diff --git a/.changeset/app-files-before-page-work.md b/.changeset/app-files-before-page-work.md
new file mode 100644
index 0000000000..a735d34b30
--- /dev/null
+++ b/.changeset/app-files-before-page-work.md
@@ -0,0 +1,8 @@
+---
+"apps": patch
+---
+
+`apps/ui/serving` exports `appFile`, which answers a version's own file, or a 404 for a missing
+dotted path, and returns `None` for the page itself, so hosts can serve files before page work.
+`appDocument` renders only the document and inlines the version watcher; `appWatchScript` is
+removed, along with the hosts' `/_executor/watch.js` routes.
diff --git a/.changeset/background-service.md b/.changeset/background-service.md
new file mode 100644
index 0000000000..889831b8b0
--- /dev/null
+++ b/.changeset/background-service.md
@@ -0,0 +1,20 @@
+---
+"@executor-js/local-server": minor
+"@executor-js/app-management": patch
+"@executor-js/desktop": minor
+"@executor-js/app-templates": patch
+---
+
+`executor` now starts one background Executor per data directory, shared by the command line,
+`executor apps` and the desktop app, and exits once the dashboard opens; the background Executor
+runs until `executor service stop`. `executor service` starts, stops and configures it, and
+`executor upgrade` stops it and starts it again on the new version. `executor apps` commands
+without `--host` or `EXECUTOR_HOST` use it and need no API key, as the app-authoring skill now says.
+Executor 1's `executor service install` and `executor service uninstall` name what to run instead.
+
+Executor desktop no longer runs its own server: it starts or joins the same background Executor and
+uses the command line's data directory, `~/.executor/v2/cli`. Its first launch moves the data of an
+earlier desktop release there, once. Command-line data already in that directory, with its apps and
+accounts, moves to `~/.executor/v2/backups/cli-data-<time>`, which the desktop names; nothing is
+merged or deleted. The command line's settings carry over, except its port and the `env` variables
+that belong to the replaced data, and the desktop says which changed.
diff --git a/.changeset/confirmed-read-retries.md b/.changeset/confirmed-read-retries.md
new file mode 100644
index 0000000000..86d8cb60c0
--- /dev/null
+++ b/.changeset/confirmed-read-retries.md
@@ -0,0 +1,12 @@
+---
+"@executor-js/sdk": patch
+---
+
+A failed call to a tool that only its MCP server labels read-only (`readOnlyHint`) is no
+longer offered as a retry. Executor keeps a read's retry advice, and repeats a refused call
+with renewed credentials, only for a query the app confirms: a declared operation, a `kinds`
+entry, an OpenAPI read method or a GraphQL query (`kindConfirmed`). Other queries fail like
+mutations, with `mayHaveWritten` and `retryable: false`. The confirmation comes only from a
+listing already kept for the app, so a failed call never evaluates the app again; a query whose
+app's tools nobody listed is unconfirmed. Apps built before `kindConfirmed` existed get this for
+every query until they are rebuilt.
diff --git a/.changeset/confirmed-tool-kinds.md b/.changeset/confirmed-tool-kinds.md
new file mode 100644
index 0000000000..f83eafa90e
--- /dev/null
+++ b/.changeset/confirmed-tool-kinds.md
@@ -0,0 +1,10 @@
+---
+"apps": patch
+---
+
+Tool listings mark a kind that the app's code or the tool's protocol decides
+with `kindConfirmed`: declared operations, `kinds` entries, OpenAPI HTTP methods
+and GraphQL operation types. A kind that comes only from an MCP server's
+`readOnlyHint` is not marked, so Executor does not offer a failed call to such a
+tool as a read's retry. A `dynamicRouter` can set `kindConfirmed` on the tools
+it lists.
diff --git a/.changeset/execute-results-whole.md b/.changeset/execute-results-whole.md
new file mode 100644
index 0000000000..d24942049e
--- /dev/null
+++ b/.changeset/execute-results-whole.md
@@ -0,0 +1,16 @@
+---
+"@executor-js/mcp": patch
+"@executor-js/sdk": patch
+"@executor-js/app-templates": patch
+---
+
+`execute` and `call` no longer limit the size of a result. A value over
+100,000 bytes used to come back from `execute` as a success with its JSON cut
+into a string that could not be parsed, and `call` refused it; both now return
+the whole value, and logs come back whole. Approval requests and an app's own
+questions are no longer refused for their size either. A failure that matches
+the runtime's 32 MiB limit on one value crossing Workers RPC now names that limit
+as the likely cause and says to ask for less if the result could be that large;
+the app's Worker can produce the same text, so a read stays retryable once. On
+local and self-host the runtime's reason for a failed call now reaches the host.
+The code-mode skill states this.
diff --git a/.changeset/failed-poll-statement.md b/.changeset/failed-poll-statement.md
new file mode 100644
index 0000000000..21c063b97e
--- /dev/null
+++ b/.changeset/failed-poll-statement.md
@@ -0,0 +1,7 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/telemetry": patch
+---
+
+A failed poll's root span now names the statement that failed: its operation,
+its table and the database's kind of failure, never its SQL or values.
diff --git a/.changeset/failed-poll-traces.md b/.changeset/failed-poll-traces.md
new file mode 100644
index 0000000000..6e0ac8cf28
--- /dev/null
+++ b/.changeset/failed-poll-traces.md
@@ -0,0 +1,10 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/hosted-server": patch
+"@executor-js/telemetry": patch
+---
+
+A check for due runs, queued provisioning jobs or event deliveries that fails is
+traced again, though a check that finds nothing is not. Each failure is
+exported as its own root span with the error it recorded, as are a failed
+claim of a due event delivery and failed event retention.
diff --git a/.changeset/graphql-stated-errors.md b/.changeset/graphql-stated-errors.md
new file mode 100644
index 0000000000..a0bf9fbd0d
--- /dev/null
+++ b/.changeset/graphql-stated-errors.md
@@ -0,0 +1,11 @@
+---
+"apps": patch
+---
+
+A `graphqlRouter` failure now quotes the errors the GraphQL server stated in its response's
+`errors` list: each message, its response path and the scalar `extensions` entries, such as
+`code`, bounded and with account secrets replaced. A client error status, such as HTTP 400 for a
+request that fails validation, reads its GraphQL errors too, from a JSON body of at most 64 KiB
+that arrives within 2 seconds; past either, the failure keeps the status and says the body was not
+read. Before, every such failure reached the caller as "GraphqlError was thrown without a
+message" with only its phase, reason and status.
diff --git a/.changeset/host-api-cache.md b/.changeset/host-api-cache.md
new file mode 100644
index 0000000000..f99ae0c3f0
--- /dev/null
+++ b/.changeset/host-api-cache.md
@@ -0,0 +1,22 @@
+---
+"@executor-js/sdk": patch
+"apps": patch
+---
+
+A host can pass `hostApi` to `createExecutor`: the SHA-256 of the API document
+it serves, the URLs it serves it at, and which app versions read it. Those
+versions' app cache and kept tool listings are keyed by the revision too, so
+after the host's API changes they read the new API on their next call instead
+of listing its removed tools until their cached document expires. That holds for
+a version that owns a database as well. Invocations carry the revision to the
+runner, whose outbound network, the data facet's included, refuses a document
+from those URLs with a different SHA-256, so a caller and an API deployed at
+different moments never keep one revision's API under the other's name. The
+app's `fetch` then rejects with the code `EXECUTOR_API_CHANGING`, and the agent
+is told that Executor's API is changing and to retry shortly; a tool call that
+may have written is told the API is changing but not to repeat it. A caller refuses
+the result of a remote runner that does not confirm the check.
+
+An app failure's `code` is the thrown error's own, or else the code of the
+error it wraps, such as the platform rejection inside the `HttpClientError`
+that `ctx.fetch` rejects with.
diff --git a/.changeset/mcp-optional-event-stream.md b/.changeset/mcp-optional-event-stream.md
new file mode 100644
index 0000000000..814a94c0d9
--- /dev/null
+++ b/.changeset/mcp-optional-event-stream.md
@@ -0,0 +1,9 @@
+---
+"apps": patch
+---
+
+`mcpRouter` no longer fails discovery when a Streamable HTTP server refuses the
+optional GET event stream, for example with a 401, while answering every POST.
+The client carries on without the stream, as the MCP SDK does. A refused POST
+still reports rejected credentials, and the legacy SSE transport's GET, which is
+its session, still fails as before.
diff --git a/.changeset/mcp-reported-tool-errors.md b/.changeset/mcp-reported-tool-errors.md
new file mode 100644
index 0000000000..d81dac43d3
--- /dev/null
+++ b/.changeset/mcp-reported-tool-errors.md
@@ -0,0 +1,12 @@
+---
+"@executor-js/mcp": patch
+"@executor-js/app-templates": patch
+---
+
+A remote MCP tool result with `isError: true` is now listed as a `failure` in the `toolCalls` of
+`execute`, `call` and `resume`, and is no longer counted in `executor.tool_call.succeeded`. It
+was listed as a `success`, though Executor already recorded the call as failed in its traces and
+analytics. The call still returns the whole result instead of throwing, so programs that read
+`isError` keep working. Fields an app defines, such as `ok: false`, are not interpreted. The
+code-mode skill and the MCP docs say to check `isError`, that a failed call may still have had
+effects, and that `success` only means no tool error was reported, not that the action happened.
diff --git a/.changeset/motel-store-low-water.md b/.changeset/motel-store-low-water.md
new file mode 100644
index 0000000000..4f573a3521
--- /dev/null
+++ b/.changeset/motel-store-low-water.md
@@ -0,0 +1,13 @@
+---
+"@executor-js/telemetry": patch
+"@executor-js/hosted-self-host": patch
+---
+
+The bundled Motel collector no longer churns once its store is full. It used to
+evict back to exactly its 1 GiB bound, so the next export crossed it again, and
+every export, about one a second on an idle server, paid for an eviction pass
+that scanned the whole store. A full store now evicts down to 90% of its bound
+and then stores exports without evicting until it fills again. On a full 1 GiB
+store with an idle server's exports, the collector's CPU fell from about 9% of a
+core to under 1%, its reads from about 30 MiB/s to about 1 MiB/s, and each
+export's time from about 120 ms to about 20 ms.
diff --git a/.changeset/oauth-refresh-redirect-uri.md b/.changeset/oauth-refresh-redirect-uri.md
new file mode 100644
index 0000000000..96771560c0
--- /dev/null
+++ b/.changeset/oauth-refresh-redirect-uri.md
@@ -0,0 +1,5 @@
+---
+"@executor-js/sdk": patch
+---
+
+Preserve the original authorization redirect URI on OAuth authorization-code grants and reuse it when refreshing their tokens.
diff --git a/.changeset/oauth-resource-indicator.md b/.changeset/oauth-resource-indicator.md
new file mode 100644
index 0000000000..4bd774fcad
--- /dev/null
+++ b/.changeset/oauth-resource-indicator.md
@@ -0,0 +1,5 @@
+---
+"apps": patch
+---
+
+The blocked-app notice for a `credentials_rejected` account reads "credentials not working at last check" instead of "sign-in rejected", because the reason also covers a sign-in that expired before any request.
diff --git a/.changeset/openapi-declared-server-errors.md b/.changeset/openapi-declared-server-errors.md
new file mode 100644
index 0000000000..cfb017d11d
--- /dev/null
+++ b/.changeset/openapi-declared-server-errors.md
@@ -0,0 +1,10 @@
+---
+"apps": patch
+---
+
+An OpenAPI operation that declares an error response for a 5xx, 401 or 429 status
+now quotes that response's declared code and message on the provider failure, as
+the service's stated error. Before, the status alone decided the failure and the
+body was not read, so an API that explains its server errors, such as Executor's
+own API through the Executor app, read as a bare "server error". The failure keeps
+its reason, status, account recovery and retry policy.
diff --git a/.changeset/openapi-held-names.md b/.changeset/openapi-held-names.md
new file mode 100644
index 0000000000..97b8479ef2
--- /dev/null
+++ b/.changeset/openapi-held-names.md
@@ -0,0 +1,12 @@
+---
+"apps": patch
+---
+
+An OpenAPI operation keeps its tool name when a later sibling's refined name
+would land on it. The sibling is refined further instead, so a name an agent or
+an approval policy already uses keeps calling the same operation. A document
+that already declares both operations names them the same way, so an app that
+upgrades to this release sees those two names change once: in a document with
+`GET /forks` and `GET /stars` (both `operationId: list`) and `GET /starred`
+(`operationId: listStars`), `repos.listStars` calls `/starred` again and `/stars`
+becomes `repos.listGet`.
diff --git a/.changeset/openapi-parameter-descriptions.md b/.changeset/openapi-parameter-descriptions.md
new file mode 100644
index 0000000000..8c7704d6bf
--- /dev/null
+++ b/.changeset/openapi-parameter-descriptions.md
@@ -0,0 +1,8 @@
+---
+"apps": patch
+---
+
+OpenAPI tools keep each parameter's `description` and `deprecated` in their
+input schema, so `describe` shows agents a path, query, header or cookie
+parameter's documentation beside it, as it already does for body properties and
+MCP tool properties. Search's one-line input types are unchanged.
diff --git a/.changeset/openapi-v1-documents.md b/.changeset/openapi-v1-documents.md
new file mode 100644
index 0000000000..f39e2c3168
--- /dev/null
+++ b/.changeset/openapi-v1-documents.md
@@ -0,0 +1,16 @@
+---
+"apps": patch
+---
+
+`liveOpenapiRouter` imports the OpenAPI documents Executor v1 imported. A schema
+reference may reach any schema in the document: a component whose name is not
+URI-encoded, a property inside a component, or a schema under `paths` or another
+component. An operation that answers with an event stream or another type, such
+as JSON, is a tool that asks for the other type. A path may carry a fixed query,
+sent before the operation's own parameters, or a fragment, which is not sent; it
+does not change the tool's name. An empty field such as `operationId:` counts as
+absent, a parameter in a location OpenAPI 3 does not have is not an input, and a
+request body without media types sends no body.
+
+`openapiOperationNames` lists every operation a document declares with the name
+the router gives it, reading the document as the router does.
diff --git a/.changeset/queue-read-indexes.md b/.changeset/queue-read-indexes.md
new file mode 100644
index 0000000000..c8a58a4283
--- /dev/null
+++ b/.changeset/queue-read-indexes.md
@@ -0,0 +1,6 @@
+---
+"@executor-js/sdk": patch
+---
+
+Webhook source ticks and account check reads use indexes instead of reading
+every row of their tables. Storage version 4.0.16 adds the indexes.
diff --git a/.changeset/request-rejections-declared.md b/.changeset/request-rejections-declared.md
new file mode 100644
index 0000000000..5de280fb87
--- /dev/null
+++ b/.changeset/request-rejections-declared.md
@@ -0,0 +1,14 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/app-management": patch
+"@executor-js/hosted-server": patch
+"@executor-js/hosted-cloud": patch
+"@executor-js/hosted-self-host": patch
+"@executor-js/local-server": patch
+---
+
+A request that does not match its operation's schema now gets a `400 RequestInvalid` that every
+operation in the Cloud, self-host and local management documents declares. It names the rejected
+part and each path with what the schema expects there, never the submitted value. Agents calling
+Executor through the Executor app see that cause instead of an HTTP 400 the document does not
+declare. App ID parameters say they take the app's `id`, not its slug.
diff --git a/.changeset/skills-input-schema.md b/.changeset/skills-input-schema.md
new file mode 100644
index 0000000000..a8dc3abc87
--- /dev/null
+++ b/.changeset/skills-input-schema.md
@@ -0,0 +1,10 @@
+---
+"@executor-js/mcp": patch
+"@executor-js/app-templates": patch
+---
+
+The MCP `skills` tool advertises the input it accepts: every input except `{}`
+needs `app`, stated as `dependentRequired` in its input schema, which is
+generated from the schema the tool decodes with. The `execute` descriptions and
+the Executor app's entry skill give the exact call,
+`skills({app: "executor", name: "executor"})`.
diff --git a/.changeset/storage-migration-diagnostics.md b/.changeset/storage-migration-diagnostics.md
new file mode 100644
index 0000000000..86864fa871
--- /dev/null
+++ b/.changeset/storage-migration-diagnostics.md
@@ -0,0 +1,6 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/hosted-server": patch
+---
+
+Report the storage version, SQLSTATE and error classes of a failed storage upgrade at startup, without its SQL, parameters or driver message.
diff --git a/.changeset/untraced-event-poll.md b/.changeset/untraced-event-poll.md
new file mode 100644
index 0000000000..10ada67374
--- /dev/null
+++ b/.changeset/untraced-event-poll.md
@@ -0,0 +1,8 @@
+---
+"@executor-js/sdk": patch
+---
+
+Self-host and local check for due event deliveries every two seconds. That
+check no longer records traces when it finds nothing to deliver; each delivery
+attempt and each subscription it expires is still traced. An idle self-host
+instance no longer fills the bundled Motel store with polling spans.
diff --git a/.changeset/untraced-idle-polls.md b/.changeset/untraced-idle-polls.md
new file mode 100644
index 0000000000..8a03940249
--- /dev/null
+++ b/.changeset/untraced-idle-polls.md
@@ -0,0 +1,11 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/hosted-server": patch
+---
+
+The scheduler's check for due runs, every second on self-host and local, and
+self-host's check for queued provisioning jobs, every second, no longer record
+traces when they find nothing to do. Each scheduled operation a check finds is
+still traced, in its own `schedule.dispatch` trace, and so is each provisioning
+job. An idle self-host instance no longer fills the bundled Motel store with
+polling spans.
diff --git a/.changeset/upgrade-follow-redirects.md b/.changeset/upgrade-follow-redirects.md
new file mode 100644
index 0000000000..e88af3b81c
--- /dev/null
+++ b/.changeset/upgrade-follow-redirects.md
@@ -0,0 +1,7 @@
+---
+"executor": patch
+---
+
+`executor upgrade` on an install from the install script downloads the release again. It checked
+the status of GitHub's redirect to each release file instead of following it, so every upgrade
+failed with "could not download SHA256SUMS" and changed nothing.
diff --git a/.changeset/workflow-control-failures.md b/.changeset/workflow-control-failures.md
new file mode 100644
index 0000000000..09430f923a
--- /dev/null
+++ b/.changeset/workflow-control-failures.md
@@ -0,0 +1,23 @@
+---
+"apps": patch
+"@executor-js/sdk": patch
+"@executor-js/app-templates": patch
+---
+
+`ctx.workflows.start`, `get`, `list` and `terminate` work again in apps built on `apps`
+0.0.1-beta.91 or earlier. Since the rename of deployments to versions the host sent runs
+without their former `deployment` field, so those apps could not read any answer and every
+call failed as a retryable `engine` failure, even when the run had started. The host now sends
+runs in their encoded form, with both names.
+
+A control call the host refuses, such as a `key` over 128 characters, fails with reason `input`,
+not retryable, and a message naming the field and the rule it broke; no run is started. A start
+whose run was saved, including one whose storage failed right after the save, fails as `engine`,
+not retryable, with the run's ID. A start whose commit failed or timed out answers with its run
+when Executor can read it back. A start whose save may have committed, and a `start` or
+`terminate` that Executor did not answer or whose answer the app could not read, are not
+retryable either, and their message says the run may have started or stopped and how to check. A
+start without a key is never told to start again, since that would create another run.
+Executor's own errors keep their tag and message through workflow controls.
+
+The app-authoring skill lists the workflow limits and what each control failure means.
diff --git a/AGENTS.md b/AGENTS.md
index 601ad089fe..7ee0052389 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -135,9 +135,9 @@ a `workflow_call` workflow, so another repository can call the same jobs.
 ### Choosing a PR's E2E scenarios
 
 A pull request runs only the E2E scenarios it selects. Pushes to `main` run the
-full suite. The static checks (`check`, `apps-version`, `self-host-native`) always
-run, except in a skipped stack layer. Put exactly one fenced `e2e` block in the PR
-description, listing spec files from `e2e/tests/`:
+full suite. The static checks (`check` and the jobs it gates, `apps-version`,
+`self-host-native`) always run, except in a skipped stack layer. Put exactly one
+fenced `e2e` block in the PR description, listing spec files from `e2e/tests/`:
 
 ````md
 ```e2e
@@ -242,14 +242,19 @@ Do not run CI checks on macOS runners. They cost 5-20x as much per minute as Lin
 runners and were most of the CI bill, and no check needs macOS. Fix slow or flaky
 scenarios on Linux instead of moving them to a Mac.
 
-- `check` runs `bun run check`: the format check, `oxlint`, the typecheck, the
+- `check` passes when `select` and each static check job passed. The static checks run as
+  parallel jobs, so a pull request waits for the slowest, about a minute and a half, not their
+  sum. `static` runs `bun run check`: the format check, `oxlint`, the typecheck, the
   no-tests-outside-`e2e/` check and the e2e boundary check.
-  It also builds the public site and runs `bun run site:links`, which fails when
+  `site` builds the public site and runs `bun run site:links`, which fails when
   any marketing or docs page links to a path that would 404. Then
   `bun run hosted:cloud:worker-sizes` builds each Cloud Worker as the deploy does,
   for production and for the pull request's preview, and fails when one exceeds
   its upload budget; the job summary shows each Worker's size, its change from
-  `main` and the packages and files that grew.
+  `main` and the packages and files that grew. `apps-package` checks the apps npm
+  tarball, and `tooling` checks the dependency patches and the scripts that run CI,
+  releases, the public export and deploys. Put a new static check in the job it fits, or
+  in a new job that `check` needs.
 - `select` runs [`e2e/ci-selection.ts`](e2e/ci-selection.ts) and gives each e2e job
   its `--test-name` pattern, or skips the job when none of its scenarios is selected.
   Its job patterns hold the exclusions and splits below.
@@ -278,8 +283,9 @@ scenarios on Linux instead of moving them to a Mac.
   per-address limit off, as deployed test stages do; the scenario that proves the limit gets
   its own local Cloud with it on (`e2e:cloud --auth-rate-limit`).
   Each of these local Clouds is a Cloud job in `e2e/ci-selection.ts`, and its `runner`
-  there puts it on one of three `e2e-cloud` runners that run at once, about four minutes each
-  on a full run. Each runner builds the apps package and Motel once before its runs; runs only
+  there puts it on one of four `e2e-cloud` runners that run at once. On a full run
+  `cloud-product` has a runner to itself, about eleven minutes, and the others take about six or
+  seven each. Each runner builds the apps package and Motel once before its runs; runs only
   serve that Motel bundle, because every target in a run shares it.
 - `e2e` passes when `select` succeeded, every E2E job it chose passed and every other one was
   skipped; it runs even after a cancellation, which fails it. The matrix runners' check
@@ -294,6 +300,14 @@ Release PRs build and test the Linux and Windows targets only. The macOS targets
 on manual dispatch, where they are built, signed, notarized and tested. macOS runners
 cost 5-20x as much as Linux runners, so keep them off pull requests.
 
+A pull request that changes the release paths (the `paths` in
+`.github/workflows/release-artifacts.yml`) also runs "Executor releases". Gate its
+merge on that workflow as on CI: wait for both
+(`ci-wait --workflow CI --workflow "Executor releases"`) and do not merge while
+either fails. Its packaging jobs fail when a native archive exceeds the npm budget
+(`npmArchiveBudgetBytes` in `scripts/releases/config.ts`); an archive over it cannot be
+published, so that failure blocks every later release until it is fixed.
+
 A failed e2e job uploads raw reports and server logs. Product database files,
 runtime dependencies and private `actors.json` sessions are excluded.
 Reports use Vitest's final result, including setup and cleanup failures.
diff --git a/README.md b/README.md
index 9710206698..a4a172c1c3 100644
--- a/README.md
+++ b/README.md
@@ -319,9 +319,12 @@ bun run web:build
 bun run server
 ```
 
-Run `bun run executor` to start the server and open an authenticated dashboard.
-Use `bun run executor serve` for headless startup, or `bun run executor pair` to
-get a fresh one-use connection link for an already running server. Browser
+Run `bun run executor` to start or join the background server and open an
+authenticated dashboard; the server keeps running until
+`bun run executor service stop`. Use `bun run executor serve` to run it in the
+foreground without a browser, or `bun run executor pair` to get a fresh one-use
+connection link for the running server. See the
+[background service](apps/local/server/README.md#background-service). Browser
 sessions use HttpOnly cookies; no API key is pasted or stored in the browser.
 Apps and Accounts show persisted state. Open an app to inspect its live tools, selected
 accounts, and retained source. Reads use Effect Atom with the server's typed
diff --git a/apps/cli/CHANGELOG.md b/apps/cli/CHANGELOG.md
index 870fd7ba93..db0a1009a5 100644
--- a/apps/cli/CHANGELOG.md
+++ b/apps/cli/CHANGELOG.md
@@ -1,5 +1,37 @@
 # executor
 
+## 2.0.0-beta.34
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.33
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.32
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.31
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.30
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.29
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.28
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
+## 2.0.0-beta.27
+
+Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
+
 ## 2.0.0-beta.26
 
 Nightly beta of the Executor local runtime, CLI, desktop, and self-host Docker image.
diff --git a/apps/cli/package.json b/apps/cli/package.json
index 82585803fc..a4999471b9 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "executor",
-  "version": "2.0.0-beta.26",
+  "version": "2.0.0-beta.34",
   "private": true,
   "description": "Run Executor locally and connect your agents to your apps.",
   "homepage": "https://executor.sh",
diff --git a/apps/docs/content/mcp-clients.mdx b/apps/docs/content/mcp-clients.mdx
index 4c26a1b427..3ebf5325a7 100644
--- a/apps/docs/content/mcp-clients.mdx
+++ b/apps/docs/content/mcp-clients.mdx
@@ -109,8 +109,10 @@ browser the first time the client connects.
 
 ## Connecting to a local server
 
-A local server has no browser sign-in. It authenticates with the API key you
-configured as `EXECUTOR_API_KEY`, sent as a bearer token:
+A local server also signs clients in through your browser, using the dashboard
+you paired with `executor`. A client that cannot sign in can send the local API
+key as a bearer token instead. The port is `4312` unless you changed it with
+`executor service set port`:
 
 <CodeGroup>
 
@@ -135,8 +137,9 @@ npx add-mcp 'http://127.0.0.1:4312/mcp' --transport http --name executor \
 
 </CodeGroup>
 
-The local Connect page shows this with your real key. Keep the local server
-running while the client is connected.
+The background Executor keeps running until you stop it, but it does not start
+with your computer: after a restart, run `executor` or `executor service start`,
+or the client's connection is refused.
 
 ## Choosing where approvals appear
 
diff --git a/apps/docs/content/mcp.md b/apps/docs/content/mcp.md
index 06f9d33c35..22f2abb3db 100644
--- a/apps/docs/content/mcp.md
+++ b/apps/docs/content/mcp.md
@@ -45,9 +45,8 @@ For one or a few calls, an agent needs no program:
 
 `call` returns each call's outcome in order, with `ok` and its `value` or
 `error`. One failed call does not stop the others. An unknown path comes back
-with the closest paths. A result that would pass the output limit is refused
-rather than cut, with a pointer to `execute`, which can return only the fields
-you need. Approvals and input pause `call` exactly as they pause `execute`,
+with the closest paths. Results come back whole, however large; `execute` can
+return only the fields you need. Approvals and input pause `call` exactly as they pause `execute`,
 except in [native mode](#elicitation-modes): there `call` is marked destructive
 and open-world, so your MCP client confirms each call before it runs, and that
 confirmation answers the apps' approval policies. Tool input still opens the
@@ -88,6 +87,14 @@ The agent can call several tools, join the results and return only the part it
 needs. That is the point: the whole result set never has to pass through the
 model's context.
 
+A remote MCP tool returns its whole MCP result: `content`, `structuredContent`
+and `isError`. `isError: true` is the tool saying it failed. The call returns
+that result instead of throwing, so programs that read `isError` keep working,
+and the result's `toolCalls` lists the call with outcome `failure`. The server
+may still have made changes. `call` lists it the same way. An outcome of
+`success` only means no tool error was reported; check the result before
+treating its action as done.
+
 The interpreter has no `fetch`, no `process`, no filesystem, no timers and no
 imports. Its only way out is a tool call, which enters the trusted runtime where your
 credentials live. Limits are cooperative, not process isolation. Discovery is
@@ -95,8 +102,13 @@ not cached across changes, so run `tools.search` again in a new `execute` after
 you add or reconfigure an app.
 
 Some limits are fixed by the server and a client cannot raise them: 65,536
-characters of program source, 100 tool calls, 5 minutes, and 100,000 bytes of
-output. Time spent waiting for your approval or input does not count toward the
+characters of program source, 100 tool calls and 5 minutes. Executor does not
+limit the size of a result. The runtime limits one value crossing between an app
+and Executor, such as a tool's result, to 32 MiB, and on Cloud a result of a few
+tens of megabytes can pass the MCP session's 128 MB memory. Failures Executor
+recognizes at these limits return an error naming the likely limit, never a cut
+value. A failure that loses the response first, such as a 64 MiB value on Cloud,
+can end with no answer before the client's timeout. Time spent waiting for your approval or input does not count toward the
 5 minutes. Execute returns the result when the program ends, or sooner with a
 request for approval or input when the program pauses. An MCP client with a
 shorter tool-call timeout, often 60 seconds, may give up and cancel the program.
diff --git a/apps/docs/content/run/cli.mdx b/apps/docs/content/run/cli.mdx
index df7360376c..1503cfdb05 100644
--- a/apps/docs/content/run/cli.mdx
+++ b/apps/docs/content/run/cli.mdx
@@ -16,9 +16,11 @@ accounts, runs your apps, and serves an MCP endpoint for your agents.
 
 <ReleaseCommand product="cli-homebrew" />
 
-`executor` starts the server and opens the dashboard in your browser. Executor
-is one executable with its runtime, dashboard, Git and workerd beside it; no
-source checkout, Node or Bun is needed to run it.
+`executor` starts Executor in the background, opens the dashboard in your
+browser and exits. Executor keeps running until you stop it; see
+[The background Executor](#the-background-executor). Executor is one executable
+with its runtime, dashboard, Git and workerd beside it; no source checkout, Node
+or Bun is needed to run it.
 
 The npm package is a small launcher: npm installs the executable for your
 platform as an optional dependency. If `executor` reports that its native
@@ -44,12 +46,11 @@ Windows Credential Manager, or Linux Secret Service. Unlock the credential store
 and allow Executor access when asked. If there is no credential store on the
 first launch, for example on a Linux server without GNOME Keyring, Executor saves
 the keys to `keys.json` in its data directory instead. The file is readable only
-by your user, and Executor prints its path when it creates it. Keep that
-directory private. If a credential store exists but access is denied, for
-example because you dismissed the prompt or the store is locked, Executor stops
-without writing `keys.json`. Start it again to be asked again. Where no prompt
-can appear, such as over SSH, unlock the store first: on Linux run
-`gnome-keyring-daemon --unlock`, on macOS `security unlock-keychain`.
+by your user. Keep that directory private. If a credential store exists but
+access is denied, for example because you dismissed the prompt or the store is
+locked, Executor stops without writing `keys.json`. Start it again to be asked
+again. Where no prompt can appear, such as over SSH, unlock the store first: on
+Linux run `gnome-keyring-daemon --unlock`, on macOS `security unlock-keychain`.
 
 To use `keys.json` on a new data directory even when a credential store works,
 set `EXECUTOR_KEY_STORAGE=file` for its first start. Set
@@ -59,20 +60,19 @@ value that does not match the directory stops startup and changes nothing.
 
 | Command | Purpose |
 | --- | --- |
-| `executor` | Start the server and open the dashboard. |
-| `executor serve` | Start without opening a browser. |
-| `executor pair` | Print a new connection link for the running server. |
+| `executor` | Start the background Executor if it is not running, open the dashboard and exit. |
+| `executor service` | Start, stop and configure the background Executor. |
+| `executor serve` | Run Executor in this terminal, without opening a browser, until you press Ctrl+C. |
+| `executor pair` | Print a new connection link for the background Executor. |
 | `executor apps` | Create, edit, deploy and install apps. See [Author an app](/author-an-app). |
 | `executor upgrade` | Install the newest release the way Executor was installed; `--rollback` returns to the previous one. |
-| `executor rotate-key` | Replace the saved API key. Restart Executor, then update clients that used the old key. |
+| `executor rotate-key` | Replace the saved API key. Run `executor service restart`, then update clients that used the old key. |
 
-`executor pair` asks the server on `EXECUTOR_PORT` for a link, using the API key
-saved in `EXECUTOR_DATA_DIR`, or `EXECUTOR_API_KEY` when you set it. Run it with
-the same values as the server. It only reads the key: it never creates a data
-directory or keys. If it reports that the server did not accept the key, the
-server uses another data directory, or its key was rotated and it has not
-restarted yet. Executor desktop keeps its own data directory; use its
-**File > Open in browser** menu item instead.
+`executor pair` asks the background Executor for a link, waiting up to 30
+seconds while it starts, stops or does not respond. It only reads: it never
+starts Executor or creates a data directory or keys. When you set
+`EXECUTOR_API_KEY`, it sends that key instead, to the background Executor or,
+when none runs, to the server on `EXECUTOR_PORT`.
 
 ### Coming from Executor 1
 
@@ -80,21 +80,98 @@ Executor 2 answers the old commands with the command to run instead.
 
 | Executor 1 | Executor 2 |
 | --- | --- |
-| `executor web` | `executor` starts the server and opens the dashboard. If the server is already running, `executor pair` prints a link to open instead. |
-| `executor open` | `executor pair` prints a connection link for the running server. |
-| `executor daemon run` | `executor serve` starts the server without opening a browser. |
-| `executor install`, `executor service install` | No background service yet. Keep `executor serve` running while your agents use Executor. |
-| `executor mcp` | The running server serves MCP over HTTP at `http://127.0.0.1:4312/mcp`; see [Connect an agent](#connect-an-agent). |
+| `executor web` | `executor` starts the background Executor if needed and opens the dashboard. |
+| `executor open` | `executor pair` prints a connection link for the background Executor. |
+| `executor daemon run` | `executor service start` starts the background Executor without opening a browser. It runs until `executor service stop`. |
+| `executor install`, `executor service install` | Nothing to install. `executor` or `executor service start` starts the background Executor, which runs until you stop it; it does not start with your computer. |
+| `executor service uninstall` | Nothing to remove. `executor service stop` stops the background Executor. |
+| `executor mcp` | The background Executor serves MCP over HTTP at `http://127.0.0.1:4312/mcp`; see [Connect an agent](#connect-an-agent). |
 | `executor call`, `executor tools`, `executor resume` | Agents call tools through the MCP endpoint. |
 | `executor server` | No server profiles. `executor apps` commands take `--host`, and `executor rotate-key` replaces `executor server rotate-token`. |
 | `executor login` | `executor apps login --host https://api.executor.sh` signs in to hosted Executor for app commands. |
 | `executor docs` | Open [executor.sh/docs](https://executor.sh/docs). |
 
+## The background Executor
+
+Each data directory has one background Executor that every command shares. The
+first command that needs it starts it: `executor`, `executor service start` or
+an `executor apps` command. It keeps running after that command exits, until you
+run `executor service stop`. Nothing is installed with your operating system, so
+it does not start again after you restart your computer: MCP clients cannot
+connect until you run `executor` or `executor service start`.
+
+The desktop app uses the same background Executor and data directory. When you
+stop it, with `executor service stop` or by changing a setting, the desktop app
+says it was stopped and does not start it again. It reconnects once a command
+starts it, or when you click **Start** there.
+
+Desktop app releases before the background Executor kept their own data. The
+first launch of a newer desktop app moves that data into the command line's data
+directory, `~/.executor/v2/cli`, once, so both use the same apps and accounts.
+Nothing is merged: if the command line already had data there, the desktop
+app's data replaces it, and the command line's folder, with its apps, accounts
+and `service.json`, moves to `~/.executor/v2/backups/cli-data-<time>`. Either
+way its settings carry over, except the port, which becomes the desktop app's,
+and the `env` variables that belong to the replaced data: `EXECUTOR_PORT`,
+`EXECUTOR_KEY_STORAGE`, `EXECUTOR_API_KEY` and `EXECUTOR_ENCRYPTION_KEY`. The
+desktop app names that folder and says which settings changed. Nothing is
+deleted: the desktop app's old folder moves to
+`~/.executor/v2/backups/desktop-data-<time>`, or stays where it was when it is
+on another drive. A desktop app that never started successfully has no data to
+move, and the command line's data is left alone.
+
+When the background Executor runs another version, `executor` stops it and
+starts its own version. Other commands use whichever version is running. An
+upgrade outside `executor upgrade`, such as `brew upgrade`, `npm i -g` or the
+install script, removes or replaces the executable it runs from. It then stops
+by itself within five seconds, and the next command starts the installed
+version; the install script stops it first. On Windows the files of a running
+program cannot be replaced, so run `executor service stop` before you install
+with npm, pnpm, Bun or Yarn.
+
+| Command | Purpose |
+| --- | --- |
+| `executor service start` | Start the background Executor, or confirm that it runs, and print its URL. |
+| `executor service stop` | Stop it. |
+| `executor service restart` | Stop it and start this version. |
+| `executor service status` | Print its URL, version and process ID, with `starting`, `stopping` or `not responding` before them while it starts, stops or does not answer, or `stopped`. |
+| `executor service get [setting]` | Print every setting as JSON, or one setting. |
+| `executor service set <setting> <value>` | Change a setting. |
+| `executor service unset <setting>` | Remove a setting. |
+
+| Setting | Purpose |
+| --- | --- |
+| `port` | The port it listens on. `EXECUTOR_PORT` wins over it; the default is `4312`. Each data directory's background Executor needs its own port. |
+| `env` | Extra environment variables for it: `executor service set env <name> <value>`, `executor service unset env <name>`. |
+| `disabled` | `true` makes `executor`, and `executor apps` commands without `--host` or `EXECUTOR_HOST`, run a private server for the command instead, as `--standalone` does. `executor service start`, `executor pair` and the desktop app still use the background Executor. |
+
+Changing `port` or `env`, or setting `disabled` to `true`, stops the background
+Executor; the next command that needs it starts it with the new settings. It
+runs with the environment of the command that started it plus `env`, so use
+`env` for variables it should always have, such as `EXECUTOR_BROWSER_ORIGIN`.
+`EXECUTOR_API_KEY` and `EXECUTOR_ENCRYPTION_KEY` reach it only when both are
+set, as for supplied keys; `EXECUTOR_API_KEY` alone is only the key the command
+itself sends.
+
+The data directory holds the settings in `service.json`. While Executor runs,
+`server.json` records its address, process ID and a password that changes each
+time it starts, and `.server.lock` stops a second server from opening the same
+data directory. `service.json` and `server.json` are readable only by your user.
+
+`executor --standalone` runs a private server on a free port for that command
+instead, until you press Ctrl+C. It uses the same data directory, so stop the
+background Executor first or set `EXECUTOR_DATA_DIR` to another folder.
+`executor --server <url>` opens the dashboard of an Executor server that already
+runs at that URL, using `EXECUTOR_API_KEY` or the API key saved in the data
+directory. `executor serve` runs Executor in your terminal instead of the
+background, so stop the background Executor first; while it runs, other commands
+use it as they would the background Executor.
+
 ## Configure it
 
 | Variable | Purpose |
 | --- | --- |
-| `EXECUTOR_PORT` | Port, default `4312`. |
+| `EXECUTOR_PORT` | Port. Wins over the `port` setting; the default is `4312`. |
 | `EXECUTOR_NO_UPDATE_CHECK` | Set to `1` to skip the daily check for a newer release. |
 | `EXECUTOR_DATA_DIR` | Data directory, default `~/.executor/v2/cli`. |
 | `EXECUTOR_BROWSER_ORIGIN` | Exact HTTPS origin for generated browser links. |
@@ -113,7 +190,9 @@ and a directory using `keys.json` needs that file.
 
 Use the dashboard's **Connect** card to add the local MCP endpoint to your
 agent. See [Add an MCP client](/mcp-clients) for Claude Code, Cursor and Codex.
-Keep Executor running while the client is connected.
+The client connects to the background Executor. After you restart your
+computer, run `executor` or `executor service start` first; until then the
+client's connection is refused. If you change the port, update the client's URL.
 
 ## Back up and update
 
@@ -156,14 +235,22 @@ release needs the version and confirmation, or `--yes` without a terminal. If
 you run Executor through `npx`, `bunx` or `pnpm dlx`, there is nothing to
 upgrade: run `npx executor@beta` to get the newest release. When Executor cannot
 tell which package manager installed it, it prints the install command for each
-one instead of guessing. A running `executor` or `executor serve` keeps using
-the old version until you restart it; `executor upgrade` says when one is
-running. Executor never updates itself without being asked.
-
-The desktop app uses the same local server with a separate
-profile. It checks for updates in the background and asks before restarting to
-install one. Beta installs follow beta releases and move to stable when it is
-newer. On Linux, only the AppImage updates itself; install a newer `.deb` over
-the existing package.
+one instead of guessing.
+
+The upgrade replaces the files the background Executor runs from, so
+`executor upgrade` and `executor upgrade --rollback` stop it first and start it
+again on the new version afterwards. If the upgrade fails or you cancel it, the
+old version starts again. If the new version does not start, the upgrade still
+succeeds and tells you to run `executor service start`. A release from before
+the background Executor, which `--rollback` or an older version can install,
+has no `executor service`: run `executor serve`, or `executor`, and keep it
+running. A background Executor from a development build keeps running. Executor
+never updates itself without being asked.
+
+The desktop app shares the background Executor with the command line. It
+checks for updates in the background and asks before restarting to install one.
+Beta installs follow beta releases and move to stable when it is newer. On
+Linux, only the AppImage updates itself; install a newer `.deb` over the
+existing package.
 
 <ReleaseDesktopLink />
diff --git a/apps/docs/content/run/self-host.mdx b/apps/docs/content/run/self-host.mdx
index 352baf5c15..50cb50a526 100644
--- a/apps/docs/content/run/self-host.mdx
+++ b/apps/docs/content/run/self-host.mdx
@@ -32,7 +32,8 @@ These settings override the defaults:
 | `EXECUTOR_OAUTH_CLIENT_METADATA_URL` | no       | Identify Executor to OAuth services by a client metadata document instead of registering a client. Off by default. See below. |
 | `EXECUTOR_CATALOG_URL`               | no       | `index.json` of the official app feed that **Add app** lists. Without it, Add app lists only the built-in Executor app. |
 | `EXECUTOR_TOOL_LISTING_FRESH_SECONDS` | no     | Reuse an app's evaluated tool list this long before refreshing it in the background. The default is `30`. |
-| `EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS` | no  | Never serve an evaluated tool list older than this; `0` evaluates every list. The default is `86400`. |
+| `EXECUTOR_TOOL_LISTING_RENEW_SECONDS` | no     | Renew the tool lists search serves in the background once they are this old. The default is `86400`. |
+| `EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS` | no  | Never serve an evaluated tool list older than this; `0` evaluates every list. The default is `604800`. |
 | `EXECUTOR_TOOL_LISTING_LOAD_SECONDS` | no     | Stop evaluating an app's tool list after this long when no request is waiting for it; capped at the maximum age. The default is `45`. |
 | `EXECUTOR_EVALUATION_MEMORY_MB`      | no       | Memory for kept tool lists and app declarations. The default is `256`.  |
 | `EXECUTOR_NPM_REGISTRY`              | no       | npm registry that app builds install packages from. The default is `https://registry.npmjs.org`. |
diff --git a/apps/docs/content/run/tracing.md b/apps/docs/content/run/tracing.md
index ab7385769e..9106679a71 100644
--- a/apps/docs/content/run/tracing.md
+++ b/apps/docs/content/run/tracing.md
@@ -18,7 +18,7 @@ Where it writes depends on where you run:
 
 | Deployment | Diagnostics directory                                                       |
 | ---------- | --------------------------------------------------------------------------- |
-| Local      | `<EXECUTOR_DATA_DIR>/diagnostics`, by default `.local/executor/diagnostics` |
+| Local      | `<EXECUTOR_DATA_DIR>/diagnostics`, by default `~/.executor/v2/cli/diagnostics` |
 | Self-host Docker | `EXECUTOR_MOTEL_DATA_DIR`, by default `/app/motel-data`              |
 
 The local diagnostics directory holds:
@@ -27,7 +27,8 @@ The local diagnostics directory holds:
   path.
 - `motel/` — the stored traces and logs, as Motel's SQLite files.
 - `executor-local.jsonl` or `executor-selfhost.jsonl` — Effect logs, written
-  independently of the collector.
+  independently of the collector. The background Executor writes its logs only
+  here.
 
 Motel keeps seven days and targets 1 GiB. Each log file keeps four rotated
 archives at about 10 MiB each.
diff --git a/apps/docs/content/run/usage-analytics.md b/apps/docs/content/run/usage-analytics.md
index 38d7f58479..55db45015a 100644
--- a/apps/docs/content/run/usage-analytics.md
+++ b/apps/docs/content/run/usage-analytics.md
@@ -24,8 +24,10 @@ returns `FeedbackDisabled`.
 ## What is sent
 
 Each event carries an anonymous install ID, made on first start and kept in the
-data directory, plus the product (`cli`, `desktop` or `self-host`) and its
-version.
+data directory, plus the product and its version. The product is `self-host` or
+`cli`: the desktop app uses the command line's background Executor, which sends
+its events as `cli`. Desktop app releases from before the background Executor
+send `desktop`.
 
 - **Startup:** product, version, release channel, operating system,
   architecture, and the number of apps and accounts. Self-host adds the number
diff --git a/apps/docs/evals.yaml b/apps/docs/evals.yaml
index 15c9e05954..710a66b7a7 100644
--- a/apps/docs/evals.yaml
+++ b/apps/docs/evals.yaml
@@ -95,7 +95,7 @@ questions:
       - 100 tool calls
       - 5 minutes
       - 65,536 characters of program source
-      - 65,536 bytes of output
+      - no limit on the size of a result
       - a client cannot raise them
     routes:
       - /mcp
diff --git a/apps/docs/public/install.ps1 b/apps/docs/public/install.ps1
index e7ae8aef08..ad9c62ca0b 100644
--- a/apps/docs/public/install.ps1
+++ b/apps/docs/public/install.ps1
@@ -6,7 +6,9 @@
 # It downloads the release archive from the public GitHub release, checks it against the
 # release's SHA256SUMS, unpacks it into %USERPROFILE%\.executor\v2\runtime\versions\<version>,
 # points the runtime\current junction at it and adds runtime\current to your user PATH. The
-# version it replaces stays as `previous`, so `executor upgrade --rollback` can switch back.
+# version it replaces stays as `previous`, so `executor upgrade --rollback` can switch back. A
+# running background Executor is stopped first; the next `executor` command starts it on the new
+# version.
 #
 # Settings: EXECUTOR_VERSION (or the first argument), EXECUTOR_INSTALL_DIR, EXECUTOR_DOWNLOAD_URL,
 # EXECUTOR_NPM_REGISTRY, and EXECUTOR_NO_MODIFY_PATH=1 to leave PATH alone.
@@ -71,6 +73,26 @@ try {
     Fail "the downloaded Executor did not start on this machine. Nothing was installed."
   }
 
+  # A background Executor may run from a version this replaces or removes, and Windows cannot
+  # remove the files of a running program, so the installed Executor stops it first, as
+  # `executor upgrade` does. A version from before the background service has no
+  # `executor service` and runs none; a development build's runs from its checkout and is left
+  # alone. This script does not start it again: a server started from here would hold this shell's
+  # inheritable handles, such as the pipe a caller reads its output from, for as long as it runs.
+  $installed = Join-Path $root "current\executor.exe"
+  if (Test-Path $installed) {
+    # Its errors, such as from a version without `executor service`, only leave it running.
+    $ErrorActionPreference = "Continue"
+    $status = "$(& $installed service status 2>$null)"
+    # A registered server prints its URL, version and process, whether it answers or not.
+    if ($status -match 'http://\S+ \(version [^,]+, process \d+\)' -and $status -notmatch '\(version 0\.0\.0-dev,') {
+      & $installed service stop *> $null
+      if ($LASTEXITCODE -eq 0) { Write-Host "Stopped the background Executor; the next executor command starts it on $Version." }
+      else { Write-Host "The background Executor did not stop. Run executor service restart once the install is done." }
+    }
+    $ErrorActionPreference = "Stop"
+  }
+
   $versions = Join-Path $root "versions"
   New-Item -ItemType Directory -Force -Path $versions | Out-Null
   $destination = Join-Path $versions $Version
diff --git a/apps/docs/public/install.sh b/apps/docs/public/install.sh
index 953f57b3ab..7680160bf5 100755
--- a/apps/docs/public/install.sh
+++ b/apps/docs/public/install.sh
@@ -8,8 +8,9 @@
 # against the release's SHA256SUMS, unpacks it into ~/.executor/v2/runtime/versions/<version>,
 # points ~/.executor/v2/runtime/current at it and links ~/.local/bin/executor to
 # current/executor. The version it replaces stays as `previous`, so `executor upgrade --rollback`
-# can switch back. Your shell profile is never edited: if ~/.local/bin is not on PATH, the script
-# prints the line to add.
+# can switch back. A running background Executor is stopped first; the next `executor` command
+# starts it on the new version. Your shell profile is never edited: if ~/.local/bin is not on
+# PATH, the script prints the line to add.
 #
 # Settings: EXECUTOR_VERSION (or the first argument), EXECUTOR_INSTALL_DIR (default
 # ~/.executor/v2/runtime), EXECUTOR_BIN_DIR (default ~/.local/bin), EXECUTOR_DOWNLOAD_URL and
@@ -110,6 +111,24 @@ reported="$("$temporary/unpacked/package/executor" --version 2>/dev/null || true
 [ "$reported" = "executor v$version" ] ||
   fail "the downloaded Executor did not start on this machine. Nothing was installed."
 
+# A background Executor may run from a version this replaces or removes, so the installed
+# Executor stops it first, as `executor upgrade` does. A version from before the background
+# service has no `executor service` and runs none; a development build's runs from its checkout
+# and is left alone. One that does not stop stops by itself if this removes its executable.
+installed="$root/current/executor"
+if [ -x "$installed" ]; then
+  case "$("$installed" service status </dev/null 2>/dev/null || true)" in
+    *"(version 0.0.0-dev,"*) ;;
+    *"http://"*" (version "*", process "*")") # Registered, whether it answers or not.
+      if "$installed" service stop </dev/null >/dev/null 2>&1; then
+        printf 'Stopped the background Executor; the next executor command starts it on %s.\n' "$version"
+      else
+        printf 'The background Executor did not stop. Run executor service restart once the install is done.\n'
+      fi
+      ;;
+  esac
+fi
+
 # The version directory is complete before anything points at it.
 staged="$root/versions/.$version.$$"
 rm -rf "$staged"
diff --git a/apps/hosted/cloud/alchemy.deploy-events.ts b/apps/hosted/cloud/alchemy.deploy-events.ts
new file mode 100644
index 0000000000..ef6248bef1
--- /dev/null
+++ b/apps/hosted/cloud/alchemy.deploy-events.ts
@@ -0,0 +1,75 @@
+/**
+ * Production deploy events (`src/infrastructure/deploy-events.ts`; `notes/ci.md`, "Deploy
+ * events"): the Axiom dataset the recorder (`.github/workflows/deploy-events.yml`) records each
+ * Deploy attempt in, an ingest-only token for it, and the repository secret and variable the
+ * recorder reads them from.
+ *
+ * It owns nothing else. The CI stack (`alchemy.github.ts`) keeps every other secret, variable,
+ * environment and repository setting, and this stack has its own state, so applying it cannot change
+ * them. The secret and variable are repository-scoped, not in `production`: on this repository's
+ * plan an environment cannot be limited to `main`, so a dedicated one would restrict nothing more,
+ * and the recorder needs none of production's credentials (`notes/ci.md`).
+ *
+ *   bun run deploy-events:plan
+ *   bun run deploy-events:deploy
+ */
+import * as Alchemy from "alchemy";
+import * as Axiom from "alchemy/Axiom";
+import * as GitHub from "alchemy/GitHub";
+import * as Output from "alchemy/Output";
+import { retain } from "alchemy/RemovalPolicy";
+import { Config, Effect, Layer } from "effect";
+import {
+  deployEventsDataset,
+  deployEventsTokenSecret,
+  deployEventsUrlVariable,
+} from "./src/infrastructure/deploy-events.ts";
+import { stackState } from "./src/infrastructure/state.ts";
+
+export default Alchemy.Stack(
+  "executor-next-deploy-events",
+  {
+    providers: Layer.mergeAll(Axiom.providers(), GitHub.providers()),
+    state: stackState,
+  },
+  Effect.gen(function* () {
+    const owner = yield* Config.NonEmptyString("GITHUB_OWNER");
+    const repository = yield* Config.NonEmptyString("GITHUB_REPOSITORY_NAME");
+
+    const dataset = yield* Axiom.Dataset("DeployEvents", {
+      name: deployEventsDataset,
+      kind: "axiom:events:v1",
+      description: "One event per attempt of the production Deploy workflow",
+    }).pipe(retain());
+    // Axiom returns the token's value once, on creation, so Alchemy copies it into the secret.
+    // Named through the dataset's output, so the token is created after the dataset it names.
+    const ingest = yield* Axiom.ApiToken("DeployEventsIngest", {
+      name: `${deployEventsDataset}-ingest`,
+      datasetCapabilities: dataset.name.pipe(
+        Output.map((name) => ({ [name]: { ingest: ["create" as const] } })),
+      ),
+    }).pipe(retain());
+    yield* GitHub.Secret(deployEventsTokenSecret, {
+      owner,
+      repository,
+      name: deployEventsTokenSecret,
+      value: ingest.token,
+    }).pipe(retain());
+    // The dataset's own edge deployment ingests its events.
+    yield* GitHub.Variable(deployEventsUrlVariable, {
+      owner,
+      repository,
+      name: deployEventsUrlVariable,
+      value: dataset.edgeDeploymentUrl.pipe(
+        Output.map((url) => `${url.replace(/\/$/u, "")}/v1/ingest/${deployEventsDataset}`),
+      ),
+    }).pipe(retain());
+
+    return {
+      dataset: deployEventsDataset,
+      repository: `${owner}/${repository}`,
+      secret: deployEventsTokenSecret,
+      variable: deployEventsUrlVariable,
+    };
+  }),
+);
diff --git a/apps/hosted/cloud/alchemy.github.ts b/apps/hosted/cloud/alchemy.github.ts
index af77c04f22..447ae678a3 100644
--- a/apps/hosted/cloud/alchemy.github.ts
+++ b/apps/hosted/cloud/alchemy.github.ts
@@ -24,13 +24,11 @@ import {
   V1FirstPartyClients,
   invalidV1FirstPartyClients,
   missingV1FirstPartyClient,
-  invalidV1ImportAllowedOrgs,
-  parseV1ImportAllowedOrgs,
-  v1ImportAllowedOrgsName,
   missingV1ImportWriter,
   missingV1McpForwardSecret,
   v1ImportWriterName,
   v1McpForwardSecretName,
+  v1SessionHandoffSecretName,
   v1ImportOperatorTokenMinLength,
   missingV1ImportOperatorToken,
   v1FirstPartyClientsName,
@@ -327,22 +325,6 @@ export default Alchemy.Stack(
       value: v1ImportWrites,
       environment: production,
     }).pipe(retain());
-    /**
-     * The v1 organizations production may import (`v1-import-settings.ts`): with writes on, an
-     * import names its organizations and each must be on this list. `.env.ci.op` sets it; unset
-     * or empty imports none, and stores nothing, as GitHub refuses an empty variable. It is not
-     * retained: emptying the list removes the variable, so production imports none again.
-     */
-    const allowedOrgs = yield* Config.String(v1ImportAllowedOrgsName).pipe(Config.withDefault(""));
-    if (parseV1ImportAllowedOrgs(allowedOrgs) === undefined)
-      return yield* Effect.die(new Error(invalidV1ImportAllowedOrgs));
-    if (allowedOrgs.trim() !== "")
-      yield* GitHub.Variable(`production-${v1ImportAllowedOrgsName}`, {
-        ...target,
-        name: v1ImportAllowedOrgsName,
-        value: allowedOrgs,
-        environment: production,
-      });
     /**
      * The URL of v1's `v1_import_writer` role (`moved-flag.ts`), which freezes and cuts over each
      * imported organization. Imports that write need it, so this stack refuses writes without it.
@@ -513,6 +495,19 @@ export default Alchemy.Stack(
         environment: production,
       }).pipe(retain());
 
+    /**
+     * The secret v1 signs session handoffs with (`v1-session-handoff.ts`), the same value as v1's
+     * `V2_SESSION_HANDOFF_SECRET`. Without it a member v1 sends to a moved workspace signs in to v2.
+     */
+    const v1Handoff = yield* nonEmptySecret(v1SessionHandoffSecretName);
+    if (Option.isSome(v1Handoff))
+      yield* GitHub.Secret(`production-${v1SessionHandoffSecretName}`, {
+        ...target,
+        name: v1SessionHandoffSecretName,
+        value: v1Handoff.value,
+        environment: production,
+      }).pipe(retain());
+
     // Rulesets are unavailable on private repositories under the GitHub Free plan, so
     // `CI_RULESET_ENFORCEMENT=disabled` skips the resource instead of asking GitHub for it.
     const ruleset =
diff --git a/apps/hosted/cloud/alchemy.posthog.ts b/apps/hosted/cloud/alchemy.posthog.ts
index 267e56bc32..676f2b09d3 100644
--- a/apps/hosted/cloud/alchemy.posthog.ts
+++ b/apps/hosted/cloud/alchemy.posthog.ts
@@ -17,6 +17,7 @@ import {
 } from "./src/infrastructure/posthog-reports.ts";
 import {
   onboardingExperimentDefinition,
+  onboardingSkipExperimentDefinition,
   PostHogExperiment,
   postHogExperimentProvider,
   retiredExperimentProvider,
@@ -80,8 +81,15 @@ export default Alchemy.Stack(
       definition: onboardingExperimentDefinition,
       status: "running",
     }).pipe(retain());
+    // Independent of the order experiment; also running, so the same deploy launches it.
+    const onboardingSkip = yield* PostHogExperiment("OnboardingSkipExperiment", {
+      projectId: project.id,
+      definition: onboardingSkipExperimentDefinition,
+      status: "running",
+    }).pipe(retain());
     return {
       onboardingExperimentId: onboarding.id,
+      onboardingSkipExperimentId: onboardingSkip.id,
       proxyPath: proxy.text.pipe(Output.map((value) => `/api/${Redacted.value(value)}`)),
       dashboardId: dashboard.id,
       projectId: project.id,
diff --git a/apps/hosted/cloud/scripts/build-framework.ts b/apps/hosted/cloud/scripts/build-framework.ts
index 4a8adae257..59fcc87755 100644
--- a/apps/hosted/cloud/scripts/build-framework.ts
+++ b/apps/hosted/cloud/scripts/build-framework.ts
@@ -1,6 +1,12 @@
-/** Generate the Executor app's skills and framework reference for Cloud. */
+/**
+ * Generate the Executor app's skills and framework reference for Cloud, and the revision of the
+ * API the Executor app reads. Generating the API document takes too long for a request's isolate.
+ */
 import { generateFrameworkReference } from "../../../../packages/apps/scripts/reference.mjs";
 import { readExecutorSkillDocuments } from "@executor-js/app-templates/executor";
+import { hostedApiRevision } from "@executor-js/hosted-server";
+import { executorCloudApiDocument } from "../src/contracts/api.ts";
+import { builtApiOrigin } from "../src/contracts/browser.ts";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import { Effect, FileSystem, Path } from "effect";
@@ -20,5 +26,14 @@ NodeRuntime.runMain(
         "framework-reference.json": JSON.stringify(reference),
       }),
     );
+    // Every deployed stage serves these exact bytes; see `servesBuiltApiDocument`.
+    yield* fs.writeFileString(
+      path.join(root, "apps/hosted/cloud/.generated/executor-api-revision.json"),
+      JSON.stringify({
+        revision: yield* hostedApiRevision(
+          JSON.stringify(executorCloudApiDocument(builtApiOrigin)),
+        ),
+      }),
+    );
   }).pipe(Effect.provide(NodeServices.layer)),
 );
diff --git a/apps/hosted/cloud/scripts/check-v1-import-access.ts b/apps/hosted/cloud/scripts/check-v1-import-access.ts
index c5e9affe73..bdb49ef94f 100644
--- a/apps/hosted/cloud/scripts/check-v1-import-access.ts
+++ b/apps/hosted/cloud/scripts/check-v1-import-access.ts
@@ -10,19 +10,15 @@
  *   with writes allowed;
  * - production's source runs on any other stage;
  * - the emulated Cloud the E2E runner uses stops allowing imports that write;
- * - an import over v1's real data runs without naming its organizations, or for one the allow-list
- *   (`CLOUD_V1_IMPORT_ALLOWED_ORGS`) does not list, or the allow-list reads wrongly.
+ * - an import runs without naming its organizations, or for one without a row in the allow table
+ *   (`private_v1_import_allowed`), given the rows read from it.
  */
 import { Stage } from "alchemy/Stage";
-import { ConfigProvider, Effect, Exit, Schema } from "effect";
-import { V1OrganizationId } from "../src/contracts/v1-import.ts";
+import { ConfigProvider, Effect, Exit } from "effect";
 import type { V1MovedFlag } from "../src/implementation/v1-import/moved-flag.ts";
-import { V1ImportWrites, importRefusal } from "../src/implementation/v1-import/writes.ts";
+import { V1ImportWrites, refusalGiven } from "../src/implementation/v1-import/writes.ts";
 import { productionStage } from "../src/infrastructure/stage.ts";
-import {
-  parseV1ImportAllowedOrgs,
-  v1ImportAccess,
-} from "../src/infrastructure/v1-import-settings.ts";
+import { v1ImportAccess } from "../src/infrastructure/v1-import-settings.ts";
 
 const stages = [productionStage, "dev", "dev-checkout", "staging", "test-e2e-check", "test-pr-1"];
 const loopbackOrigins = ["http://localhost:4411", "http://127.0.0.1:4411", "http://[::1]:4411"];
@@ -119,48 +115,32 @@ const e2e = evaluate({
 if (!Exit.isSuccess(e2e) || e2e.value.source !== "emulated" || !e2e.value.writes)
   failures.push("Emulated Cloud no longer allows imports that write.");
 
-// Which organizations an import may write. The flag is never written here.
+// Which organizations an import may write, given the allow table's rows. The flag is never
+// written here.
 const flag: V1MovedFlag = { set: () => Effect.void };
-const id = Schema.decodeUnknownSync(V1OrganizationId);
-const [listedOrg, otherOrg] = [id("org_listed1"), id("org_other1")];
-const listed = V1ImportWrites.Listed({ organizations: new Set([listedOrg]), flag });
+const [listedOrg, otherOrg] = ["org_listed1", "org_other1"];
+const listed = V1ImportWrites.Listed({ flag });
+const rows = new Set([listedOrg]);
 const writeRules: ReadonlyArray<readonly [string, string | undefined, boolean]> = [
-  ["a real import that pages through v1", importRefusal(listed, undefined), false],
-  ["a real import that names no organization", importRefusal(listed, []), false],
-  ["a real import of a listed organization", importRefusal(listed, [listedOrg]), true],
-  ["a real import of an unlisted organization", importRefusal(listed, [otherOrg]), false],
-  ["a real import that adds an unlisted one", importRefusal(listed, [listedOrg, otherOrg]), false],
+  ["an import that pages through v1", refusalGiven(listed, undefined, rows), false],
+  ["an import that names no organization", refusalGiven(listed, [], rows), false],
+  ["an import of an organization with a row", refusalGiven(listed, [listedOrg], rows), true],
+  ["an import of an organization without a row", refusalGiven(listed, [otherOrg], rows), false],
   [
-    "a real import with an empty allow-list",
-    importRefusal(V1ImportWrites.Listed({ organizations: new Set(), flag }), [listedOrg]),
+    "an import that adds an organization without a row",
+    refusalGiven(listed, [listedOrg, otherOrg], rows),
     false,
   ],
-  ["an emulated import that pages", importRefusal(V1ImportWrites.Any({ flag }), undefined), true],
+  ["an import with an empty allow table", refusalGiven(listed, [listedOrg], new Set()), false],
   [
     "a deployment that refuses imports",
-    importRefusal(V1ImportWrites.Refused({ reason: "off" }), [listedOrg]),
+    refusalGiven(V1ImportWrites.Refused({ reason: "off" }), [listedOrg], rows),
     false,
   ],
 ];
 for (const [rule, refusal, allowed] of writeRules)
   if ((refusal === undefined) !== allowed)
     failures.push(`${rule} is ${refusal === undefined ? "allowed" : "refused"}`);
-const lists: ReadonlyArray<readonly [string, readonly string[] | undefined]> = [
-  ["", []],
-  [" ", []],
-  ["org_a1", ["org_a1"]],
-  [" org_a1 , org_b2,", ["org_a1", "org_b2"]],
-  ["org_a1,not-an-org", undefined],
-  ["org_a1;org_b2", undefined],
-];
-for (const [value, expected] of lists) {
-  const parsed = parseV1ImportAllowedOrgs(value);
-  const got = parsed === undefined ? undefined : [...parsed].toSorted();
-  if (JSON.stringify(got) !== JSON.stringify(expected))
-    failures.push(
-      `CLOUD_V1_IMPORT_ALLOWED_ORGS=${JSON.stringify(value)} reads as ${JSON.stringify(got)}`,
-    );
-}
 
 if (failures.length > 0) {
   console.error(`v1 import access rules failed in ${failures.length} combinations:`);
@@ -168,5 +148,5 @@ if (failures.length > 0) {
   process.exit(1);
 }
 console.log(
-  `v1 import access: ${cases.length} combinations checked, ${live} run the live source; ${writeRules.length} write rules and ${lists.length} allow-lists checked.`,
+  `v1 import access: ${cases.length} combinations checked, ${live} run the live source; ${writeRules.length} write rules checked.`,
 );
diff --git a/apps/hosted/cloud/scripts/deploy-event.ts b/apps/hosted/cloud/scripts/deploy-event.ts
new file mode 100644
index 0000000000..562737e3a1
--- /dev/null
+++ b/apps/hosted/cloud/scripts/deploy-event.ts
@@ -0,0 +1,47 @@
+/**
+ * Records one attempt of a Deploy run as one event in the deploys dataset
+ * (`src/infrastructure/deploy-events.ts`). `.github/workflows/deploy-events.yml` runs it when a
+ * Deploy run on `main` completes, apart from the deploy, so it can neither delay nor fail it.
+ *
+ * It builds the event from GitHub's API with `deployEventOf`, as the backfill does, so both give
+ * the same event for the same run attempt. An attempt that never reached its deploy step, as when
+ * a newer push cancelled the run before it started, records nothing.
+ *
+ * Reads:
+ * - `DEPLOY_RUN_ID` and `DEPLOY_RUN_ATTEMPT`: the attempt to record.
+ * - `GITHUB_REPOSITORY` and `GITHUB_TOKEN`, which needs Actions and Contents read.
+ * - `AXIOM_TOKEN` and `AXIOM_DEPLOY_EVENTS_URL`: where the event goes.
+ *
+ * `--dry-run` prints the event and sends nothing:
+ *
+ *   GITHUB_REPOSITORY=UsefulSoftwareCo/executor-next GITHUB_TOKEN="$(gh auth token)" \
+ *     DEPLOY_RUN_ID=<run id> DEPLOY_RUN_ATTEMPT=<attempt> \
+ *     node apps/hosted/cloud/scripts/deploy-event.ts --dry-run
+ */
+import { parseArgs } from "node:util";
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import { Config, Console, Effect, Option } from "effect";
+import { FetchHttpClient } from "effect/http";
+import { deployEventsDataset, ingestDeployEvents } from "../src/infrastructure/deploy-events.ts";
+import { deployEventOf, makeDeployHistory } from "../src/infrastructure/deploy-history.ts";
+
+const program = Effect.gen(function* () {
+  const { values } = parseArgs({ options: { "dry-run": { type: "boolean", default: false } } });
+  const repository = yield* Config.NonEmptyString("GITHUB_REPOSITORY");
+  const runId = yield* Config.Int("DEPLOY_RUN_ID");
+  const number = yield* Config.Int("DEPLOY_RUN_ATTEMPT");
+
+  const history = yield* makeDeployHistory(repository);
+  const event = yield* deployEventOf(history, yield* history.run(runId), number);
+  if (Option.isNone(event))
+    return yield* Console.log(
+      `Run ${runId} attempt ${number} has no deploy step of its own; nothing to record.`,
+    );
+  if (values["dry-run"]) return yield* Console.log(JSON.stringify(event.value));
+  yield* ingestDeployEvents([event.value]);
+  yield* Console.log(
+    `Recorded the ${event.value.outcome} deploy of ${event.value.sha} (run ${runId} attempt ${number}) with ${event.value.commits.length} commit(s) in ${deployEventsDataset}.`,
+  );
+});
+
+NodeRuntime.runMain(program.pipe(Effect.provide(FetchHttpClient.layer)));
diff --git a/apps/hosted/cloud/scripts/deploy-events-backfill.ts b/apps/hosted/cloud/scripts/deploy-events-backfill.ts
new file mode 100644
index 0000000000..04ba285f30
--- /dev/null
+++ b/apps/hosted/cloud/scripts/deploy-events-backfill.ts
@@ -0,0 +1,75 @@
+/**
+ * One-off: builds the deploy events (`src/infrastructure/deploy-events.ts`) of the Deploy
+ * workflow's past runs on `main`, one per run attempt whose deploy job reached its deploy step. It
+ * builds each one with `deployEventOf`, as the recorder does, so an attempt the recorder also sent
+ * gets the same event.
+ *
+ *   GITHUB_TOKEN="$(gh auth token)" node apps/hosted/cloud/scripts/deploy-events-backfill.ts --dry-run
+ *
+ * `--dry-run` prints the events as JSON lines and sends nothing. Without it the events go to
+ * `AXIOM_DEPLOY_EVENTS_URL` with `AXIOM_TOKEN`, a short-lived API token (`notes/ci.md`).
+ * `--days` sets how far back to read runs, by when they were created (90 by default).
+ */
+import { parseArgs } from "node:util";
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import { Array as Arr, Console, DateTime, Effect, Option } from "effect";
+import { FetchHttpClient } from "effect/http";
+import {
+  DeployOutcome,
+  deployEventsDataset,
+  ingestDeployEvents,
+} from "../src/infrastructure/deploy-events.ts";
+import {
+  deployEventOf,
+  listSpansBetween,
+  makeDeployHistory,
+} from "../src/infrastructure/deploy-history.ts";
+
+const repository = "UsefulSoftwareCo/executor-next";
+const concurrency = 8;
+
+const program = Effect.gen(function* () {
+  const { values } = parseArgs({
+    options: {
+      "dry-run": { type: "boolean", default: false },
+      days: { type: "string", default: "90" },
+    },
+  });
+  if (!/^[1-9]\d*$/u.test(values.days)) return yield* Effect.die("Pass --days <whole days>");
+  const now = yield* DateTime.now;
+  const since = DateTime.subtract(now, { days: Number(values.days) });
+
+  const history = yield* makeDeployHistory(repository);
+  const listed = yield* Effect.forEach(listSpansBetween(since, now), history.runsCreatedIn, {
+    concurrency,
+  });
+  const runs = listed
+    .flat()
+    .filter((run) => DateTime.isGreaterThanOrEqualTo(run.created_at, since));
+  const attempts = runs.flatMap((run) =>
+    Arr.makeBy(run.run_attempt, (index) => ({ run, number: index + 1 })),
+  );
+  const events = (yield* Effect.forEach(
+    attempts,
+    ({ run, number }) => deployEventOf(history, run, number),
+    { concurrency },
+  ))
+    .filter(Option.isSome)
+    .map((event) => event.value)
+    .toSorted((a, b) => a.finishedAt.localeCompare(b.finishedAt));
+
+  const outcomes = DeployOutcome.literals
+    .map((outcome) => `${events.filter((event) => event.outcome === outcome).length} ${outcome}`)
+    .join(", ");
+  yield* Console.error(
+    `${events.length} deploy attempts (${outcomes}) from ${runs.length} runs created since ${DateTime.formatIsoDate(since)}.`,
+  );
+  if (values["dry-run"]) {
+    for (const event of events) yield* Console.log(JSON.stringify(event));
+    return;
+  }
+  for (const batch of Arr.chunksOf(events, 1000)) yield* ingestDeployEvents(batch);
+  yield* Console.error(`Sent ${events.length} events to ${deployEventsDataset}.`);
+});
+
+NodeRuntime.runMain(program.pipe(Effect.provide(FetchHttpClient.layer)));
diff --git a/apps/hosted/cloud/scripts/onboarding-experiment-report.ts b/apps/hosted/cloud/scripts/onboarding-experiment-report.ts
index 7f3ed14eed..97f9d01281 100644
--- a/apps/hosted/cloud/scripts/onboarding-experiment-report.ts
+++ b/apps/hosted/cloud/scripts/onboarding-experiment-report.ts
@@ -1,4 +1,7 @@
-/** Read the onboarding experiment's native PostHog results. Alchemy alone owns provisioning. */
+/**
+ * Read an onboarding experiment's native PostHog results: `--experiment order` (the default) or
+ * `skip`. Alchemy alone owns provisioning.
+ */
 import { isDeepStrictEqual, parseArgs } from "node:util";
 import { Config, Console, Context, Effect, Layer } from "effect";
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
@@ -6,6 +9,7 @@ import { postHogProviderCredentials } from "../src/infrastructure/posthog-provid
 import {
   nativeExperiments,
   onboardingExperimentDefinition,
+  onboardingSkipExperimentDefinition,
 } from "../src/infrastructure/posthog-experiment.ts";
 
 class Client extends Context.Service<Client, Effect.Success<typeof nativeExperiments>>()(
@@ -14,13 +18,20 @@ class Client extends Context.Service<Client, Effect.Success<typeof nativeExperim
 
 const program = Effect.gen(function* () {
   const { values } = parseArgs({
-    options: { project: { type: "string" } },
+    options: { project: { type: "string" }, experiment: { type: "string", default: "order" } },
   });
+  const definitions = {
+    order: onboardingExperimentDefinition,
+    skip: onboardingSkipExperimentDefinition,
+  } as const;
+  if (values.experiment !== "order" && values.experiment !== "skip")
+    return yield* Effect.die("Pass --experiment order or --experiment skip");
+  const definition = definitions[values.experiment];
   if (values.project === undefined || !/^[1-9]\d*$/.test(values.project))
     return yield* Effect.die("Pass --project <PostHog project ID>");
   const project = Number(values.project);
   const api = yield* Client;
-  const experiment = yield* api.find(project, onboardingExperimentDefinition.feature_flag_key);
+  const experiment = yield* api.find(project, definition.feature_flag_key);
   if (experiment === undefined)
     return yield* Effect.die(
       "The onboarding experiment has not been provisioned; deploy alchemy.posthog.ts",
@@ -30,10 +41,7 @@ const program = Effect.gen(function* () {
     JSON.stringify({
       id: experiment.id,
       url: `${host}/project/${project}/experiments/${experiment.id}`,
-      configurationMatchesCode: isDeepStrictEqual(
-        experiment.definition,
-        onboardingExperimentDefinition,
-      ),
+      configurationMatchesCode: isDeepStrictEqual(experiment.definition, definition),
       featureFlagActive: experiment.flag.active,
       ...(yield* api.results(project, experiment)),
     }),
diff --git a/apps/hosted/cloud/scripts/v1-import-repair.ts b/apps/hosted/cloud/scripts/v1-import-repair.ts
new file mode 100644
index 0000000000..acac2f8722
--- /dev/null
+++ b/apps/hosted/cloud/scripts/v1-import-repair.ts
@@ -0,0 +1,282 @@
+/**
+ * One-off repair of the v1 organizations moved before the importer took v1's approval stamps
+ * (`notes/v1-import.md`, "Repair of moved organizations"): MCP tools v1 asked before only from its
+ * stamp, which v2 asks before only while the server still marks them destructive. It also lists
+ * each app deployed again since the import, whose users may have changed its rules.
+ *
+ *   (default)  Dry run. Reads v1 and v2 directly, every statement in a read-only transaction over
+ *              TLS on sessions that default to read-only, and writes nothing. Prints, per moved
+ *              organization, each MCP app and the tools that would get `always`, with the
+ *              importer's own code (`repair.ts`). Needs V1_URL and V2_URL; --orgs-out writes the
+ *              organizations with a change, one per line, for --plan and --apply.
+ *   --plan     Asks the deployment to plan each organization's repair, without writing:
+ *              the same changes, and for each app whether its deployed files are still the
+ *              importer's output, which the dry run cannot read.
+ *   --apply    Asks the deployment to repair each organization: it deploys each app's new version
+ *              through the importer's deploy call.
+ *
+ *   --restore <file>
+ *              Runs an earlier version of each listed imported app again, while the app still runs
+ *              the version expected: a JSON array of `{ organization, app, version, expected }`
+ *              (`restoreApp` in `repair.ts`). It gives an app whose users changed its approvals in
+ *              v2 back the version a repair replaced.
+ *
+ * --plan and --apply call `/api/internal/v1-import/orgs/:org/repair` on --origin with
+ * V1_IMPORT_OPERATOR_TOKEN, for the organizations named with --org or listed in --orgs-file;
+ * --restore calls `/api/internal/v1-import/orgs/:org/restore` on --origin for each listed app.
+ *
+ *   agent-vault run \
+ *     --env 'V1_URL=op://Agents/Production Planetscale Url/credential' \
+ *     --env 'V2_URL=op://Agents/6jic7icrdjy3ksckhtg2wnygli/database_url' \
+ *     -- node apps/hosted/cloud/scripts/v1-import-repair.ts [--org <v1 org id>]... [--orgs-out <file>]
+ *
+ * The output names organizations, apps and accounts: keep it private, out of PRs, issues and logs.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import { PgClient } from "@effect/sql-pg";
+import { Config, Console, Context, Effect, Layer, Redacted, Schema } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { SqlClient } from "effect/sql";
+import { importedMembers, planStampedApps } from "../src/implementation/v1-import/repair.ts";
+import {
+  allSnapshotTables,
+  readSnapshot,
+  readOpenApiOperations,
+  readTools,
+} from "../src/implementation/v1-import/source.ts";
+import { makeImportStore } from "../src/implementation/v1-import/store.ts";
+import { V1ImportUnavailable } from "../src/contracts/v1-import.ts";
+
+const usage =
+  "Usage: node apps/hosted/cloud/scripts/v1-import-repair.ts [--plan | --apply --origin <https://...>] [--org <v1 org id>]... [--orgs-file <file>] [--orgs-out <file>] | --restore <file> --origin <https://...>";
+
+const Moved = Schema.Struct({ org_id: Schema.String });
+/** One app to restore: its v1 organization, and the version to run while it still runs `expected`. */
+const Restores = Schema.Array(
+  Schema.Struct({
+    organization: Schema.String,
+    app: Schema.String,
+    version: Schema.String,
+    expected: Schema.String,
+  }),
+);
+const AppRow = Schema.Struct({ active: Schema.NullOr(Schema.String) });
+
+/** How many organizations the dry run reads at once, each on its own connection. */
+const concurrency = 8;
+
+/** A database client whose sessions default to read-only. */
+const readOnlyClient = (url: Redacted.Redacted) =>
+  Layer.build(
+    PgClient.layer({
+      url,
+      ssl: { rejectUnauthorized: true },
+      maxConnections: concurrency,
+      prepare: false,
+      startupParameters: { default_transaction_read_only: "on" },
+    }),
+  ).pipe(Effect.map(Context.get(SqlClient.SqlClient)));
+
+/**
+ * Run a read in its own read-only transaction on this client, as the importer reads v1. Reads on
+ * the two clients never nest.
+ */
+const reading =
+  (sql: SqlClient.SqlClient) =>
+  <A, E, R>(work: Effect.Effect<A, E, R>) =>
+    sql.withTransaction(sql`set transaction read only`.pipe(Effect.andThen(work))).pipe(
+      Effect.provideService(SqlClient.SqlClient, sql),
+      Effect.catchTag("SqlError", () => Effect.fail(new V1ImportUnavailable())),
+    );
+
+const dryRun = (only: readonly string[], orgsOut: string | undefined) =>
+  Effect.gen(function* () {
+    const v1 = yield* readOnlyClient(yield* Config.Redacted("V1_URL"));
+    const v2 = yield* readOnlyClient(yield* Config.Redacted("V2_URL"));
+    const v1Read = reading(v1);
+    const v2Read = reading(v2);
+    const store = makeImportStore(v2);
+    const find: typeof store.find = (kind, id) => v2Read(store.find(kind, id));
+    const deployedSince: typeof store.deployedSince = (organization) =>
+      v2Read(store.deployedSince(organization));
+    const moved = (yield* v1Read(
+      v1`select org_id from org_moved_to_v2 where state = 'moved' order by org_id`.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Moved))),
+      ),
+    )).map((row) => row.org_id);
+    const organizations = only.length === 0 ? moved : moved.filter((id) => only.includes(id));
+    yield* Console.log(`${organizations.length} moved organizations\n`);
+    const totals = {
+      appOrgs: 0,
+      apps: 0,
+      tools: 0,
+      missingApps: 0,
+    };
+    const changed: string[] = [];
+    // A few organizations at a time; each one's lines print together, in organization order.
+    const planned = yield* Effect.forEach(
+      organizations,
+      (organization) =>
+        Effect.gen(function* () {
+          const out: string[] = [];
+          const recorded = yield* find("organization", organization);
+          const target =
+            recorded?.status === "imported" && recorded.v2_id !== null
+              ? yield* v2Read(store.target(recorded.v2_id))
+              : undefined;
+          if (target === undefined) {
+            out.push(`${organization}: not imported into a live v2 organization; skipped\n`);
+            return out;
+          }
+          const members = yield* v2Read(importedMembers(v2, target.id));
+          const [first, ...rest] = members.map((member) => member.v1);
+          if (first === undefined) {
+            out.push(`${organization}: no imported members; skipped\n`);
+            return out;
+          }
+          const subjects = [first, ...rest] as const;
+          const snapshot = yield* v1Read(
+            readSnapshot(organization, subjects, subjects.length > 1, allSnapshotTables),
+          );
+          const source = {
+            tools: (tenant: string, members: readonly [string, ...string[]], integration: string) =>
+              v1Read(readTools(tenant, members, integration)),
+            openApiOperations: (tenant: string, integration: string) =>
+              v1Read(readOpenApiOperations(tenant, integration)),
+          };
+          const apps = yield* planStampedApps(snapshot, source, { find, deployedSince });
+          if (apps.length === 0) return out;
+          out.push(`${organization} -> v2 ${target.id} (${target.slug})`);
+          let live = 0;
+          for (const app of apps) {
+            const [row] = yield* v2Read(
+              v2`select active_deployment as active from executor_apps where id = ${app.app}`.pipe(
+                Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(AppRow))),
+              ),
+            );
+            const state =
+              row === undefined ? " (app removed)" : row.active === null ? " (not deployed)" : "";
+            if (row === undefined || row.active === null) totals.missingApps++;
+            else {
+              live++;
+              totals.apps++;
+              totals.tools += app.always.length;
+            }
+            const unlisted =
+              app.unlisted === null
+                ? ""
+                : `; tools v1 did not list: left out ${app.unlisted.omitted.join(", ") || "none"}, always ${app.unlisted.always.join(", ") || "none"}${app.unlisted.otherwise === null ? "" : `, any other ${app.unlisted.otherwise === "always" ? "asks always" : "left out"}`}`;
+            const since = app.deployedSince ? " (deployed since the import)" : "";
+            out.push(
+              `  app ${app.app} (${app.integration.name ?? app.integration.slug})${state}${since}: always ${app.always.join(", ") || "none"}${unlisted}`,
+            );
+          }
+          if (live > 0) {
+            totals.appOrgs++;
+            changed.push(organization);
+          }
+          out.push("");
+          return out;
+        }),
+      { concurrency },
+    );
+    for (const out of planned) for (const line of out) yield* Console.log(line);
+    yield* Console.log(
+      [
+        "Summary",
+        `  apps to deploy: ${totals.apps}, ${totals.tools} stamped tools always, in ${totals.appOrgs} organizations`,
+        `  apps removed or not deployed (skipped): ${totals.missingApps}`,
+        `  organizations with a change: ${changed.length}`,
+      ].join("\n"),
+    );
+    if (orgsOut !== undefined)
+      writeFileSync(
+        orgsOut,
+        changed
+          .toSorted()
+          .map((id) => `${id}\n`)
+          .join(""),
+        {
+          mode: 0o600,
+        },
+      );
+  }).pipe(Effect.scoped);
+
+/** An HTTP client for the operator routes on `origin`, with the operator token. */
+const operatorClient = (origin: string) =>
+  Effect.gen(function* () {
+    const token = yield* Config.Redacted("V1_IMPORT_OPERATOR_TOKEN");
+    return (yield* HttpClient.HttpClient).pipe(
+      HttpClient.mapRequest((request) =>
+        request.pipe(
+          HttpClientRequest.prependUrl(origin),
+          HttpClientRequest.bearerToken(Redacted.value(token)),
+        ),
+      ),
+    );
+  });
+
+const restore = (origin: string, file: string) =>
+  Effect.gen(function* () {
+    const apps = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Restores))(
+      readFileSync(file, "utf8"),
+    );
+    const http = yield* operatorClient(origin);
+    for (const { organization, ...app } of apps) {
+      const response = yield* HttpClientRequest.post(
+        `/api/internal/v1-import/orgs/${encodeURIComponent(organization)}/restore`,
+      ).pipe(HttpClientRequest.bodyJsonUnsafe(app), http.execute);
+      const body = yield* response.json;
+      yield* Console.log(JSON.stringify({ status: response.status, body }));
+    }
+  }).pipe(Effect.provide(FetchHttpClient.layer));
+
+const remote = (origin: string, organizations: readonly string[], apply: boolean) =>
+  Effect.gen(function* () {
+    if (organizations.length === 0) return yield* Effect.die(usage);
+    const http = yield* operatorClient(origin);
+    for (const organization of organizations) {
+      const response = yield* HttpClientRequest.post(
+        `/api/internal/v1-import/orgs/${encodeURIComponent(organization)}/repair`,
+      ).pipe(HttpClientRequest.bodyJsonUnsafe({ apply }), http.execute);
+      const body = yield* response.json;
+      yield* Console.log(JSON.stringify({ status: response.status, body }));
+    }
+  }).pipe(Effect.provide(FetchHttpClient.layer));
+
+const program = Effect.gen(function* () {
+  const { values } = parseArgs({
+    options: {
+      plan: { type: "boolean", default: false },
+      apply: { type: "boolean", default: false },
+      origin: { type: "string" },
+      org: { type: "string", multiple: true },
+      "orgs-file": { type: "string" },
+      "orgs-out": { type: "string" },
+      restore: { type: "string" },
+    },
+  });
+  if (values.restore !== undefined) {
+    if (values.origin === undefined || values.plan || values.apply) return yield* Effect.die(usage);
+    return yield* restore(values.origin, values.restore);
+  }
+  const listed = [
+    ...(values.org ?? []),
+    ...(values["orgs-file"] === undefined
+      ? []
+      : readFileSync(values["orgs-file"], "utf8")
+          .split("\n")
+          .map((line) => line.trim())
+          .filter((line) => line !== "")),
+  ];
+  if (values.plan || values.apply) {
+    if (values.origin === undefined || (values.plan && values.apply))
+      return yield* Effect.die(usage);
+    return yield* remote(values.origin, listed, values.apply);
+  }
+  return yield* dryRun(listed, values["orgs-out"]);
+});
+
+NodeRuntime.runMain(program);
diff --git a/apps/hosted/cloud/scripts/v1-import.ts b/apps/hosted/cloud/scripts/v1-import.ts
index 2f0c702167..8ef5739137 100644
--- a/apps/hosted/cloud/scripts/v1-import.ts
+++ b/apps/hosted/cloud/scripts/v1-import.ts
@@ -15,16 +15,28 @@
  *              Raise the bound only while it stays rare. Dry runs write only their reports.
  *              `--mode import` freezes each organization in v1, moves it and cuts it over. It
  *              needs the deployment's CLOUD_V1_IMPORT_WRITES=on and the organizations named with
- *              --org; production imports only those on its CLOUD_V1_IMPORT_ALLOWED_ORGS and
- *              refuses the rest with the reason.
+ *              --org; the deployment imports only those with a row in its
+ *              private_v1_import_allowed table and refuses the rest with the reason. This
+ *              command never writes that table: rows are added by direct SQL.
  *   aggregate  Combine a run's reports, a page per request, into
  *              v1-import/runs/<run>/aggregate.json and print it. Repeat it until `complete` is
  *              true.
  *   report     Print one organization's report and its instances' states, and a summary of an
  *              import's verification and cutover on stderr.
+ *   return-billing
+ *              Give the paid organization named with --org its v1 subscription back: v1's Team
+ *              plan in place of v2's on the same Stripe subscription, under v1's customer id. Run
+ *              it before deleting its v2 organization, which otherwise cancels the subscription.
+ *              Refused while its import instance runs. --run is not used.
  *   rollback   Give the organization named with --org back to v1: v1 serves it again and its
  *              import map is cleared. Delete its v2 organization first; the deployment refuses
- *              while it exists or while its import instance runs. --run is not used.
+ *              while it exists or while its import instance runs. An organization moved into an
+ *              existing v2 organization (decision 32) keeps it: the rollback removes only what
+ *              the import added, after return-billing for a paid copy. --run is not used.
+ *   accounts   For each organization named with --org that the opt-in import copied before it
+ *              moved and that has cut over, bring the accounts an earlier run saved up to date:
+ *              each takes v1's final tokens if they are newer, and follows its app's provider.
+ *              It needs the deployment's write switch. --run is not used.
  *
  * Reports hold customer data: keep the output private, out of PRs, issues and logs.
  */
@@ -39,7 +51,7 @@ import {
 } from "../src/contracts/v1-import-run.ts";
 
 const usage =
-  "Usage: node apps/hosted/cloud/scripts/v1-import.ts <start|aggregate|report|rollback> --origin <https://...> [--run <id>] [--mode dry-run|import] [--org <v1 org id>]... [--after <cursor>] [--max-in-flight <1-100>] [--pause <seconds>]";
+  "Usage: node apps/hosted/cloud/scripts/v1-import.ts <start|aggregate|report|return-billing|rollback|accounts> --origin <https://...> [--run <id>] [--mode dry-run|import] [--org <v1 org id>]... [--after <cursor>] [--max-in-flight <1-100>] [--pause <seconds>]";
 
 const Refused = Schema.Struct({ error: Schema.String });
 
@@ -63,7 +75,13 @@ const program = Effect.gen(function* () {
     },
   });
   const [command] = positionals;
-  if (values.origin === undefined || (values.run === undefined && command !== "rollback"))
+  if (
+    values.origin === undefined ||
+    (values.run === undefined &&
+      command !== "rollback" &&
+      command !== "return-billing" &&
+      command !== "accounts")
+  )
     return yield* Effect.die(usage);
   if (values.mode !== "dry-run" && values.mode !== "import") return yield* Effect.die(usage);
   const token = yield* Config.Redacted("V1_IMPORT_OPERATOR_TOKEN");
@@ -74,7 +92,7 @@ const program = Effect.gen(function* () {
         HttpClientRequest.bearerToken(Redacted.value(token)),
       ),
     ),
-    // A refused request names why (`{ error }`), such as an organization off the allow-list.
+    // A refused request names why (`{ error }`), such as an organization without a row in the allow table.
     HttpClient.transformResponse(
       Effect.flatMap((response) =>
         response.status >= 200 && response.status < 300
@@ -201,11 +219,24 @@ const program = Effect.gen(function* () {
         );
       return;
     }
+    case "accounts": {
+      for (const organization of values.org ?? []) {
+        const result = yield* HttpClientRequest.post(
+          `/api/internal/v1-import/orgs/${encodeURIComponent(organization)}/accounts`,
+        ).pipe(
+          http.execute,
+          Effect.flatMap((response) => response.json),
+        );
+        yield* Console.log(JSON.stringify(result, null, 2));
+      }
+      return;
+    }
+    case "return-billing":
     case "rollback": {
       const [organization] = values.org ?? [];
       if (organization === undefined) return yield* Effect.die(usage);
       const result = yield* HttpClientRequest.post(
-        `/api/internal/v1-import/orgs/${encodeURIComponent(organization)}/rollback`,
+        `/api/internal/v1-import/orgs/${encodeURIComponent(organization)}/${command}`,
       ).pipe(
         http.execute,
         Effect.flatMap((response) => response.json),
diff --git a/apps/hosted/cloud/scripts/worker-sizes.ts b/apps/hosted/cloud/scripts/worker-sizes.ts
index 03556620df..465246e702 100644
--- a/apps/hosted/cloud/scripts/worker-sizes.ts
+++ b/apps/hosted/cloud/scripts/worker-sizes.ts
@@ -13,6 +13,11 @@
  *
  * The dashboard Worker bundles the site, so each stage's site is built first, with the
  * environment the stack's `Site` resource gives that stage's deploy.
+ *
+ * It also fails when a deployed build contains a local test hook (`localTestModules` in
+ * `worker-build.ts`): only `alchemy dev` may bundle one, so no binding or request can turn it on
+ * in a deployed Worker. Each uploaded file is searched for the hook's text, and each Worker's
+ * sources for the hook's file.
  */
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
@@ -48,7 +53,8 @@ import { previewSlug } from "../src/contracts/pr-preview.ts";
 import { McpServer } from "../src/infrastructure/mcp-server-worker.ts";
 import { Marketing } from "../src/infrastructure/marketing-worker.ts";
 import { productionStage, testStagePrefix } from "../src/infrastructure/stage.ts";
-import { uploadedModulesPlugin } from "../src/infrastructure/worker-build.ts";
+import { interactionFaultMarkers } from "../src/infrastructure/mcp-interaction-faults-local.ts";
+import { localTestModules, uploadedModulesPlugin } from "../src/infrastructure/worker-build.ts";
 import {
   packageOf,
   workerUploadDirectory,
@@ -77,7 +83,17 @@ const {
   WorkerBundle,
 }: {
   readonly WorkerBundle: Effect.Effect<
-    { readonly build: (options: object) => Effect.Effect<unknown, Error> },
+    {
+      readonly build: (options: object) => Effect.Effect<
+        {
+          readonly files: ReadonlyArray<{
+            readonly path: string;
+            readonly content: string | Uint8Array;
+          }>;
+        },
+        Error
+      >;
+    },
     never,
     FileSystem.FileSystem | Path.Path
   >;
@@ -328,10 +344,24 @@ const buildWorkers = (target: Target) =>
               extraOptions: props.build,
             }),
           );
-          if (Exit.isFailure(exit))
+          if (Exit.isFailure(exit)) {
             failures.push(
               `${target.stage} ${resource.LogicalId}: ${Cause.pretty(exit.cause).split("\n")[0]}`,
             );
+            continue;
+          }
+          for (const file of exit.value.files) {
+            const content =
+              typeof file.content === "string"
+                ? file.content
+                : new TextDecoder().decode(file.content);
+            for (const text of interactionFaultMarkers)
+              if (content.includes(text))
+                failures.push(
+                  `${target.stage} ${resource.LogicalId}: ${file.path} contains the local test ` +
+                    `hook text "${text}", which only an \`alchemy dev\` build may bundle`,
+                );
+          }
         }
         return failures;
       }),
@@ -524,7 +554,16 @@ const program = Effect.gen(function* () {
         provideFreshArtifactStore,
         Effect.provide(Layer.mergeAll(layerNonInteractive(), Alchemy.localState())),
       );
-      return { stage: target.stage, uploads: yield* readUploads(directory), failures };
+      const uploads = yield* readUploads(directory);
+      for (const upload of uploads.values())
+        for (const source of Object.keys(upload.sources))
+          for (const [, hook] of localTestModules)
+            if (source.endsWith(`/infrastructure/${hook}`))
+              failures.push(
+                `${target.stage} ${upload.worker}: uploads the local test hook ${source}, ` +
+                  "which only an `alchemy dev` build may bundle",
+              );
+      return { stage: target.stage, uploads, failures };
     });
   const previewBuild =
     previewNumber === undefined ? undefined : yield* measure(preview(Number(previewNumber)));
diff --git a/apps/hosted/cloud/src/agent-mail.ts b/apps/hosted/cloud/src/agent-mail.ts
index c5ce120cc6..24896cbe52 100644
--- a/apps/hosted/cloud/src/agent-mail.ts
+++ b/apps/hosted/cloud/src/agent-mail.ts
@@ -18,7 +18,7 @@ export default AgentMailReceiver.make(
   Effect.succeed({
     main: import.meta.url,
     workersDev: false,
-    compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+    compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
   }),
   Effect.gen(function* () {
     const mailbox = yield* Cloudflare.KV.WriteNamespace(AgentMailbox);
diff --git a/apps/hosted/cloud/src/app-data.ts b/apps/hosted/cloud/src/app-data.ts
index 82fe85f88d..6f13f38f00 100644
--- a/apps/hosted/cloud/src/app-data.ts
+++ b/apps/hosted/cloud/src/app-data.ts
@@ -289,7 +289,7 @@ export default AppData.make(
       build: workerBuild("app-data"),
       ...(yield* cloudObservability),
       workersDev: false,
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: {
         ...(yield* telemetryBindings),
         ...(yield* appOutboundBindings),
@@ -355,7 +355,9 @@ export default AppData.make(
                 // Read after the reply, so a fresh isolate's lookup had the round trip to answer.
                 Effect.tap(() => Effect.annotateCurrentSpan("cache.caller.colo", colo())),
                 Effect.provide(RuntimeContext.phantom),
-                Effect.withSpan("runtime.cloud.cache"),
+                Effect.withSpan("runtime.cloud.cache", {
+                  attributes: { "executor.app.id": app },
+                }),
               ),
           };
         },
diff --git a/apps/hosted/cloud/src/app-domains.ts b/apps/hosted/cloud/src/app-domains.ts
index 93cdce47ee..2ab7398354 100644
--- a/apps/hosted/cloud/src/app-domains.ts
+++ b/apps/hosted/cloud/src/app-domains.ts
@@ -10,11 +10,18 @@ import { Cause, Clock, DateTime, Effect, Layer, Redacted, Schema, Semaphore } fr
 import { SqlClient } from "effect/sql";
 import { cloudAppUiBase } from "./contracts/app-ui.ts";
 import { AppDomainZoneSettings } from "./contracts/app-domains.ts";
-import { appDomainCertificates } from "./implementation/app-domain-inventory.ts";
+import {
+  appDomainCertificates,
+  type HostCertificates,
+} from "./implementation/app-domain-inventory.ts";
 import { writeAppDomainRecords } from "./implementation/app-domain-records.ts";
 import { appDomainHttpClient } from "./implementation/app-domain-http.ts";
-import { appDomainState } from "./implementation/app-domain-state.ts";
-import { reconcileAppDomainStack } from "./implementation/app-domain-stack.ts";
+import { appDomainJournal, appDomainState } from "./implementation/app-domain-state.ts";
+import {
+  appDomainShard,
+  reconcileAppDomainStack,
+  teamDomainShard,
+} from "./implementation/app-domain-stack.ts";
 import { AppDomainController } from "./infrastructure/app-domain-controller-worker.ts";
 import { AppDomainCoordinator, AppDomainDrainFailed, Team } from "./infrastructure/app-domains.ts";
 import { appDomainControllerToken, sharedAppDomainZone } from "./infrastructure/app-domain-zone.ts";
@@ -45,6 +52,21 @@ const observeDomainFailure = (phase: string, cause: Cause.Cause<unknown>) =>
     })),
   });
 
+/** Teams per plan. One stack of about 5,000 teams exhausted the coordinator's isolate memory. */
+const teamsPerPass = 500;
+
+/**
+ * A provider can wait five minutes after HTTP 429. Bound every step that holds the lock, so a
+ * deployment can stop this controller and drain its durable journal.
+ */
+const stepTimeout = "60 seconds";
+
+/**
+ * The certificate inventory runs without the lock and reads up to 6,000 packs in about the time of
+ * one page. The bound ends a stalled read, so the pass fails and is retried.
+ */
+const inventoryTimeout = "5 minutes";
+
 const makeAppDomainCoordinator = Effect.gen(function* () {
   const base = yield* cloudAppUiBase.pipe(Effect.orDie);
   if (base === undefined || new URL(base).protocol !== "https:") {
@@ -102,99 +124,122 @@ const makeAppDomainCoordinator = Effect.gen(function* () {
         if (existing === null || existing > due || existing < now - 60_000)
           yield* state.storage.setAlarm(due);
       });
-    const applyTeams = (teams: ReadonlyArray<typeof Team.Type>) =>
+    /**
+     * One plan and apply per group of teams. A plan holds every resource in its stack in memory,
+     * so a single stack for every team ran out of isolate memory. Run the returned passes in order
+     * while holding the lock: they share the journal read here.
+     */
+    const dnsPasses = (teams: ReadonlyArray<typeof Team.Type>) =>
       Effect.gen(function* () {
         const zone = yield* configuration;
         const apiToken = yield* secret;
-        yield* reconcileAppDomainStack({
-          stage: suffix,
-          accountId: zone.accountId,
-          zoneId: zone.id,
-          zoneName: zone.domain,
-          suffix,
-          credentials: apiTokenCredentials({ apiToken: Redacted.value(apiToken) }),
-          teams,
-          state: appDomainState(state.raw.storage, "executor-team-domains", suffix),
-        });
-      }).pipe(
-        Effect.withSpan("app_domains.dns", { attributes: { "app_domains.teams": teams.length } }),
-        Effect.tapCause((cause) => observeDomainFailure("dns", cause)),
-      );
-    const reconcile = lock.withPermits(1)(
-      Effect.scoped(
-        Effect.gen(function* () {
-          if (yield* state.storage.get<boolean>("stopped")) return;
-          const zone = yield* configuration;
-          if (suffix !== zone.domain && !suffix.endsWith(`.${zone.domain}`))
-            return yield* Effect.die(new Error("App domain suffix is outside the managed zone"));
-          const teams = yield* withDatabase(
-            Effect.flatMap(SqlClient.SqlClient, (sql) =>
-              sql`select id, slug from organization`.pipe(
-                Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Team))),
-              ),
+        const journal = yield* appDomainJournal(state.raw.storage);
+        const count = Math.max(1, Math.ceil(Math.max(teams.length, journal.size) / teamsPerPass));
+        return Array.from({ length: count }, (_, shard) => {
+          const shardTeams = teams.filter((team) => teamDomainShard(team, count) === shard);
+          return reconcileAppDomainStack({
+            stage: suffix,
+            accountId: zone.accountId,
+            zoneId: zone.id,
+            zoneName: zone.domain,
+            suffix,
+            credentials: apiTokenCredentials({ apiToken: Redacted.value(apiToken) }),
+            teams: shardTeams,
+            state: appDomainState(
+              state.raw.storage,
+              journal,
+              (fqn) => appDomainShard(fqn, count) === shard,
+              "executor-team-domains",
+              suffix,
             ),
+          }).pipe(
+            Effect.withSpan("app_domains.dns", {
+              attributes: {
+                "app_domains.teams": shardTeams.length,
+                "app_domains.shard": shard,
+                "app_domains.shards": count,
+              },
+            }),
+            Effect.tapCause((cause) => observeDomainFailure("dns", cause)),
           );
-          const valid = teams.filter((team) => `*.${team.slug}.${suffix}`.length <= 64);
-          yield* Effect.annotateCurrentSpan("app_domains.teams", teams.length);
-          const apiToken = yield* secret;
-          yield* applyTeams(valid);
-          const certificates =
-            valid.length === 0
-              ? []
-              : yield* appDomainCertificates(zone.id).pipe(
-                  Effect.provideService(
-                    Credentials,
-                    Effect.succeed(apiTokenCredentials({ apiToken: Redacted.value(apiToken) })),
-                  ),
-                  Effect.provide(appDomainHttpClient),
-                  Effect.withSpan("app_domains.certificates"),
-                  Effect.tapCause((cause) => observeDomainFailure("certificates", cause)),
-                );
-          const now = yield* Clock.currentTimeMillis;
-          yield* Effect.annotateCurrentSpan("app_domains.certificates", certificates.length);
-          const records = teams.map((team) => {
-            const hostname = `*.${team.slug}.${suffix}`;
-            const matching = Array.from(certificates).filter((certificate) =>
-              certificate.hosts?.includes(hostname),
-            );
-            const ready = matching.some(
-              (pack) =>
-                pack.status === "active" &&
-                pack.certificates.some(
-                  (certificate) =>
-                    certificate.status === "active" &&
-                    certificate.hosts.includes(hostname) &&
-                    certificate.expiresOn !== undefined &&
-                    certificate.expiresOn !== null &&
-                    Date.parse(certificate.expiresOn) > now,
-                ),
+        });
+      }).pipe(Effect.tapCause((cause) => observeDomainFailure("dns", cause)));
+    const addressable = (team: typeof Team.Type) => `*.${team.slug}.${suffix}`.length <= 64;
+    /**
+     * Read the desired teams and apply their DNS records. Holds the lock, because the passes read
+     * and write the journal; returns nothing once a drain has stopped this object.
+     */
+    const provision = lock.withPermits(1)(
+      Effect.gen(function* () {
+        if (yield* state.storage.get<boolean>("stopped")) return undefined;
+        const zone = yield* configuration;
+        if (suffix !== zone.domain && !suffix.endsWith(`.${zone.domain}`))
+          return yield* Effect.die(new Error("App domain suffix is outside the managed zone"));
+        const teams = yield* withDatabase(
+          Effect.flatMap(SqlClient.SqlClient, (sql) =>
+            sql`select id, slug from organization`.pipe(
+              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Team))),
+            ),
+          ),
+        ).pipe(Effect.timeout(stepTimeout));
+        for (const pass of yield* dnsPasses(teams.filter(addressable))) {
+          // A drain marks the object stopped, then waits for the lock this pass holds.
+          if (yield* state.storage.get<boolean>("stopped")) return undefined;
+          yield* pass.pipe(Effect.timeout(stepTimeout));
+        }
+        return teams;
+      }),
+    );
+    const reconcile = Effect.scoped(
+      Effect.gen(function* () {
+        const teams = yield* provision;
+        if (teams === undefined || (yield* state.storage.get<boolean>("stopped"))) return undefined;
+        yield* Effect.annotateCurrentSpan("app_domains.teams", teams.length);
+        // Certificates and records are observations outside the journal, so they run without the
+        // lock: a drain or resume waits only for DNS work, and the inventory, which grows with the
+        // zone, is not held to the bound of a step under the lock.
+        const zone = yield* configuration;
+        const apiToken = yield* secret;
+        const certificates = !teams.some(addressable)
+          ? new Map<string, HostCertificates>()
+          : yield* appDomainCertificates(zone.id).pipe(
+              Effect.provideService(
+                Credentials,
+                Effect.succeed(apiTokenCredentials({ apiToken: Redacted.value(apiToken) })),
+              ),
+              Effect.provide(appDomainHttpClient),
+              Effect.withSpan("app_domains.certificates"),
+              Effect.tapCause((cause) => observeDomainFailure("certificates", cause)),
+              Effect.timeout(inventoryTimeout),
             );
-            const failed =
-              hostname.length > 64 ||
-              matching.some((certificate) => certificate.status === "validation_timed_out");
-            const status = ready
-              ? ("ready" as const)
-              : failed
-                ? ("failed" as const)
-                : ("pending" as const);
-            return { organization: team.id, slug: team.slug, status };
-          });
-          yield* withDatabase(writeAppDomainRecords(records, DateTime.makeUnsafe(now)));
-          // Observations moved to the database; remove the copies this object used to keep.
-          // Remove this cleanup in a later release, once every stage has completed a pass.
-          yield* state.storage.delete("reconcileError");
-          const legacy = Array.from((yield* state.storage.list({ prefix: "team:" })).keys());
-          if (legacy.length > 0) yield* state.storage.delete(legacy);
-          return records.some((record) => record.status === "pending") ? 15_000 : 300_000;
-        }),
-      ).pipe(
-        // A provider can wait five minutes after HTTP 429. Release the lock so
-        // a deployment can stop this controller and drain its durable journal.
-        Effect.timeout("60 seconds"),
-        Effect.withSpan("app_domains.reconcile"),
-        Effect.catchCause((cause) =>
-          observeDomainFailure("reconcile", cause).pipe(Effect.as(30_000)),
-        ),
+        yield* Effect.annotateCurrentSpan("app_domains.certificate_hosts", certificates.size);
+        const records = teams.map((team) => {
+          const hostname = `*.${team.slug}.${suffix}`;
+          const observed = certificates.get(hostname);
+          const status = observed?.ready
+            ? ("ready" as const)
+            : !addressable(team) || observed?.failed
+              ? ("failed" as const)
+              : ("pending" as const);
+          return { organization: team.id, slug: team.slug, status };
+        });
+        // A drain that started during the inventory is tearing the stage down; write nothing more.
+        if (yield* state.storage.get<boolean>("stopped")) return undefined;
+        const now = yield* Clock.currentTimeMillis;
+        yield* withDatabase(writeAppDomainRecords(records, DateTime.makeUnsafe(now))).pipe(
+          Effect.timeout(stepTimeout),
+        );
+        // Observations moved to the database; remove the copies this object used to keep.
+        // Remove this cleanup in a later release, once every stage has completed a pass.
+        yield* state.storage.delete("reconcileError");
+        const legacy = Array.from((yield* state.storage.list({ prefix: "team:" })).keys());
+        if (legacy.length > 0) yield* state.storage.delete(legacy);
+        return records.some((record) => record.status === "pending") ? 15_000 : 300_000;
+      }),
+    ).pipe(
+      Effect.withSpan("app_domains.reconcile"),
+      Effect.catchCause((cause) =>
+        observeDomainFailure("reconcile", cause).pipe(Effect.as(30_000)),
       ),
     );
     return {
@@ -206,7 +251,9 @@ const makeAppDomainCoordinator = Effect.gen(function* () {
           // Queued alarms must not win the lock and start provisioning again.
           yield* state.storage.put("stopped", true);
           yield* state.storage.deleteAlarm();
-          yield* lock.withPermits(1)(applyTeams([]));
+          yield* lock.withPermits(1)(
+            Effect.flatMap(dnsPasses([]), (passes) => Effect.forEach(passes, (pass) => pass)),
+          );
         }).pipe(Effect.mapError(() => new AppDomainDrainFailed())),
       resume: () =>
         lock.withPermits(1)(
@@ -242,7 +289,7 @@ export default AppDomainController.make(
       main: import.meta.url,
       ...(yield* cloudObservability),
       workersDev: false,
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: yield* telemetryBindings,
     };
   }),
diff --git a/apps/hosted/cloud/src/app-ui.ts b/apps/hosted/cloud/src/app-ui.ts
index 88163dc0ee..e34f10a01a 100644
--- a/apps/hosted/cloud/src/app-ui.ts
+++ b/apps/hosted/cloud/src/app-ui.ts
@@ -56,7 +56,7 @@ export default class AppPages extends Cloudflare.Worker<AppPages>()(
       },
       compatibility: {
         date: "2026-09-08",
-        flags: ["nodejs_compat", "global_fetch_strictly_public"],
+        flags: ["nodejs_compat", "global_fetch_strictly_public", "no_brotli_content_encoding"],
       },
       ...(dev
         ? {}
@@ -81,7 +81,6 @@ export default class AppPages extends Cloudflare.Worker<AppPages>()(
     const protectedRoutes = Layer.mergeAll(
       HttpRouter.add("GET", appSignInCallbackPath, appUi.callback),
       HttpRouter.add("GET", "/_executor/assets/:version/*", appUi.asset),
-      HttpRouter.add("GET", "/_executor/watch.js", appUi.watch),
       HttpRouter.add("GET", "/_executor/version", appUi.versions),
       HttpRouter.add("POST", "/_executor/api/telemetry/traces", appUi.telemetry("traces")),
       HttpRouter.add("POST", "/_executor/api/telemetry/logs", appUi.telemetry("logs")),
diff --git a/apps/hosted/cloud/src/artifacts-credentials.ts b/apps/hosted/cloud/src/artifacts-credentials.ts
index eeee431d36..b51d51e55e 100644
--- a/apps/hosted/cloud/src/artifacts-credentials.ts
+++ b/apps/hosted/cloud/src/artifacts-credentials.ts
@@ -47,10 +47,13 @@ const treeEntry = Schema.Struct({
   hash: Schema.String,
   type: Schema.String,
 });
+type TreeFile = { path: string; mode: string; type: string; object: string };
 const commitTree = Schema.Struct({ hash: Schema.String, treeHash: Schema.String });
 const objectId = Schema.String.check(Schema.isPattern(/^[a-f0-9]{40}$/u));
 /** Blobs read at once: each is held only until its size, and bytes within budget, are taken. */
 const blobReads = 4;
+/** Subtree reads at once across a whole walk, however deep it goes. */
+const treeReads = 4;
 const pendingPreparation = Schema.Struct({
   repository: AppCodeId,
   trace: Schema.NullOr(TraceContext),
@@ -218,31 +221,43 @@ const makeArtifactsTokenCoordinator = Effect.gen(function* () {
           Effect.gen(function* () {
             const repository = yield* Schema.decodeUnknownEffect(AppCodeId)(id);
             const repo = yield* open(repository);
-            const files: Array<{ path: string; mode: string; type: string; object: string }> = [];
-            const walk = (hash: string, prefix: string): Effect.Effect<void, SourceError> =>
+            const reads = yield* Semaphore.make(treeReads);
+            // Sibling subtrees are read together; each level keeps its entries' order, so the
+            // list is the same depth-first order a one-at-a-time walk produces.
+            const walk = (
+              hash: string,
+              prefix: string,
+            ): Effect.Effect<ReadonlyArray<TreeFile>, SourceError> =>
               Effect.gen(function* () {
                 const entries = yield* Effect.tryPromise({
                   try: () => repo.raw.readTree(hash),
                   catch: unavailable,
                 }).pipe(
+                  reads.withPermits(1),
                   Effect.flatMap(
                     Schema.decodeUnknownEffect(Schema.NullOr(Schema.Array(treeEntry))),
                   ),
                   Effect.mapError(unavailable),
                 );
                 if (entries === null) return yield* unavailable();
-                for (const entry of entries) {
-                  if (entry.type === "tree") yield* walk(entry.hash, `${prefix}${entry.name}/`);
-                  else
-                    files.push({
-                      path: `${prefix}${entry.name}`,
-                      mode: entry.mode,
-                      type: entry.type,
-                      object: entry.hash,
-                    });
-                }
+                const listed = yield* Effect.forEach(
+                  entries,
+                  (entry) =>
+                    entry.type === "tree"
+                      ? walk(entry.hash, `${prefix}${entry.name}/`)
+                      : Effect.succeed([
+                          {
+                            path: `${prefix}${entry.name}`,
+                            mode: entry.mode,
+                            type: entry.type,
+                            object: entry.hash,
+                          },
+                        ]),
+                  { concurrency: "unbounded" },
+                );
+                return listed.flat();
               });
-            yield* walk(yield* Schema.decodeUnknownEffect(objectId)(root), "");
+            const files = yield* walk(yield* Schema.decodeUnknownEffect(objectId)(root), "");
             yield* Effect.annotateCurrentSpan("source.tree.files", files.length);
             return files;
           }),
@@ -421,7 +436,7 @@ export default ArtifactsCredentials.make(
       main: import.meta.url,
       ...(yield* cloudObservability),
       workersDev: false,
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: yield* telemetryBindings,
     };
   }),
diff --git a/apps/hosted/cloud/src/authoring.ts b/apps/hosted/cloud/src/authoring.ts
index c1221c3731..f65e9e498a 100644
--- a/apps/hosted/cloud/src/authoring.ts
+++ b/apps/hosted/cloud/src/authoring.ts
@@ -18,7 +18,7 @@ export default Authoring.make(
       workersDev: false,
       build: workerBuild("authoring"),
       // No placement: a service binding runs this Worker beside its caller, the placed API Worker.
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
     };
   }),
   Effect.succeed(Authoring.of({ files: () => Effect.succeed(authoring) })),
diff --git a/apps/hosted/cloud/src/compiler.ts b/apps/hosted/cloud/src/compiler.ts
index b87f77642e..6939bbfd71 100644
--- a/apps/hosted/cloud/src/compiler.ts
+++ b/apps/hosted/cloud/src/compiler.ts
@@ -30,7 +30,7 @@ export default AppCompiler.make(
       ...(yield* cloudObservability),
       workersDev: false,
       build: workerBuild("compiler"),
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: yield* telemetryBindings,
       ...(Option.isSome(framework) ? { assets: { directory: framework.value } } : {}),
     };
diff --git a/apps/hosted/cloud/src/contracts/api.ts b/apps/hosted/cloud/src/contracts/api.ts
index 24539c43cc..6f3f4d9ac8 100644
--- a/apps/hosted/cloud/src/contracts/api.ts
+++ b/apps/hosted/cloud/src/contracts/api.ts
@@ -4,6 +4,7 @@ import { HostedApi, hostedApiDocument } from "@executor-js/hosted-server/contrac
 import { HostedOrganizationRemoval } from "@executor-js/hosted-server";
 import { billingGroup } from "./billing.ts";
 import { onboardingGroup, setupGroup } from "./onboarding.ts";
+import { RequestRejection } from "@executor-js/sdk/core";
 import { OpenApi } from "effect/http-api";
 
 /** Complete Executor Cloud API. Compose every Cloud product endpoint here. */
@@ -11,6 +12,7 @@ export const ExecutorCloudApi = HostedApi.add(HostedAppUi, billingGroup)
   .add(onboardingGroup)
   .add(setupGroup)
   .add(HostedOrganizationRemoval)
+  .middleware(RequestRejection)
   .annotate(OpenApi.Title, "Executor Cloud");
 
 /** The exact product contract used by the router, published spec and generated Executor app. */
diff --git a/apps/hosted/cloud/src/contracts/autumn.ts b/apps/hosted/cloud/src/contracts/autumn.ts
index f98c756697..61f4c12f4e 100644
--- a/apps/hosted/cloud/src/contracts/autumn.ts
+++ b/apps/hosted/cloud/src/contracts/autumn.ts
@@ -62,6 +62,95 @@ const trial = Schema.Struct({
   }),
 );
 
+/**
+ * The version of a plan a subscription bills, as `customers.get` expands it: its base price and
+ * its items' prices, which say how the plan charges.
+ */
+const subscribedPlan = Schema.Struct({
+  id: Schema.String,
+  version: Schema.Number,
+  price: Schema.NullOr(price),
+  items: Schema.Array(
+    Schema.Struct({
+      featureId: Schema.String,
+      unlimited: Schema.Boolean,
+      price: Schema.NullOr(
+        Schema.Struct({
+          amount: Schema.optionalKey(Schema.Number),
+          interval: Schema.String,
+          billingUnits: Schema.optionalKey(Schema.Number),
+          billingMethod: Schema.optionalKey(Schema.String),
+        }).pipe(
+          Schema.encodeKeys({ billingUnits: "billing_units", billingMethod: "billing_method" }),
+        ),
+      ),
+    }).pipe(Schema.encodeKeys({ featureId: "feature_id" })),
+  ),
+});
+
+/** A subscription with its dates, all in milliseconds since the epoch. */
+const datedSubscription = Schema.Struct({
+  planId: Schema.String,
+  status: Schema.String,
+  canceledAt: Schema.NullOr(Schema.Number),
+  expiresAt: Schema.NullOr(Schema.Number),
+  trialEndsAt: Schema.NullOr(Schema.Number),
+  currentPeriodEnd: Schema.NullOr(Schema.Number),
+  /** Absent when Autumn cannot expand it, such as for a plan no longer in its catalog. */
+  plan: Schema.optionalKey(subscribedPlan),
+}).pipe(
+  Schema.encodeKeys({
+    planId: "plan_id",
+    canceledAt: "canceled_at",
+    expiresAt: "expires_at",
+    trialEndsAt: "trial_ends_at",
+    currentPeriodEnd: "current_period_end",
+  }),
+);
+
+/**
+ * The plan overrides a carried-over subscription uses: a flat base price in place of the plan's,
+ * the plan's items replaced, and the plan's trial removed (`null`).
+ */
+const customize = Schema.Struct({
+  price: Schema.optionalKey(price),
+  items: Schema.optionalKey(
+    Schema.Array(
+      Schema.Struct({
+        featureId: Schema.String,
+        unlimited: Schema.optionalKey(Schema.Boolean),
+      }).pipe(Schema.encodeKeys({ featureId: "feature_id" })),
+    ),
+  ),
+  freeTrial: Schema.optionalKey(Schema.Null),
+}).pipe(Schema.encodeKeys({ freeTrial: "free_trial" }));
+
+/**
+ * One attach, as a checkout or as a carried-over subscription. A checkout names the plan and where
+ * Stripe returns. A carry-over replaces the plans it removes on their existing Stripe subscription
+ * (`removePlanIds`), creates no charge for the change (`prorationBehavior: "none"`) and never
+ * sends the customer to a checkout (`redirectMode: "never"`).
+ */
+const attachRequest = Schema.Struct({
+  ...customer,
+  planId: Schema.String,
+  version: Schema.optionalKey(Schema.Number),
+  successUrl: Schema.optionalKey(Schema.String),
+  removePlanIds: Schema.optionalKey(Schema.Array(Schema.String)),
+  prorationBehavior: Schema.optionalKey(Schema.Literal("none")),
+  redirectMode: Schema.optionalKey(Schema.Literal("never")),
+  customize: Schema.optionalKey(customize),
+}).pipe(
+  Schema.encodeKeys({
+    ...customerKeys,
+    planId: "plan_id",
+    successUrl: "success_url",
+    removePlanIds: "remove_plan_ids",
+    prorationBehavior: "proration_behavior",
+    redirectMode: "redirect_mode",
+  }),
+);
+
 /** Only the inputs used by the product, encoded with Autumn's wire field names. */
 export const AutumnRequests = {
   getOrCreateCustomer: Schema.Struct({
@@ -70,25 +159,37 @@ export const AutumnRequests = {
   }).pipe(Schema.encodeKeys({ ...customerKeys, autoEnablePlanId: "auto_enable_plan_id" })),
   /** Read only: unlike `getOrCreateCustomer`, an unknown customer is not created. */
   getCustomer: Schema.Struct(customer).pipe(Schema.encodeKeys(customerKeys)),
+  /** Read only, like `getCustomer`, with each subscription's dates and the plan version it bills. */
+  getCustomerPlans: Schema.Struct({
+    ...customer,
+    expand: Schema.Tuple([Schema.Literal("subscriptions.plan")]),
+  }).pipe(Schema.encodeKeys(customerKeys)),
   listPlans: Schema.Struct(customer).pipe(Schema.encodeKeys(customerKeys)),
   updateBalance: Schema.Struct({
     ...customer,
     featureId: Schema.String,
     usage: Schema.Number,
   }).pipe(Schema.encodeKeys(featureKeys)),
-  attach: Schema.Struct({ ...customer, planId: Schema.String, successUrl: Schema.String }).pipe(
-    Schema.encodeKeys({ ...customerKeys, planId: "plan_id", successUrl: "success_url" }),
-  ),
+  attach: attachRequest,
+  /** What `attach` would bill and change, changing nothing. */
+  previewAttach: attachRequest,
   openCustomerPortal: Schema.Struct({ ...customer, returnUrl: Schema.String }).pipe(
     Schema.encodeKeys({ ...customerKeys, returnUrl: "return_url" }),
   ),
   // Autumn identifies a subscription by (customer, plan), so cancelling is an
   // update carrying a cancel action rather than its own operation.
-  cancelSubscription: Schema.Struct({
+  updateSubscription: Schema.Struct({
     ...customer,
     planId: Schema.String,
-    cancelAction: Schema.Literal("cancel_immediately"),
+    cancelAction: Schema.Literals(["cancel_immediately", "cancel_end_of_cycle", "uncancel"]),
   }).pipe(Schema.encodeKeys({ ...customerKeys, planId: "plan_id", cancelAction: "cancel_action" })),
+  /** Give a customer a new id. Its Stripe customer, subscriptions and plans stay as they are. */
+  renameCustomer: Schema.Struct({ ...customer, newCustomerId: Schema.String }).pipe(
+    Schema.encodeKeys({ ...customerKeys, newCustomerId: "new_customer_id" }),
+  ),
+  deleteCustomer: Schema.Struct(customer).pipe(Schema.encodeKeys(customerKeys)),
+  /** Compare the customer's Stripe subscriptions with its plans. Read only. */
+  verifyBilling: Schema.Struct(customer).pipe(Schema.encodeKeys(customerKeys)),
 };
 
 const subscriptions = Schema.Array(
@@ -96,6 +197,11 @@ const subscriptions = Schema.Array(
     Schema.encodeKeys({ planId: "plan_id" }),
   ),
 );
+const planIds = Schema.Array(
+  Schema.Struct({ planId: Schema.String }).pipe(Schema.encodeKeys({ planId: "plan_id" })),
+);
+/** How serious a drift `verifyBilling` found; a warning, such as a Stripe-only subscription, can be deliberate. */
+const mismatch = Schema.Struct({ severity: Schema.optionalKey(Schema.String) });
 
 /** Decode provider responses into the fields billing reads; unrelated provider fields are ignored. */
 export const AutumnResponses = {
@@ -105,6 +211,13 @@ export const AutumnResponses = {
   }),
   /** Null when Autumn has no customer with this id. */
   getCustomer: Schema.NullOr(Schema.Struct({ subscriptions })),
+  /** Null when Autumn has no customer with this id. */
+  getCustomerPlans: Schema.NullOr(
+    Schema.Struct({
+      subscriptions: Schema.Array(datedSubscription),
+      balances: Schema.Record(Schema.String, Schema.Struct({ usage: Schema.Number })),
+    }),
+  ),
   listPlans: Schema.Struct({
     list: Schema.Array(
       Schema.Struct({
@@ -120,12 +233,45 @@ export const AutumnResponses = {
     ),
   }),
   updateBalance: Schema.Struct({ success: Schema.Literal(true) }),
-  attach: Schema.Struct({ paymentUrl: Schema.NullOr(Schema.String) }).pipe(
-    Schema.encodeKeys({ paymentUrl: "payment_url" }),
+  /** `invoice` is present only when the attach charged something. */
+  attach: Schema.Struct({
+    paymentUrl: Schema.NullOr(Schema.String),
+    invoice: Schema.optionalKey(Schema.NullOr(Schema.Struct({ total: Schema.Number }))),
+  }).pipe(Schema.encodeKeys({ paymentUrl: "payment_url" })),
+  /**
+   * The charge now (`total`, in the currency's major unit), the next cycle when there is one, and
+   * the plans the attach would add and end.
+   */
+  previewAttach: Schema.Struct({
+    total: Schema.Number,
+    nextCycle: Schema.optionalKey(
+      Schema.NullOr(
+        Schema.Struct({ startsAt: Schema.Number, total: Schema.Number }).pipe(
+          Schema.encodeKeys({ startsAt: "starts_at" }),
+        ),
+      ),
+    ),
+    incoming: planIds,
+    outgoing: planIds,
+    redirectToCheckout: Schema.Boolean,
+  }).pipe(
+    Schema.encodeKeys({ nextCycle: "next_cycle", redirectToCheckout: "redirect_to_checkout" }),
   ),
   openCustomerPortal: Schema.Struct({ url: Schema.String }),
   // Only the outcome matters here; the invoice and proration detail is Autumn's.
-  cancelSubscription: Schema.Struct({}),
+  updateSubscription: Schema.Struct({}),
+  renameCustomer: Schema.Struct({ id: Schema.String }),
+  deleteCustomer: Schema.Struct({ success: Schema.Literal(true) }),
+  verifyBilling: Schema.Struct({
+    subscriptions: Schema.Array(
+      Schema.Struct({
+        stripeSubscriptionId: Schema.String,
+        status: Schema.String,
+        mismatches: Schema.Array(mismatch),
+      }).pipe(Schema.encodeKeys({ stripeSubscriptionId: "stripe_subscription_id" })),
+    ),
+    customerMismatches: Schema.Array(mismatch),
+  }).pipe(Schema.encodeKeys({ customerMismatches: "customer_mismatches" })),
 };
 
 /** Safe diagnostics for transport, provider and contract failures. Cancellation remains interruption. */
@@ -135,11 +281,16 @@ export class AutumnRequestFailed extends Schema.TaggedError<AutumnRequestFailed>
     operation: Schema.Literals([
       "getOrCreateCustomer",
       "getCustomer",
+      "getCustomerPlans",
       "listPlans",
       "updateBalance",
       "attach",
+      "previewAttach",
       "openCustomerPortal",
-      "cancelSubscription",
+      "updateSubscription",
+      "renameCustomer",
+      "deleteCustomer",
+      "verifyBilling",
     ]),
     reason: Schema.Literals(["request", "transport", "status", "response", "timeout"]),
     status: Schema.optionalKey(Schema.Int),
@@ -153,7 +304,10 @@ export interface AutumnOptions {
   readonly serverUrl: Redacted.Redacted<string>;
 }
 
-/** Seven typed HTTP operations. Product policy and customer identity belong to Billing/BillingMeter. */
+/**
+ * Typed Autumn HTTP operations. Product policy and customer identity belong to Billing/BillingMeter
+ * and, for v1's carried-over subscriptions, the v1 import.
+ */
 export class AutumnClient extends Context.Service<
   AutumnClient,
   {
diff --git a/apps/hosted/cloud/src/contracts/billing-catalog.ts b/apps/hosted/cloud/src/contracts/billing-catalog.ts
index 75fa160b31..1e95d38038 100644
--- a/apps/hosted/cloud/src/contracts/billing-catalog.ts
+++ b/apps/hosted/cloud/src/contracts/billing-catalog.ts
@@ -1,3 +1,4 @@
+import { organizationOwner, type OrganizationId } from "@executor-js/hosted-server";
 import { Schema } from "effect";
 
 /**
@@ -20,6 +21,10 @@ export const BillingCatalog = Schema.Struct({
 /** One catalog is shared by the API and MCP runtime in the same deployment stage. */
 export type BillingCatalog = typeof BillingCatalog.Type;
 
+/** An organization's Autumn customer: namespaced by stage, so stages never share a customer. */
+export const billingCustomerId = (catalog: BillingCatalog, organization: OrganizationId) =>
+  `${catalog.namespace}:${organizationOwner(organization)}`;
+
 /** Free includes three members; Team costs USD 15 per active member per month. */
 export const freeMembers = 3;
 export const teamMemberPrice = 15;
diff --git a/apps/hosted/cloud/src/contracts/browser.ts b/apps/hosted/cloud/src/contracts/browser.ts
index 731088fa83..bf0381355e 100644
--- a/apps/hosted/cloud/src/contracts/browser.ts
+++ b/apps/hosted/cloud/src/contracts/browser.ts
@@ -12,6 +12,17 @@ export const cloudSessionCookiePrefix = (origin: string): string => {
   return `executor-cloud-dev-${port}`;
 };
 
+/** The origin the build generates the API document for, to hash it; see `servesBuiltApiDocument`. */
+export const builtApiOrigin = "https://executor.invalid";
+
+/**
+ * Whether the API at `origin` serves the document the build hashed. The origin enters the document
+ * only through the session cookie's name, which every HTTPS origin outside development shares.
+ */
+export const servesBuiltApiDocument = (origin: string) =>
+  new URL(origin).protocol === "https:" &&
+  cloudSessionCookiePrefix(origin) === cloudSessionCookiePrefix(builtApiOrigin);
+
 /** A routing hint only: product pages and APIs still verify the live session. */
 export const hasSessionCookie = (headers: Headers, cookiePrefix: string): boolean =>
   Boolean(getSessionCookie(headers, { cookiePrefix }));
diff --git a/apps/hosted/cloud/src/contracts/invocation-telemetry.ts b/apps/hosted/cloud/src/contracts/invocation-telemetry.ts
index 17beabd15e..d91ee4a552 100644
--- a/apps/hosted/cloud/src/contracts/invocation-telemetry.ts
+++ b/apps/hosted/cloud/src/contracts/invocation-telemetry.ts
@@ -1,4 +1,7 @@
-/** Parse only platform timing metadata; request bodies, URLs, credentials and logs are discarded. */
+/**
+ * Parse only platform timing metadata. Request bodies, credentials and logs are discarded; the
+ * request's URL and user agent are read only to classify the invocation, never recorded.
+ */
 import { Schema } from "effect";
 
 const milliseconds = Schema.Number.check(Schema.isFinite(), Schema.isGreaterThanOrEqualTo(0));
@@ -40,9 +43,11 @@ export const InvocationRpc = Schema.Struct({ rpcMethod: Schema.String });
 export const InvocationHttp = Schema.Struct({
   request: Schema.Struct({
     method: Schema.String,
+    url: Schema.optional(Schema.String),
     headers: Schema.Struct({
       "cf-ray": Schema.optional(Schema.String),
       traceparent: Schema.optional(Schema.String),
+      "user-agent": Schema.optional(Schema.String),
     }),
   }),
   response: Schema.optional(Schema.Struct({ status: Schema.Int })),
diff --git a/apps/hosted/cloud/src/contracts/job-outcome.ts b/apps/hosted/cloud/src/contracts/job-outcome.ts
new file mode 100644
index 0000000000..48f0f29398
--- /dev/null
+++ b/apps/hosted/cloud/src/contracts/job-outcome.ts
@@ -0,0 +1,121 @@
+/**
+ * How a background job's run ended. Most jobs handle their own failure, so their route answers
+ * 204 and no caller retries; the run reports the failure here instead, and the trigger's
+ * `job.dispatch` span records it (`infrastructure/background-jobs.ts`).
+ */
+import { Cause, Effect, Predicate, Schema } from "effect";
+
+/**
+ * The tags of the errors Cloud's jobs fail with. The route's and {@link handledJob}'s types require
+ * every error a job can fail with to have one of them.
+ */
+const JobErrorTag = Schema.Literals([
+  "BillingUnavailable",
+  "DataStepUnavailable",
+  "EmailDeliveryFailed",
+  "GrantExpiryUnavailable",
+  "GroupsUnavailable",
+  "OrganizationRemovalUnavailable",
+  "ProvisioningFailed",
+  "R2Error",
+  "SchemaError",
+  "SiteAssetsUnavailable",
+  "SqlError",
+  "StorageError",
+  "TimeoutError",
+  "WelcomeEmailUnavailable",
+  "WorkflowFailure",
+]);
+
+/** An error a job may fail with. */
+export interface JobError {
+  readonly _tag: typeof JobErrorTag.Type;
+}
+
+/**
+ * Every failure a run can report: a listed error tag, or a fixed kind. Closed, so neither the
+ * route's answer nor telemetry can carry any other value, such as an arbitrary defect's tag.
+ */
+export const JobFailure = Schema.Literals([
+  ...JobErrorTag.literals,
+  // A defect without a listed tag.
+  "Defect",
+  // The run, or its dispatch, was interrupted before it finished.
+  "Interrupted",
+  // A failure without a listed tag.
+  "UnrecognizedFailure",
+  // The dispatch got no outcome from the route: the job did not run, or did not finish.
+  "Unreported",
+  // A data step item ended with an outcome its step retries (`@executor-js/app-management`).
+  "DataStepItemFailed",
+]);
+export type JobFailure = typeof JobFailure.Type;
+
+export const JobOutcome = Schema.Union([
+  /** The run did all of its work. */
+  Schema.Struct({ outcome: Schema.Literal("completed") }),
+  /**
+   * `failed`: the run stopped, or every unit of its work failed. `partial`: some units failed and
+   * the others finished. `failure` names the first failure.
+   */
+  Schema.Struct({ outcome: Schema.Literals(["partial", "failed"]), failure: JobFailure }),
+]);
+export type JobOutcome = typeof JobOutcome.Type;
+
+const isJobErrorTag = Schema.is(JobErrorTag);
+
+/**
+ * The listed tag of `error` (see `@executor-js/telemetry/recorded-failure`), or `fallback`: never
+ * a message, a field or an unlisted tag.
+ */
+const failureOf = (error: unknown, fallback: "UnrecognizedFailure" | "Defect"): JobFailure =>
+  Predicate.hasProperty(error, "_tag") && isJobErrorTag(error._tag) ? error._tag : fallback;
+
+export const jobCompleted: JobOutcome = { outcome: "completed" };
+
+/** The run stopped on `error`, which its job handled. */
+export const jobFailed = (error: JobError): JobOutcome => ({
+  outcome: "failed",
+  failure: failureOf(error, "UnrecognizedFailure"),
+});
+
+/** The run stopped on `cause`: a failure, a defect, or only an interruption. */
+export const jobFailedWith = (cause: Cause.Cause<unknown>): JobOutcome => {
+  const reason = cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+  return {
+    outcome: "failed",
+    failure:
+      reason === undefined
+        ? "Interrupted"
+        : Cause.isFailReason(reason)
+          ? failureOf(reason.error, "UnrecognizedFailure")
+          : failureOf(reason.defect, "Defect"),
+  };
+};
+
+/** A run over `attempted` units of work, of which `failed` failed, the first with `failure`. */
+export const jobUnitCounts = (
+  attempted: number,
+  failed: number,
+  failure: JobFailure,
+): JobOutcome =>
+  failed === 0 ? jobCompleted : { outcome: failed < attempted ? "partial" : "failed", failure };
+
+/** A run over `attempted` units of work, of which those in `failures` failed. */
+export const jobUnits = (attempted: number, failures: ReadonlyArray<JobError>): JobOutcome => {
+  const [first] = failures;
+  return first === undefined
+    ? jobCompleted
+    : jobUnitCounts(attempted, failures.length, failureOf(first, "UnrecognizedFailure"));
+};
+
+/**
+ * A job that handles its own failure: `handled` logs it and the route still answers 204, so no
+ * caller retries. The run reports the failure as its outcome.
+ */
+export const handledJob =
+  (handled: Effect.Effect<void>) =>
+  <E extends JobError, R>(
+    job: Effect.Effect<JobOutcome, E, R>,
+  ): Effect.Effect<JobOutcome, never, R> =>
+    job.pipe(Effect.catch((error) => handled.pipe(Effect.as(jobFailed(error)))));
diff --git a/apps/hosted/cloud/src/contracts/onboarding.ts b/apps/hosted/cloud/src/contracts/onboarding.ts
index af11069c9b..d946cc28b2 100644
--- a/apps/hosted/cloud/src/contracts/onboarding.ts
+++ b/apps/hosted/cloud/src/contracts/onboarding.ts
@@ -1,9 +1,15 @@
-import { RequireUser, OrganizationId, OrganizationLogo } from "@executor-js/hosted-server";
+import {
+  RequireUser,
+  OrganizationId,
+  OrganizationLogo,
+  type SetupProgress,
+} from "@executor-js/hosted-server";
 import {
   OrganizationReference,
   RequireOrganization,
 } from "@executor-js/hosted-server/organization";
-import { SetupOrder } from "@executor-js/hosted-server/setup";
+import { SetupOrder, SetupSkip, SetupStep } from "@executor-js/hosted-server/setup";
+import { GrantId } from "@executor-js/mcp-auth/grants";
 import { ApiError } from "@executor-js/utils/api-error";
 import { Context, Effect, Schema } from "effect";
 import {
@@ -106,12 +112,48 @@ export const onboardingExperiment = {
 } as const satisfies { readonly control: SetupOrder } & Record<string, unknown>;
 
 /**
- * The setup order this member sees for this team. `enrolled` marks a team in the experiment; every
- * other team, including one whose evaluation failed, sees the control untracked.
+ * The onboarding skip experiment, assigned beside the order experiment and independently of it:
+ * `skippable` (the control) keeps today's "Skip for now", `required` takes it away and keeps the
+ * dashboard closed until both steps are done. See `notes/posthog.md#onboarding-skip-experiment`.
+ */
+export const onboardingSkipExperiment = {
+  flag: "onboarding-skip-v1",
+  control: "skippable",
+  attributionDays: 7,
+} as const satisfies { readonly control: SetupSkip } & Record<string, unknown>;
+
+/** Whether this member's setup steps for this team can be skipped, and whether that is tracked. */
+export const SetupSkipAssignment = Schema.Struct({ variant: SetupSkip, enrolled: Schema.Boolean });
+export type SetupSkipAssignment = typeof SetupSkipAssignment.Type;
+
+/**
+ * The setup this member sees for this team: the order of its steps and whether they can be
+ * skipped. Each `enrolled` marks the member in that experiment; every other member, including one
+ * whose evaluation failed, sees that experiment's control untracked.
  */
-export const SetupSequence = Schema.Struct({ order: SetupOrder, enrolled: Schema.Boolean });
+export const SetupSequence = Schema.Struct({
+  order: SetupOrder,
+  enrolled: Schema.Boolean,
+  skip: SetupSkipAssignment,
+});
 export type SetupSequence = typeof SetupSequence.Type;
 
+/**
+ * Whether the team's dashboard is open to this member. It is closed only to a member whose setup
+ * is `required` and who has not done both steps; `step` is the one to do next. When the assistant
+ * came first and is connected, `agent` is the agent it connected, which the account step carries
+ * to the first prompt.
+ */
+export const SetupGate = Schema.Union([
+  Schema.Struct({ status: Schema.Literal("open") }),
+  Schema.Struct({
+    status: Schema.Literal("setup"),
+    step: SetupStep,
+    agent: Schema.optionalKey(GrantId),
+  }),
+]);
+export type SetupGate = typeof SetupGate.Type;
+
 /**
  * A team created for its setup carries its setup order, so its first step opens without reading
  * the order again. The order is left out when it could not be read; setup then reads it.
@@ -191,6 +233,16 @@ export class Onboarding extends Context.Service<
       userId: string,
       organization: OrganizationId,
     ) => Effect.Effect<SetupSequence, OnboardingUnavailable>;
+    /**
+     * Whether the team's dashboard is open to this member. `progress` reads what the member has
+     * done of the steps; it runs only for a member whose setup is required and not yet finished.
+     * Finding both steps done finishes setup for good.
+     */
+    readonly gate: <E, R>(
+      userId: string,
+      organization: OrganizationId,
+      progress: Effect.Effect<SetupProgress, E, R>,
+    ) => Effect.Effect<SetupGate, OnboardingUnavailable, R>;
     readonly icon: (
       userId: string,
       owner: string,
@@ -226,7 +278,10 @@ export const onboardingGroup = HttpApiGroup.make("onboarding")
   )
   .middleware(RequireUser);
 
-/** A new team's setup steps read their order with the page; membership is checked first. */
+/**
+ * A new team's setup steps read their order with the page, and dashboard pages whether setup still
+ * holds them; membership is checked first.
+ */
 export const setupGroup = HttpApiGroup.make("setup")
   .add(
     HttpApiEndpoint.get("sequence", "/api/organizations/:organization/setup", {
@@ -235,5 +290,12 @@ export const setupGroup = HttpApiGroup.make("setup")
       error: OnboardingUnavailable,
     }),
   )
+  .add(
+    HttpApiEndpoint.get("gate", "/api/organizations/:organization/setup/gate", {
+      params: { organization: OrganizationReference },
+      success: SetupGate,
+      error: OnboardingUnavailable,
+    }),
+  )
   .middleware(RequireOrganization)
   .middleware(RequireUser);
diff --git a/apps/hosted/cloud/src/contracts/schedules.ts b/apps/hosted/cloud/src/contracts/schedules.ts
index c83dbef7dc..aaada07edd 100644
--- a/apps/hosted/cloud/src/contracts/schedules.ts
+++ b/apps/hosted/cloud/src/contracts/schedules.ts
@@ -1,2 +1,20 @@
 /** A native minute heartbeat repairs coordinator alarms after a failed event or isolate restart. */
 export const scheduleRecoveryMilliseconds = 60_000;
+
+/**
+ * How far past its time a stored alarm must be, while nothing explains the wait, before the
+ * coordinators treat it as held by the runtime and write it again. Delivery is normally well
+ * under a second late; held alarms waited 10 to 60 seconds.
+ */
+export const heldAlarmMilliseconds = 5_000;
+
+/**
+ * Scheduled runs the coordinator keeps in flight at once, for every organization together. A run
+ * holds its slot while its mutation waits on the app and the services it calls, which takes about
+ * 2 s for most runs and 30 s or more for some. The Node hosts' 8 slots, sized for one server's own
+ * workload, were full whenever a few slow runs met the runs due on the minute, so due runs from
+ * every organization waited for other organizations' slow ones to finish. Replayed against four
+ * days of production runs, at most about 35 were in flight at once, and 32 slots left none waiting
+ * except in the backlog after a stall.
+ */
+export const cloudScheduleConcurrency = 32;
diff --git a/apps/hosted/cloud/src/contracts/v1-import-run.ts b/apps/hosted/cloud/src/contracts/v1-import-run.ts
index d624250925..e5b954a469 100644
--- a/apps/hosted/cloud/src/contracts/v1-import-run.ts
+++ b/apps/hosted/cloud/src/contracts/v1-import-run.ts
@@ -102,6 +102,14 @@ export const V1StaleCategory = Schema.Literals([
 ]);
 export type V1StaleCategory = typeof V1StaleCategory.Type;
 
+/**
+ * How a v1 organization moves into an existing v2 organization the operator listed
+ * (`notes/v1-import.md`, decision 32): with nothing to copy (the default), leaving its v1 data in
+ * v1, or copying it into an organization with nothing set up.
+ */
+export const V1IntoMode = Schema.Literals(["nothing_to_copy", "leave_v1_data", "copy_into_empty"]);
+export type V1IntoMode = typeof V1IntoMode.Type;
+
 const EmailMatch = Schema.Struct({
   email: Schema.String,
   match: Schema.Literals(["merge", "conflict"]),
@@ -114,6 +122,17 @@ const Slug = Schema.Struct({
   v1: Schema.String,
   v2: Schema.NullOr(Schema.String),
   changed: Schema.Boolean,
+  /**
+   * The v2 organization the operator listed to give up the slug (`notes/v1-import.md`, "Slug
+   * displacement"), and its new slug; null, with why, when the displacement does not apply.
+   */
+  displaced: Schema.optionalKey(
+    Schema.Struct({
+      organization: Schema.String,
+      slug: Schema.NullOr(Schema.String),
+      reason: Schema.optionalKey(Schema.String),
+    }),
+  ),
 });
 const IntegrationFailure = Schema.Struct({
   id: Schema.String,
@@ -126,6 +145,8 @@ const DroppedTraceTools = Schema.Struct({
 });
 const ConnectionFailure = Schema.Struct({
   reason: Schema.String,
+  /** The connections move without their account, for their owners to connect again in v2. */
+  reconnect: Schema.optional(Schema.Literal(true)),
   connections: Schema.Array(
     Schema.Struct({ id: Schema.String, label: Schema.String, integration: Schema.String }),
   ),
@@ -192,6 +213,35 @@ const VaultFailure = Schema.Struct({
   integration: Schema.String,
   reason: Schema.Literals(["missing", "unavailable"]),
 });
+/**
+ * An integration whose connections' v1 rules differ, which moves as an app per connection
+ * (decision 33): each connection's app, by the connection's row id and name, with what it did or
+ * would do and, when it was generated, how many tools its rules leave out, ask before and run
+ * without asking, and what they do with a tool none of them names.
+ */
+const SplitIntegration = Schema.Struct({
+  id: Schema.String,
+  label: Schema.String,
+  apps: Schema.Array(
+    Schema.Struct({
+      connection: Schema.String,
+      label: Schema.String,
+      owner: Schema.Literals(["org", "user"]),
+      name: Schema.String,
+      status: Schema.Literals(["imported", "planned", "failed", "skipped"]),
+      v2Id: Schema.optionalKey(Schema.String),
+      reason: Schema.optionalKey(Schema.String),
+      rules: Schema.optionalKey(
+        Schema.Struct({
+          omitted: Count,
+          always: Count,
+          never: Count,
+          otherwise: Schema.NullOr(Schema.Literals(["omitted", "always"])),
+        }),
+      ),
+    }),
+  ),
+});
 
 /**
  * An import's cutover check (`notes/v1-import.md`, cutover step 4): every planned item has a result
@@ -208,6 +258,30 @@ export const V1ImportVerification = Schema.Struct({
 });
 export type V1ImportVerification = typeof V1ImportVerification.Type;
 
+/** How a v1 Team subscription charges, and how its carried-over v2 subscription does. */
+const TeamPricing = Schema.Literals(["per_member", "flat"]);
+
+/**
+ * A paid organization's v1 subscription and its carry-over to v2's Team plan
+ * (`notes/v1-import.md`, "Billing"). `subscription` is null when it does not map; `problem` says
+ * why it cannot carry over, from the mapping or Autumn's preview; `carried` is an import's result.
+ */
+export const V1BillingCarryOver = Schema.Struct({
+  subscription: Schema.NullOr(
+    Schema.Struct({
+      plan: Schema.String,
+      version: Count,
+      pricing: TeamPricing,
+      v2Pricing: TeamPricing,
+      trialing: Schema.Boolean,
+      cancelling: Schema.Boolean,
+    }),
+  ),
+  problem: Schema.NullOr(Schema.String),
+  carried: Schema.optionalKey(Schema.Boolean),
+});
+export type V1BillingCarryOver = typeof V1BillingCarryOver.Type;
+
 /**
  * One organization's report. Its fields are the ones `notes/v1-import.md` lists under "Dry run";
  * an import adds each item's result (`items`).
@@ -230,6 +304,19 @@ export const V1OrgReport = Schema.Struct({
   skippedMembers: Schema.Array(SkippedMember),
   /** The v2 slug the organization would take; null when every candidate is taken. */
   slug: Schema.NullOr(Slug),
+  /**
+   * The existing v2 organization the operator listed for it to move into instead of a new one, and
+   * how (`notes/v1-import.md`, decision 32), with why it does not when it may not. Absent when none
+   * is listed.
+   */
+  into: Schema.optionalKey(
+    Schema.Struct({
+      organization: Schema.String,
+      /** The listed mode, null when the allow table names one the import does not know. */
+      mode: Schema.NullOr(V1IntoMode),
+      refused: Schema.optionalKey(Schema.String),
+    }),
+  ),
   integrationFailures: Schema.Array(IntegrationFailure),
   /** v1 TRACE operations' tools, which are dropped and not failures (decision 16). */
   droppedTraceTools: Schema.Array(DroppedTraceTools),
@@ -255,6 +342,10 @@ export const V1OrgReport = Schema.Struct({
   }),
   /** Connections whose secret v1's Vault did not return: missing, or unavailable after retries. */
   vaultFailures: Schema.Array(VaultFailure),
+  /** Integrations that move as an app per connection; absent from reports written before. */
+  splitIntegrations: Schema.optionalKey(Schema.Array(SplitIntegration)),
+  /** A paid organization's subscription carry-over. */
+  billing: Schema.optionalKey(V1BillingCarryOver),
   /** The organization an import moved into. */
   v2Organization: Schema.optionalKey(Schema.Struct({ id: Schema.String, slug: Schema.String })),
   /** An import's cutover check, once it got that far. */
@@ -389,6 +480,8 @@ export const V1ImportAggregate = Schema.Struct({
     ),
   }),
   vaultFailures: Listed(VaultFailure),
+  /** Absent from aggregates combined before integrations moved as an app per connection. */
+  splitIntegrations: Schema.optionalKey(Listed(SplitIntegration)),
 });
 export type V1ImportAggregate = typeof V1ImportAggregate.Type;
 
diff --git a/apps/hosted/cloud/src/dashboard.ts b/apps/hosted/cloud/src/dashboard.ts
index 5d5ade5cd0..bb716ad16d 100644
--- a/apps/hosted/cloud/src/dashboard.ts
+++ b/apps/hosted/cloud/src/dashboard.ts
@@ -80,7 +80,7 @@ export default Dashboard.make(
       build: workerBuild("dashboard"),
       env: { EXECUTOR_SITE_BUILD: site.hash.output },
       // No placement: a service binding runs this Worker beside its caller, the placed API Worker.
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
     };
   }),
   Effect.succeed(
diff --git a/apps/hosted/cloud/src/edge.ts b/apps/hosted/cloud/src/edge.ts
index ee4cfb8768..4e53390432 100644
--- a/apps/hosted/cloud/src/edge.ts
+++ b/apps/hosted/cloud/src/edge.ts
@@ -15,6 +15,7 @@ import { Marketing } from "./infrastructure/marketing-worker.ts";
 import { Edge } from "./infrastructure/edge-worker.ts";
 import { testStageEdgeRoutes } from "./infrastructure/role-hosts.ts";
 import { workerBuild } from "./infrastructure/worker-build.ts";
+import { platformObservability } from "./infrastructure/telemetry.ts";
 
 /** The stage's telemetry paths (`site-telemetry.ts`), which v1 lists for production. */
 const SiteTelemetry = Schema.fromJsonString(
@@ -36,12 +37,13 @@ export default Edge.make(
       main: import.meta.url,
       workersDev: false,
       build: workerBuild("edge"),
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: siteTelemetryBinding(
         (yield* postHogBindings).analyticsProxy,
         (yield* sentryBindings).errorTunnel,
       ),
       ...(yield* testStageEdgeRoutes),
+      ...(yield* platformObservability),
     };
   }),
   Effect.gen(function* () {
diff --git a/apps/hosted/cloud/src/formatter.ts b/apps/hosted/cloud/src/formatter.ts
index 5de4e02660..d33cc217c3 100644
--- a/apps/hosted/cloud/src/formatter.ts
+++ b/apps/hosted/cloud/src/formatter.ts
@@ -23,7 +23,7 @@ export default Formatter.make(
       workersDev: false,
       build: workerBuild("formatter"),
       // No placement: a service binding runs this Worker beside its caller, the placed API Worker.
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: yield* telemetryBindings,
     };
   }),
diff --git a/apps/hosted/cloud/src/implementation/api.ts b/apps/hosted/cloud/src/implementation/api.ts
index 47f197f1ae..38d5e3cb45 100644
--- a/apps/hosted/cloud/src/implementation/api.ts
+++ b/apps/hosted/cloud/src/implementation/api.ts
@@ -6,6 +6,7 @@ import {
   hostedHandlers,
   type LazyHostedApiDocument,
 } from "@executor-js/hosted-server";
+import { requestRejections } from "@executor-js/sdk/core";
 import { Layer } from "effect";
 import { layerWithBatches } from "@executor-js/dashboard-start/batch-host";
 import { layerBuildHeader } from "@executor-js/dashboard-start/build-header";
@@ -24,10 +25,12 @@ export const cloudApi = (document: LazyHostedApiDocument) =>
     Layer.provide(
       Layer.mergeAll(
         hostedHandlers,
-        billingHandlers,
-        onboardingHandlers,
-        setupHandlers,
-        organizationRemovalHandlers,
+        Layer.mergeAll(
+          billingHandlers,
+          onboardingHandlers,
+          setupHandlers,
+          organizationRemovalHandlers,
+        ).pipe(Layer.provide(requestRejections)),
       ),
     ),
   );
diff --git a/apps/hosted/cloud/src/implementation/app-domain-inventory.ts b/apps/hosted/cloud/src/implementation/app-domain-inventory.ts
index e3e54275ec..d38b1d895f 100644
--- a/apps/hosted/cloud/src/implementation/app-domain-inventory.ts
+++ b/apps/hosted/cloud/src/implementation/app-domain-inventory.ts
@@ -1,7 +1,7 @@
 /** Read complete provider inventories without requesting a page beyond the reported end. */
 import { listRecords } from "@distilled.cloud/cloudflare/dns";
 import { listCertificatePacks } from "@distilled.cloud/cloudflare/ssl";
-import { Stream } from "effect";
+import { Clock, Effect, Stream } from "effect";
 
 const lastPage = (response: {
   readonly resultInfo?: {
@@ -22,10 +22,75 @@ export const appDomainDnsRecords = (zoneId: string, suffix: string) =>
     Stream.runCollect,
   );
 
-/** Read all certificate states so callers can distinguish pending, active, and failed issuance. */
+/**
+ * Cloudflare lists certificate packs at about 15 to 30 milliseconds per pack. Read one page after
+ * another, a zone of a few thousand teams outlasted the time a pass allows for the whole inventory.
+ * Half-size pages answer in about 15 seconds and keep the pages held at once to a few megabytes.
+ */
+const certificatePageSize = 500;
+
+/** Pages requested at once: 6,000 packs in the time of one page. */
+const certificatePageConcurrency = 12;
+
+/** What the zone's certificate packs say about one host. */
+export interface HostCertificates {
+  /** An active pack holds an active, unexpired certificate for the host. */
+  readonly ready: boolean;
+  /** A pack for the host timed out waiting for validation. */
+  readonly failed: boolean;
+}
+
+/**
+ * Every certificate pack of every status, reduced to each host's certificates. A small request
+ * reports the pack count, then the pages are requested several at a time instead of one after
+ * another. Each page is reduced as it arrives, so the isolate never holds every pack. The list
+ * changes while it is read: a pack can be counted twice, which changes nothing, and a page added
+ * meanwhile is read before returning. A pack deleted ahead of a page boundary between two page
+ * requests moves the next pack onto the earlier page, so that host can be missed and read as
+ * pending until the next pass. Requesting the pages together keeps that window short.
+ */
 export const appDomainCertificates = (zoneId: string) =>
-  listCertificatePacks.pages({ zoneId, status: "all", perPage: 1000 }).pipe(
-    Stream.takeUntil(lastPage),
-    Stream.flatMap((page) => Stream.fromIterable(page.result)),
-    Stream.runCollect,
-  );
+  Effect.gen(function* () {
+    const now = yield* Clock.currentTimeMillis;
+    const hosts = new Map<string, HostCertificates>();
+    const readPage = (page: number) =>
+      listCertificatePacks({ zoneId, status: "all", perPage: certificatePageSize, page }).pipe(
+        Effect.map((response) => {
+          for (const pack of response.result)
+            for (const host of pack.hosts) {
+              const known = hosts.get(host);
+              hosts.set(host, {
+                ready:
+                  (known?.ready ?? false) ||
+                  (pack.status === "active" &&
+                    pack.certificates.some(
+                      (certificate) =>
+                        certificate.status === "active" &&
+                        certificate.hosts.includes(host) &&
+                        certificate.expiresOn !== undefined &&
+                        certificate.expiresOn !== null &&
+                        Date.parse(certificate.expiresOn) > now,
+                    )),
+                failed: (known?.failed ?? false) || pack.status === "validation_timed_out",
+              });
+            }
+          return response.resultInfo?.totalPages ?? 0;
+        }),
+      );
+    const probe = yield* listCertificatePacks({ zoneId, status: "all", perPage: 5, page: 1 });
+    const count = probe.resultInfo?.totalCount;
+    if (typeof count !== "number")
+      return yield* Effect.die(new Error("Certificate pack list reported no total"));
+    let done = 0;
+    let pages = Math.ceil(count / certificatePageSize);
+    while (done < pages) {
+      const reported = yield* Effect.forEach(
+        Array.from({ length: pages - done }, (_, index) => done + index + 1),
+        readPage,
+        { concurrency: certificatePageConcurrency },
+      );
+      done = pages;
+      pages = Math.max(pages, ...reported);
+    }
+    return hosts as ReadonlyMap<string, HostCertificates>;
+  });
diff --git a/apps/hosted/cloud/src/implementation/app-domain-stack.ts b/apps/hosted/cloud/src/implementation/app-domain-stack.ts
index c68ca97c52..5f7ed2d822 100644
--- a/apps/hosted/cloud/src/implementation/app-domain-stack.ts
+++ b/apps/hosted/cloud/src/implementation/app-domain-stack.ts
@@ -23,6 +23,23 @@ export interface TeamDomain {
   readonly slug: string;
 }
 
+/** Alchemy's logical ID, and so its journal FQN, for a team's wildcard record. */
+const teamResource = (team: TeamDomain) => `team-${team.slug}`;
+
+/**
+ * Which of `count` partial stacks owns a journal row. A partial stack's desired teams and its
+ * journal view hash the same FQN, so its plan only deletes orphans of its own.
+ */
+export const appDomainShard = (fqn: string, count: number) => {
+  let hash = 0x811c9dc5;
+  for (let index = 0; index < fqn.length; index++)
+    hash = Math.imul(hash ^ fqn.charCodeAt(index), 0x01000193);
+  return (hash >>> 0) % count;
+};
+
+export const teamDomainShard = (team: TeamDomain, count: number) =>
+  appDomainShard(teamResource(team), count);
+
 const ObservedRecord = Schema.Struct({
   id: Schema.NonEmptyString,
   name: Schema.String,
@@ -267,7 +284,7 @@ export const reconcileAppDomainStack = (input: {
       );
       yield* Effect.gen(function* () {
         yield* Effect.forEach(input.teams, (team) =>
-          DnsRecord(`team-${team.slug}`, {
+          DnsRecord(teamResource(team), {
             zoneId: input.zoneId,
             zoneName: input.zoneName,
             name: `*.${team.slug}.${input.suffix}`,
diff --git a/apps/hosted/cloud/src/implementation/app-domain-state.ts b/apps/hosted/cloud/src/implementation/app-domain-state.ts
index c763e11e39..d4fbb58d0e 100644
--- a/apps/hosted/cloud/src/implementation/app-domain-state.ts
+++ b/apps/hosted/cloud/src/implementation/app-domain-state.ts
@@ -4,40 +4,76 @@ import { StateStoreError, type PersistedState, type StateService } from "alchemy
 import { STATE_STORE_VERSION } from "alchemy/State/HttpStateApi";
 import { Effect } from "effect";
 
-/** Persist every Alchemy transition, including interrupted creates and replacements, before continuing. */
+const prefix = "alchemy:resource:";
+
+const io = <A>(run: () => Promise<A>) =>
+  Effect.tryPromise({
+    try: run,
+    catch: () => new StateStoreError({ message: "App domain resource state is unavailable" }),
+  });
+
+/**
+ * Every journal row, keyed by FQN, read with one storage list. Alchemy otherwise reads each row
+ * once per plan phase, which is two storage calls per team on every pass.
+ */
+export const appDomainJournal = (storage: DurableObjectStorage) =>
+  io(() => storage.list<PersistedState>({ prefix })).pipe(
+    Effect.map(
+      (rows) => new Map(Array.from(rows, ([key, row]) => [key.slice(prefix.length), row] as const)),
+    ),
+  );
+
+/**
+ * The rows `owns` selects, as one Alchemy stack. Reads come from the journal loaded by the caller,
+ * which must hold the coordinator's lock while the view is in use: this object is the journal's
+ * only writer. Persist every Alchemy transition, including interrupted creates and replacements,
+ * before continuing.
+ */
 export const appDomainState = (
   storage: DurableObjectStorage,
+  journal: Map<string, PersistedState>,
+  owns: (fqn: string) => boolean,
   stack: string,
   stage: string,
 ): StateService => {
-  const io = <A>(run: () => Promise<A>) =>
-    Effect.tryPromise({
-      try: run,
-      catch: () => new StateStoreError({ message: "App domain resource state is unavailable" }),
-    });
-  const key = (fqn: string) => `alchemy:resource:${fqn}`;
-  const entries = () => io(() => storage.list<PersistedState>({ prefix: "alchemy:resource:" }));
+  const key = (fqn: string) => `${prefix}${fqn}`;
+  const owned = () => Array.from(journal).filter(([fqn]) => owns(fqn));
   return {
     id: "executor-app-domain-durable-object",
     getVersion: () => Effect.succeed(STATE_STORE_VERSION),
     listStacks: () => Effect.succeed([stack]),
     listStages: () => Effect.succeed([stage]),
-    get: ({ fqn }) => io(() => storage.get<PersistedState>(key(fqn))),
-    set: ({ fqn, value }) => io(() => storage.put(key(fqn), value)).pipe(Effect.as(value)),
-    delete: ({ fqn }) => io(() => storage.delete(key(fqn))).pipe(Effect.asVoid),
-    list: () =>
-      entries().pipe(
-        Effect.map((rows) => Array.from(rows.keys(), (k) => k.slice("alchemy:resource:".length))),
+    // Copies, like storage reads and writes, so Alchemy never shares an object with the journal.
+    get: ({ fqn }) => {
+      const row = owns(fqn) ? journal.get(fqn) : undefined;
+      return Effect.succeed(row === undefined ? undefined : structuredClone(row));
+    },
+    set: ({ fqn, value }) =>
+      io(() => storage.put(key(fqn), value)).pipe(
+        Effect.map(() => {
+          journal.set(fqn, structuredClone(value));
+          return value;
+        }),
       ),
-    getReplacedResources: () =>
-      entries().pipe(
-        Effect.map((rows) => Array.from(rows.values()).filter((row) => row.status === "replaced")),
+    delete: ({ fqn }) =>
+      io(() => storage.delete(key(fqn))).pipe(
+        Effect.map(() => {
+          journal.delete(fqn);
+        }),
       ),
-    deleteStack: () =>
-      entries().pipe(
-        Effect.flatMap((rows) => io(() => storage.delete([...rows.keys(), "alchemy:output"]))),
-        Effect.asVoid,
+    list: () => Effect.succeed(owned().map(([fqn]) => fqn)),
+    getReplacedResources: () =>
+      Effect.succeed(
+        owned().flatMap(([, row]) => (row.status === "replaced" ? [structuredClone(row)] : [])),
       ),
+    deleteStack: () => {
+      const fqns = owned().map(([fqn]) => fqn);
+      return io(() => storage.delete([...fqns.map(key), "alchemy:output"])).pipe(
+        Effect.map(() => {
+          for (const fqn of fqns) journal.delete(fqn);
+        }),
+      );
+    },
     getOutput: () => io(() => storage.get<unknown>("alchemy:output")),
     setOutput: ({ value }) => io(() => storage.put("alchemy:output", value)).pipe(Effect.as(value)),
   };
diff --git a/apps/hosted/cloud/src/implementation/auth-observability.ts b/apps/hosted/cloud/src/implementation/auth-observability.ts
index 75835a050c..a982667d3d 100644
--- a/apps/hosted/cloud/src/implementation/auth-observability.ts
+++ b/apps/hosted/cloud/src/implementation/auth-observability.ts
@@ -41,7 +41,76 @@ const TokenError = Schema.Literals([
   "invalid_scope",
   "invalid_target",
 ]);
-const TokenErrorBody = Schema.fromJsonString(Schema.Struct({ error: Schema.String }));
+/** RFC 7591 registration errors, and the other OAuth codes Better Auth answers one with. */
+const RegistrationError = Schema.Literals([
+  "invalid_client_metadata",
+  "invalid_redirect_uri",
+  "invalid_software_statement",
+  "invalid_client",
+  "invalid_request",
+  "invalid_scope",
+  "invalid_target",
+  "access_denied",
+]);
+/**
+ * Why Better Auth refused a registration, matched against the fixed opening of its own
+ * `error_description`. The description itself names client input and is never recorded.
+ */
+const registrationRejections = [
+  ["redirect_uri_not_absolute", /^redirect URI must be an absolute URI/u],
+  ["redirect_uri_credentials_or_fragment", /^redirect URI must not include credentials/u],
+  ["redirect_uri_localhost_dots", /^redirect URI localhost must not include trailing dots/u],
+  ["redirect_uri_web_requires_https", /^web clients require https redirect URIs/u],
+  ["redirect_uri_native_https_loopback", /^native clients must not use https loopback/u],
+  ["redirect_uri_native_http_host", /^native clients may use http only/u],
+  ["redirect_uri_native_scheme", /^native private-use redirect URI schemes/u],
+  ["redirect_uris_missing", /^Redirect URIs are required/u],
+  ["token_endpoint_auth_method", /^unsupported token_endpoint_auth_method /u],
+  ["grant_types", /^(?:unsupported grant_type |no mutually supported grant_type )/u],
+  ["response_types", /'code' response type/u],
+  ["scope", /^cannot request scope /u],
+  ["pkce_required", /^pkce is required/u],
+  ["client_credentials_unauthenticated", /^client_credentials grant requires/u],
+  ["authentication_required", /^Authentication required for client registration/u],
+  ["registration_disabled", /^Client registration is disabled/u],
+] as const;
+/** Fields a registration names; a schema refusal's description starts with the field's path. */
+const RegistrationField = Schema.Literals([
+  "redirect_uris",
+  "scope",
+  "client_name",
+  "client_uri",
+  "logo_uri",
+  "contacts",
+  "tos_uri",
+  "policy_uri",
+  "software_id",
+  "software_version",
+  "software_statement",
+  "post_logout_redirect_uris",
+  "backchannel_logout_uri",
+  "backchannel_logout_session_required",
+  "token_endpoint_auth_method",
+  "jwks",
+  "jwks_uri",
+  "grant_types",
+  "response_types",
+  "application_type",
+  "subject_type",
+  "dpop_bound_access_tokens",
+  "resources",
+  "skip_consent",
+  "client_id",
+  "client_secret",
+  "client_secret_expires_at",
+  "client_id_issued_at",
+]);
+const OAuthErrorBody = Schema.fromJsonString(
+  Schema.Struct({
+    error: Schema.optionalKey(Schema.String),
+    error_description: Schema.optionalKey(Schema.String),
+  }),
+);
 const JsonTokenRequest = Schema.fromJsonString(Schema.Struct({ grant_type: Schema.String }));
 const JsonRefreshRequest = Schema.fromJsonString(Schema.Struct({ refresh_token: Schema.String }));
 /** Token requests are a few hundred bytes; a larger body is not read a second time. */
@@ -142,19 +211,40 @@ const refreshTokenRef = (token: string) =>
     ),
   );
 
+/** The endpoint's own JSON error answer, if it gave one. */
+const errorBody = (response: HttpServerResponse.HttpServerResponse) =>
+  response.body._tag === "Uint8Array"
+    ? Schema.decodeUnknownOption(OAuthErrorBody)(new TextDecoder().decode(response.body.body))
+    : Option.none();
+
 /** The `error` of the endpoint's own JSON answer when it is a known code; never its description. */
 const tokenError = (response: HttpServerResponse.HttpServerResponse) => {
   if (response.status < 400) return "none";
-  if (response.body._tag !== "Uint8Array") return "other";
   return Option.getOrElse(
-    Option.flatMap(
-      Schema.decodeUnknownOption(TokenErrorBody)(new TextDecoder().decode(response.body.body)),
-      (body) => Schema.decodeUnknownOption(TokenError)(body.error),
+    Option.flatMap(errorBody(response), (body) =>
+      Schema.decodeUnknownOption(TokenError)(body.error),
     ),
     () => "other" as const,
   );
 };
 
+/** A refused registration's OAuth error and the rule it broke, from closed vocabularies. */
+const registrationOutcome = (response: HttpServerResponse.HttpServerResponse) => {
+  if (response.status < 400) return { error: "none", rejection: "none" };
+  const body = Option.getOrUndefined(errorBody(response));
+  const error = Option.getOrElse(Schema.decodeUnknownOption(RegistrationError)(body?.error), () =>
+    body?.error === undefined ? ("missing" as const) : ("other" as const),
+  );
+  const description = body?.error_description ?? "";
+  const rule = registrationRejections.find(([, pattern]) => pattern.test(description));
+  if (rule !== undefined) return { error, rejection: rule[0] };
+  // A schema refusal opens with the path of the field it refused, such as `redirect_uris[0]`.
+  const field = Schema.decodeUnknownOption(RegistrationField)(
+    /^([a-z_]+)(?:[.:[ ]|$)/u.exec(description)?.[1],
+  );
+  return { error, rejection: Option.getOrElse(field, () => "other" as const) };
+};
+
 /**
  * The MCP client a registration names, from a closed set. Each pattern is matched, in order,
  * against the registration's `client_name` and then its `software_id`, ignoring case. Both are
@@ -201,6 +291,12 @@ const clientFamily = (row: unknown): ClientFamily => {
   );
   return callback === undefined ? "other" : callback[0];
 };
+/** The naming fields of a registration body; any that are malformed name no client. */
+const RegistrationRequest = Schema.Struct({
+  client_name: Schema.optionalKey(Schema.Unknown),
+  software_id: Schema.optionalKey(Schema.Unknown),
+  redirect_uris: Schema.optionalKey(Schema.Unknown),
+});
 const OAuthClientRequest = Schema.Struct({ client_id: Schema.NonEmptyString });
 const ConsentRequest = Schema.Struct({ oauth_query: Schema.String });
 /**
@@ -254,7 +350,7 @@ interface Observation {
 }
 
 /**
- * Observe social callbacks and OAuth token, authorization and consent requests without
+ * Observe social callbacks and OAuth token, registration, authorization and consent requests without
  * exporting URLs, tokens, client IDs or names, provider payloads or thrown errors.
  */
 export const authObservability = () => {
@@ -329,6 +425,21 @@ export const authObservability = () => {
         });
       return yield* exit;
     });
+  /** Record the OAuth error a registration was refused with and which rule refused it. */
+  const observeRegistration = <E, R>(
+    handler: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
+  ) =>
+    Effect.gen(function* () {
+      const exit = yield* observeClient(handler);
+      const outcome = Exit.isSuccess(exit)
+        ? registrationOutcome(exit.value)
+        : { error: "other", rejection: "other" };
+      yield* Effect.annotateCurrentSpan({
+        "auth.register.error": outcome.error,
+        "auth.register.rejection": outcome.rejection,
+      });
+      return yield* exit;
+    });
   const stage = async <A>(name: Stage, task: () => Promise<A>, accepted: (value: A) => boolean) => {
     const observation = requests.getStore();
     if (observation === undefined) return task();
@@ -397,6 +508,28 @@ export const authObservability = () => {
       };
     },
     hooks: {
+      before: [
+        {
+          matcher: (ctx) => ctx.path === "/oauth2/register",
+          // A registration is not stored yet, refused or not: name its client from the body,
+          // before Better Auth validates it.
+          handler: createAuthMiddleware(async (ctx) => {
+            const observed = oauthRequests.getStore();
+            if (observed === undefined) return;
+            const body = Schema.decodeUnknownOption(RegistrationRequest)(ctx.body);
+            if (Option.isNone(body)) {
+              observed.client = "unknown";
+              return;
+            }
+            const { client_name, software_id, redirect_uris } = body.value;
+            observed.client = clientFamily({
+              ...(client_name === undefined ? {} : { name: client_name }),
+              ...(software_id === undefined ? {} : { softwareId: software_id }),
+              ...(redirect_uris === undefined ? {} : { redirectUris: redirect_uris }),
+            });
+          }),
+        },
+      ],
       after: [
         {
           matcher: (ctx) => ctx.path !== undefined && clientPaths.has(ctx.path),
@@ -432,6 +565,8 @@ export const authObservability = () => {
         const path = new URL(request.url, "https://auth.invalid").pathname;
         if (request.method === "POST" && path === "/api/auth/oauth2/token")
           return yield* observeToken(handler);
+        if (request.method === "POST" && path === "/api/auth/oauth2/register")
+          return yield* observeRegistration(handler);
         if (path === "/api/auth/oauth2/authorize" || path === "/api/auth/oauth2/consent")
           return yield* Effect.flatten(observeClient(handler));
         const match = /^\/api\/auth\/(?:oauth2\/)?callback\/([^/]+)$/.exec(path);
diff --git a/apps/hosted/cloud/src/implementation/auth-options.ts b/apps/hosted/cloud/src/implementation/auth-options.ts
index 6f83e0b9e5..402fb3489f 100644
--- a/apps/hosted/cloud/src/implementation/auth-options.ts
+++ b/apps/hosted/cloud/src/implementation/auth-options.ts
@@ -24,6 +24,7 @@ import { emulatedSocialProviders } from "./emulated-auth.ts";
 import { cloudSso, ssoVerifiedEmail } from "./sso.ts";
 import { chatGptSettings, chatGptSignIn } from "./chatgpt-sign-in.ts";
 import { cloudMemberLimit } from "./member-limit.ts";
+import { v1HandoffSessions } from "./v1-session-handoff.ts";
 
 /** The better-auth endpoint that creates accounts from a verified email code. */
 const emailCodeSignInPath = "/sign-in/email-otp";
@@ -261,6 +262,8 @@ export const cloudAuthOptions = (
             clientId: settings.googleClientId,
             clientSecret: Redacted.value(settings.googleClientSecret),
             includeGrantedScopes: false,
+            // Without it Google silently reuses an account that already approved Executor.
+            prompt: "select_account" as const,
           },
           github: {
             ...redirectURI("github"),
@@ -361,6 +364,8 @@ export const cloudAuthOptions = (
           ),
       }),
       ...(billing === undefined ? [] : [cloudMemberLimit(billing)]),
+      // Server only: sessions for members v1 vouches for (`v1-session-handoff.ts`).
+      v1HandoffSessions(),
       // The native migrator creates tables in plugin order; SSO references organization.
       cloudSso(billing),
       emailOTP({
diff --git a/apps/hosted/cloud/src/implementation/autumn-client.ts b/apps/hosted/cloud/src/implementation/autumn-client.ts
index f042417231..7253183e6f 100644
--- a/apps/hosted/cloud/src/implementation/autumn-client.ts
+++ b/apps/hosted/cloud/src/implementation/autumn-client.ts
@@ -183,6 +183,14 @@ export const autumnLive = (options: AutumnOptions, reads: AutumnReadPolicy) =>
           "read",
           "customer_not_found",
         ),
+        getCustomerPlans: post(
+          "getCustomerPlans",
+          "customers.get",
+          AutumnRequests.getCustomerPlans,
+          AutumnResponses.getCustomerPlans,
+          "read",
+          "customer_not_found",
+        ),
         listPlans: post(
           "listPlans",
           "plans.list",
@@ -204,6 +212,14 @@ export const autumnLive = (options: AutumnOptions, reads: AutumnReadPolicy) =>
           AutumnResponses.attach,
           "write",
         ),
+        // A preview changes nothing, so it is retried like a read.
+        previewAttach: post(
+          "previewAttach",
+          "billing.preview_attach",
+          AutumnRequests.previewAttach,
+          AutumnResponses.previewAttach,
+          "read",
+        ),
         openCustomerPortal: post(
           "openCustomerPortal",
           "billing.open_customer_portal",
@@ -211,13 +227,34 @@ export const autumnLive = (options: AutumnOptions, reads: AutumnReadPolicy) =>
           AutumnResponses.openCustomerPortal,
           "write",
         ),
-        cancelSubscription: post(
-          "cancelSubscription",
+        updateSubscription: post(
+          "updateSubscription",
           "billing.update",
-          AutumnRequests.cancelSubscription,
-          AutumnResponses.cancelSubscription,
+          AutumnRequests.updateSubscription,
+          AutumnResponses.updateSubscription,
           "write",
         ),
+        renameCustomer: post(
+          "renameCustomer",
+          "customers.update",
+          AutumnRequests.renameCustomer,
+          AutumnResponses.renameCustomer,
+          "write",
+        ),
+        deleteCustomer: post(
+          "deleteCustomer",
+          "customers.delete",
+          AutumnRequests.deleteCustomer,
+          AutumnResponses.deleteCustomer,
+          "write",
+        ),
+        verifyBilling: post(
+          "verifyBilling",
+          "billing.verify",
+          AutumnRequests.verifyBilling,
+          AutumnResponses.verifyBilling,
+          "read",
+        ),
       });
     }),
   );
diff --git a/apps/hosted/cloud/src/implementation/billing.ts b/apps/hosted/cloud/src/implementation/billing.ts
index 1180ee4358..eb974d620d 100644
--- a/apps/hosted/cloud/src/implementation/billing.ts
+++ b/apps/hosted/cloud/src/implementation/billing.ts
@@ -7,7 +7,7 @@ import {
   type OrganizationId,
 } from "@executor-js/hosted-server";
 import { makeExecutionMemo } from "alchemy/Runtime/ExecutionMemo";
-import { Cause, Effect, Layer, Schema } from "effect";
+import { Cause, Effect, Fiber, Layer, Schema } from "effect";
 import { FetchHttpClient, HttpServerRequest } from "effect/http";
 import { AutumnClient, type AutumnRequestFailed } from "../contracts/autumn.ts";
 import { autumnLive, autumnReads } from "./autumn-client.ts";
@@ -18,6 +18,7 @@ import {
   seatReconcileCandidates,
 } from "./billing-seats.ts";
 import { reportCloudFailure } from "./error-reporting.ts";
+import { v1BillingHold } from "./v1-import/billing.ts";
 import { HttpApiBuilder } from "effect/http-api";
 import {
   Billing,
@@ -25,7 +26,7 @@ import {
   BillingPlanUnavailable,
   BillingUnavailable,
 } from "../contracts/billing.ts";
-import { freeMembers } from "../contracts/billing-catalog.ts";
+import { billingCustomerId, freeMembers } from "../contracts/billing-catalog.ts";
 import { ExecutorCloudApi } from "../contracts/api.ts";
 import { billingSettings } from "../infrastructure/billing.ts";
 
@@ -72,18 +73,33 @@ export const billingLive = Effect.gen(function* () {
   );
   const use = <A>(call: Effect.Effect<A, AutumnRequestFailed>) =>
     call.pipe(Effect.mapError(() => new BillingUnavailable()));
+  /**
+   * A paid v1 organization's billing while the v1 import carries its subscription over (`held`),
+   * or after it gave it back to v1 (`returned`); null otherwise (`notes/v1-import.md`, "Billing").
+   * Its customer is v1's own until the carry-over finishes, so v2 must not create one, offer a
+   * checkout, sync seats or cancel anything for it meanwhile.
+   */
+  const hold = (organization: OrganizationId) => members.use(v1BillingHold(organization));
+  /** Fail any billing operation on a held organization. */
+  const unlessHeld = (organization: OrganizationId) =>
+    Effect.flatMap(hold(organization), (state) =>
+      state === null ? Effect.void : Effect.fail(new BillingUnavailable()),
+    );
   const overview: typeof Billing.Service.overview = (organization) =>
     Effect.gen(function* () {
+      yield* unlessHeld(organization);
       const { autumn, catalog } = yield* client;
-      const customerId = `${catalog.namespace}:${organizationOwner(organization)}`;
+      const customerId = billingCustomerId(catalog, organization);
       const customer = yield* use(
         autumn.getOrCreateCustomer({ customerId, autoEnablePlanId: catalog.free }),
       );
+      // The plan list is read while the seat plan is written; the write still finishes first.
+      const listing = yield* Effect.forkChild(use(autumn.listPlans({ customerId })));
       // Checkout returns here after Stripe settles, so a new seat plan joins the daily reconcile.
       yield* members.use(
         recordSeatPlan(organization, active(customer, [catalog.team, catalog.enterprise])),
       );
-      const plans = yield* use(autumn.listPlans({ customerId }));
+      const plans = yield* Fiber.join(listing);
       // The billing provider lists plans in its own order; the page shows the smallest first.
       const offered = [catalog.free, catalog.team, catalog.enterprise];
       return yield* Schema.decodeUnknownEffect(BillingOverview)({
@@ -135,8 +151,9 @@ export const billingLive = Effect.gen(function* () {
     });
   const customer = (organization: OrganizationId) =>
     Effect.gen(function* () {
+      yield* unlessHeld(organization);
       const { autumn, catalog } = yield* client;
-      const customerId = `${catalog.namespace}:${organizationOwner(organization)}`;
+      const customerId = billingCustomerId(catalog, organization);
       const value = yield* use(
         autumn.getOrCreateCustomer({ customerId, autoEnablePlanId: catalog.free }),
       );
@@ -151,6 +168,8 @@ export const billingLive = Effect.gen(function* () {
    */
   const syncSeats = (organization: OrganizationId, mode: "changed" | "verify") =>
     Effect.gen(function* () {
+      // The import syncs a held organization's seats once its subscription is carried over.
+      if ((yield* hold(organization)) !== null) return;
       let current: { readonly count: number; readonly synced: number | null } | undefined =
         yield* members.use(seatCounts(organization));
       if (current === undefined) return yield* new BillingUnavailable();
@@ -176,8 +195,11 @@ export const billingLive = Effect.gen(function* () {
     Effect.gen(function* () {
       const { autumn, catalog } = yield* client;
       const customerId = catalog
-        ? `${catalog.namespace}:${organizationOwner(organization)}`
+        ? billingCustomerId(catalog, organization)
         : organizationOwner(organization);
+      // v1 bills a returned organization again: v2 holds nothing of it to cancel.
+      if ((yield* hold(organization)) === "returned")
+        return { customerId, cancelled: [] as string[] };
       return yield* Effect.gen(function* () {
         const { value } = yield* customer(organization);
         // The free plan carries no charge, and an expired subscription is already done.
@@ -190,7 +212,7 @@ export const billingLive = Effect.gen(function* () {
           live,
           (subscription) =>
             use(
-              autumn.cancelSubscription({
+              autumn.updateSubscription({
                 customerId,
                 planId: subscription.planId,
                 cancelAction: "cancel_immediately",
@@ -270,7 +292,7 @@ export const billingLive = Effect.gen(function* () {
             const { autumn, catalog } = yield* client;
             const result = yield* use(
               autumn.attach({
-                customerId: `${catalog.namespace}:${organizationOwner(organization)}`,
+                customerId: billingCustomerId(catalog, organization),
                 planId: plan,
                 successUrl: success.href,
               }),
@@ -283,7 +305,7 @@ export const billingLive = Effect.gen(function* () {
             const { autumn, catalog } = yield* client;
             const result = yield* use(
               autumn.openCustomerPortal({
-                customerId: `${catalog.namespace}:${organizationOwner(organization)}`,
+                customerId: billingCustomerId(catalog, organization),
                 returnUrl: returnUrl.href,
               }),
             );
diff --git a/apps/hosted/cloud/src/implementation/catalog-feed-cache.ts b/apps/hosted/cloud/src/implementation/catalog-feed-cache.ts
index c788b1cb53..03a6117238 100644
--- a/apps/hosted/cloud/src/implementation/catalog-feed-cache.ts
+++ b/apps/hosted/cloud/src/implementation/catalog-feed-cache.ts
@@ -1,5 +1,6 @@
 /** Colo cache of the official app feed, so listing and installing do not each wait on R2. */
-import { Effect, Schema } from "effect";
+import { makeExecutionMemo } from "alchemy/Runtime/ExecutionMemo";
+import { Effect, FiberSet, Schema } from "effect";
 import { HttpClient, HttpClientResponse } from "effect/http";
 
 class FeedCacheFailed extends Schema.TaggedError<FeedCacheFailed>()("FeedCacheFailed", {}) {}
@@ -14,12 +15,23 @@ const retentionSeconds = 5 * 60;
  * requests, failures and non-200 responses pass through uncached. A cache failure only costs the
  * origin read.
  */
-export const cachedFeedClient = (
+export const cachedFeedClient = Effect.fn(function* (
   origin: string,
   feedUrl: string,
   client: HttpClient.HttpClient,
-): HttpClient.HttpClient => {
+) {
   const feedDirectory = new URL(".", feedUrl).href;
+  // Alchemy closes the event scope through waitUntil after sending the response.
+  // Own cache writes there, without retaining an init-time Worker context.
+  const writes = yield* makeExecutionMemo(
+    Effect.gen(function* () {
+      const writes = yield* FiberSet.make();
+      yield* Effect.addFinalizer(() =>
+        FiberSet.awaitEmpty(writes).pipe(Effect.timeoutOption("2 seconds"), Effect.asVoid),
+      );
+      return writes;
+    }),
+  );
   return HttpClient.transform(client, (response, request) => {
     if (request.method !== "GET" || !request.url.startsWith(feedDirectory)) return response;
     return Effect.gen(function* () {
@@ -49,12 +61,15 @@ export const cachedFeedClient = (
         "content-type": fresh.headers["content-type"] ?? "application/json",
         "cache-control": `public, max-age=${retentionSeconds}`,
       };
-      yield* cached(() => cache.put(key, new Response(body, { headers }))).pipe(
-        Effect.catchTag("FeedCacheFailed", () =>
-          Effect.logWarning("Catalog feed cache write failed"),
+      yield* FiberSet.run(
+        yield* writes,
+        cached(() => cache.put(key, new Response(body, { headers }))).pipe(
+          Effect.catchTag("FeedCacheFailed", () =>
+            Effect.logWarning("Catalog feed cache write failed"),
+          ),
         ),
       );
       return HttpClientResponse.fromWeb(request, new Response(body, { status: 200, headers }));
     }).pipe(Effect.withSpan("catalog.feed.read"));
   });
-};
+});
diff --git a/apps/hosted/cloud/src/implementation/data-changes.ts b/apps/hosted/cloud/src/implementation/data-changes.ts
index b5a10d2089..c4d85affb9 100644
--- a/apps/hosted/cloud/src/implementation/data-changes.ts
+++ b/apps/hosted/cloud/src/implementation/data-changes.ts
@@ -3,12 +3,14 @@ import type { DurableObjectNamespace, MessageEvent } from "@cloudflare/workers-t
 import { Cause, Effect, Queue, Schema, Stream } from "effect";
 import { RuntimeProtocolFailed } from "@executor-js/sdk/core";
 import { traceHeaders } from "@executor-js/telemetry";
+import { runtimeActor } from "./runtime-actor.ts";
 
 /** Notify after registration, conflate bursts, and close with the subscriber's scope. */
 export const dataChanges = (namespace: Pick<DurableObjectNamespace, "getByName">, app: string) =>
   Stream.callback<number, RuntimeProtocolFailed>(
     (queue) =>
       Effect.gen(function* () {
+        const actor = yield* runtimeActor;
         const socket = yield* Effect.acquireRelease(
           Effect.gen(function* () {
             const headers = yield* traceHeaders;
@@ -25,7 +27,12 @@ export const dataChanges = (namespace: Pick<DurableObjectNamespace, "getByName">
               },
               catch: () => new RuntimeProtocolFailed(),
             });
-          }).pipe(Effect.withSpan("runtime.cloud.changes.connect", { kind: "client" })),
+          }).pipe(
+            Effect.withSpan("runtime.cloud.changes.connect", {
+              kind: "client",
+              attributes: { ...actor, "executor.app.id": app },
+            }),
+          ),
           (socket) => Effect.sync(() => socket.close(1000, "Subscription ended")),
         );
         const changed = (event: MessageEvent) => {
diff --git a/apps/hosted/cloud/src/implementation/emulated-auth.ts b/apps/hosted/cloud/src/implementation/emulated-auth.ts
index 99f63979e9..c49b096eef 100644
--- a/apps/hosted/cloud/src/implementation/emulated-auth.ts
+++ b/apps/hosted/cloud/src/implementation/emulated-auth.ts
@@ -28,6 +28,7 @@ export const emulatedSocialProviders = (
         scopes: ["openid", "email", "profile"],
         pkce: true,
         requireIdTokenVerification: true,
+        prompt: "select_account",
       },
       {
         providerId: "github",
diff --git a/apps/hosted/cloud/src/implementation/feature-flags.ts b/apps/hosted/cloud/src/implementation/feature-flags.ts
index 46d272403b..50589503f9 100644
--- a/apps/hosted/cloud/src/implementation/feature-flags.ts
+++ b/apps/hosted/cloud/src/implementation/feature-flags.ts
@@ -10,14 +10,15 @@ const Flags = Schema.Struct({
 const Flag = Schema.Struct({ enabled: Schema.Boolean, variant: Schema.optional(Schema.String) });
 
 /**
- * Evaluate one flag for one person with the public project token, through PostHog's documented
- * `/flags?v=2` endpoint; no management credential enters the Worker. A missing, disabled, errored
- * or quota-limited flag, a failed request and a one-second timeout all answer `undefined`, which
- * the caller serves as an untracked control.
+ * Evaluate flags for one person in one request with the public project token, through PostHog's
+ * documented `/flags?v=2` endpoint; no management credential enters the Worker. Each key answers
+ * its variant, or `undefined` when the flag is missing, disabled or not multivariate. An errored or
+ * quota-limited evaluation, a failed request and a one-second timeout answer `undefined` for every
+ * key, which the caller serves as an untracked control.
  */
-export const evaluateFlag = (
+export const evaluateFlags = <const Key extends string>(
   settings: { readonly token: string; readonly host: string },
-  key: string,
+  keys: readonly Key[],
   distinctId: string,
 ) =>
   Effect.gen(function* () {
@@ -27,7 +28,7 @@ export const evaluateFlag = (
         HttpClientRequest.bodyJsonUnsafe({
           api_key: settings.token,
           distinct_id: distinctId,
-          flag_keys_to_evaluate: [key],
+          flag_keys_to_evaluate: keys,
         }),
       ),
     );
@@ -35,15 +36,19 @@ export const evaluateFlag = (
     const result = yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Flags)));
     if (result.errorsWhileComputingFlags || result.quotaLimited?.includes("feature_flags"))
       return yield* Effect.fail("Flag evaluation incomplete");
-    const value = result.flags[key];
-    if (value === undefined) return undefined;
-    const flag = yield* Schema.decodeUnknownEffect(Flag)(value);
-    return flag.enabled ? flag.variant : undefined;
+    const variants: Partial<Record<Key, string>> = {};
+    for (const key of keys) {
+      const value = result.flags[key];
+      if (value === undefined) continue;
+      const flag = yield* Schema.decodeUnknownEffect(Flag)(value);
+      if (flag.enabled && flag.variant !== undefined) variants[key] = flag.variant;
+    }
+    return variants;
   }).pipe(
     Effect.timeout("1 second"),
     Effect.catch(() =>
-      Effect.logWarning("Feature flag unavailable; serving untracked control").pipe(
-        Effect.as(undefined),
+      Effect.logWarning("Feature flags unavailable; serving untracked controls").pipe(
+        Effect.as<Partial<Record<Key, string>>>({}),
       ),
     ),
     Effect.provide(FetchHttpClient.layer),
@@ -55,7 +60,10 @@ export const evaluateFlag = (
  * configured; without it, as in local development and self-host, every flag is unavailable.
  */
 export const FeatureFlags = Context.Reference<{
-  readonly evaluate: (key: string, distinctId: string) => Effect.Effect<string | undefined>;
+  readonly evaluate: <const Key extends string>(
+    keys: readonly Key[],
+    distinctId: string,
+  ) => Effect.Effect<Partial<Record<Key, string>>>;
 }>("cloud/FeatureFlags", {
-  defaultValue: () => ({ evaluate: () => Effect.succeed(undefined) }),
+  defaultValue: () => ({ evaluate: () => Effect.succeed({}) }),
 });
diff --git a/apps/hosted/cloud/src/implementation/host-roles.ts b/apps/hosted/cloud/src/implementation/host-roles.ts
index c68871d625..7fc14c92d3 100644
--- a/apps/hosted/cloud/src/implementation/host-roles.ts
+++ b/apps/hosted/cloud/src/implementation/host-roles.ts
@@ -24,7 +24,7 @@
  */
 import { Effect, Option } from "effect";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
-import type { CloudHosts, HostRole } from "../infrastructure/stage.ts";
+import type { CloudHosts, HostRole, RoleHosts } from "../infrastructure/stage.ts";
 import { isBrowserPage, isMcpPath } from "../contracts/browser-pages.ts";
 import { servedOnEdge } from "../contracts/edge-paths.ts";
 import { isSitePage } from "../contracts/site-paths.ts";
@@ -35,19 +35,32 @@ const requestHost = (request: HttpServerRequest.HttpServerRequest) =>
 
 type Route = HostRole | "edge" | "deployment";
 
+/** The role host or edge `host` is, if it is one of them. */
+const roleHostOf = (roles: RoleHosts, host: string | undefined) => {
+  if (host === new URL(roles.origins.app).host) return "app";
+  if (host === new URL(roles.origins.mcp).host) return "mcp";
+  if (host === new URL(roles.origins.api).host) return "api";
+  if (host === new URL(roles.edge).host) return "edge";
+  return undefined;
+};
+
 /** The part of the product a request's host names. */
 const routeOf = (hosts: CloudHosts, host: string | undefined): Route =>
   Option.match(hosts.roles, {
     onNone: () => "deployment" as const,
-    onSome: (roles): Route => {
-      if (host === new URL(roles.origins.app).host) return "app";
-      if (host === new URL(roles.origins.mcp).host) return "mcp";
-      if (host === new URL(roles.origins.api).host) return "api";
-      if (host === new URL(roles.edge).host) return "edge";
-      return "deployment";
-    },
+    onSome: (roles): Route => roleHostOf(roles, host) ?? "deployment",
   });
 
+/**
+ * The role of the host a request to any Cloud Worker was sent to, for records of every Worker's
+ * invocations. The API Worker serves an unnamed host as the deployment origin; here such a host is
+ * `other`, because other Workers receive other hosts: an app's own domain, or the upstream of a
+ * request an app sends out.
+ */
+export const hostRoleOf = (hosts: CloudHosts, host: string | undefined): Route | "other" =>
+  (Option.isSome(hosts.roles) ? roleHostOf(hosts.roles.value, host) : undefined) ??
+  (host === new URL(hosts.deployment).host ? "deployment" : "other");
+
 /** The same path and query on `origin`. */
 const sameRequestAt = (request: HttpServerRequest.HttpServerRequest, origin: string) => {
   const url = new URL(request.originalUrl);
diff --git a/apps/hosted/cloud/src/implementation/invocation-summary.ts b/apps/hosted/cloud/src/implementation/invocation-summary.ts
index 0be16e33ff..b918db8374 100644
--- a/apps/hosted/cloud/src/implementation/invocation-summary.ts
+++ b/apps/hosted/cloud/src/implementation/invocation-summary.ts
@@ -1,6 +1,7 @@
 /** Native invocation totals include background cleanup; they are not response latency. */
 import { Effect, Option, Schema } from "effect";
 import { providerFailureCode } from "./provider-failure.ts";
+import { invocationSurface } from "./invocation-surface.ts";
 import {
   TraceContext,
   externalTrace,
@@ -13,6 +14,7 @@ import {
   InvocationPhase,
   InvocationRpc,
 } from "../contracts/invocation-telemetry.ts";
+import type { CloudHosts } from "../infrastructure/stage.ts";
 
 const phase = Schema.decodeUnknownOption(
   Schema.Union([InvocationPhase, Schema.fromJsonString(InvocationPhase)]),
@@ -38,8 +40,12 @@ const phaseAttribute = {
   "alchemy.do.response": "executor.do_response_ready_ms",
 };
 
-/** Produce an explicit, credential-free projection for one platform callback. */
-export const invocationSummary = (input: unknown) =>
+/**
+ * Produce an explicit, credential-free projection for one platform callback. `hosts`, the
+ * deployment's host layout when it loaded, names the role of the host an HTTP invocation's request
+ * was sent to.
+ */
+export const invocationSummary = (hosts: Option.Option<CloudHosts>, input: unknown) =>
   Schema.decodeUnknownEffect(CloudInvocation)(input).pipe(
     Effect.map((event) => {
       const attributes: Record<string, string | number | boolean> = {
@@ -88,6 +94,13 @@ export const invocationSummary = (input: unknown) =>
       const http = Schema.decodeUnknownOption(InvocationHttp)(event.event);
       if (Option.isSome(http)) {
         attributes["http.request.method"] = http.value.request.method;
+        Object.assign(
+          attributes,
+          invocationSurface(hosts, {
+            url: http.value.request.url,
+            userAgent: http.value.request.headers["user-agent"],
+          }),
+        );
         if (http.value.response !== undefined)
           attributes["http.response.status_code"] = http.value.response.status;
         const ray = http.value.request.headers["cf-ray"];
@@ -113,7 +126,10 @@ export const invocationSummary = (input: unknown) =>
   );
 
 /** Keep valid events if a future platform payload fails to decode; never log that raw payload. */
-export const recordInvocations = (events: ReadonlyArray<unknown>) =>
+export const recordInvocations = (
+  hosts: Option.Option<CloudHosts>,
+  events: ReadonlyArray<unknown>,
+) =>
   Effect.forEach(
     events,
     (event) =>
@@ -126,7 +142,7 @@ export const recordInvocations = (events: ReadonlyArray<unknown>) =>
             event.wallTime,
           ),
         ),
-        Effect.flatMap(invocationSummary),
+        Effect.flatMap((event) => invocationSummary(hosts, event)),
         Effect.flatMap((attributes) =>
           Effect.logInfo("cloudflare.invocation").pipe(
             Effect.annotateLogs(attributes),
diff --git a/apps/hosted/cloud/src/implementation/invocation-surface.ts b/apps/hosted/cloud/src/implementation/invocation-surface.ts
new file mode 100644
index 0000000000..22b66db2f6
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/invocation-surface.ts
@@ -0,0 +1,125 @@
+/**
+ * What an HTTP invocation of a Cloud Worker served, for its `cloudflare.invocation` record: the
+ * role of the host the request was sent to, the part of the product its path belongs to and the
+ * kind of client that sent it. Each is one of a closed set. The URL and the user agent are read
+ * only to choose them and are never recorded.
+ */
+import { Option } from "effect";
+import { isBrowserPage, isMcpPath } from "../contracts/browser-pages.ts";
+import { retainedAssetFolders } from "../contracts/retained-assets.ts";
+import { agentSkills, isSitePage, matchesSitePattern, siteFiles } from "../contracts/site-paths.ts";
+import type { CloudHosts } from "../infrastructure/stage.ts";
+import { hostRoleOf } from "./host-roles.ts";
+
+type RouteGroup =
+  | "mcp"
+  | "api"
+  | "webhooks"
+  | "telemetry"
+  | "auth"
+  | "document"
+  | "assets"
+  | "internal"
+  | "other";
+
+/** Sign-in, Executor's OAuth server and the OAuth sign-ins that connect accounts. */
+const authPath = (pathname: string) =>
+  pathname.startsWith("/api/auth/") ||
+  pathname.startsWith("/api/oauth/") ||
+  pathname.startsWith("/.well-known/oauth-authorization-server") ||
+  pathname === "/oauth/client-metadata.json" ||
+  pathname === "/api/entry" ||
+  pathname === "/api/v1-handoff";
+
+/** The site's analytics proxy and error tunnel, at a random 16-hex-digit path under `/api`. */
+const siteTelemetryPath = /^\/api\/[0-9a-f]{16}\//;
+
+/**
+ * The part of the product a path belongs to, `other` for a path in none of them. Only Executor's
+ * `/_executor/` namespace is known on a host that is not one of this deployment's own, such as an
+ * app's domain or the upstream of an app's outbound request; every other path there is `other`.
+ */
+const routeGroup = (pathname: string, ownHost: boolean): RouteGroup => {
+  if (pathname.startsWith("/_executor/")) {
+    if (pathname.startsWith("/_executor/api/telemetry/")) return "telemetry";
+    if (pathname.startsWith("/_executor/assets/")) return "assets";
+    return "api";
+  }
+  if (!ownHost) return "other";
+  if (pathname.startsWith("/api/webhooks/")) return "webhooks";
+  if (pathname.startsWith("/api/internal/") || pathname === "/health") return "internal";
+  if (pathname.startsWith("/api/telemetry/") || siteTelemetryPath.test(pathname))
+    return "telemetry";
+  if (authPath(pathname)) return "auth";
+  // API discovery shares the protected-resource prefix with MCP's.
+  if (pathname.startsWith("/.well-known/oauth-protected-resource/api")) return "api";
+  if (isMcpPath(pathname)) return "mcp";
+  if (
+    pathname === "/api" ||
+    pathname.startsWith("/api/") ||
+    pathname === "/openapi.json" ||
+    pathname.startsWith("/git/")
+  )
+    return "api";
+  if (
+    retainedAssetFolders.some((folder) => pathname.startsWith(`/${folder}/`)) ||
+    siteFiles.some((pattern) => matchesSitePattern(pattern, pathname))
+  )
+    return "assets";
+  if (isBrowserPage(pathname) || isSitePage(pathname) || matchesSitePattern(agentSkills, pathname))
+    return "document";
+  return "other";
+};
+
+/**
+ * Client families, matched in order against the user agent, most by the product it starts with.
+ * The names follow `auth.token.client_family` where a client is in both. Agents that act for a
+ * person inside a browser-shaped agent string (`ChatGPT-User`, `Claude-User`) come before browsers
+ * and bots.
+ * User agents are self-declared, so this says what a client calls itself, never who it is.
+ */
+const clientFamilies = [
+  // Codex's MCP client, and OpenAI's connector client when Codex runs it.
+  ["codex", /^codex|^openai-mcp\/\S+ \(Codex\)/i],
+  ["chatgpt", /^openai-(?:mcp|connectors)\b|\bChatGPT-User\b/i],
+  // Claude Code in its CLI, SDKs, desktop app and editor extensions.
+  ["claude-code", /^claude-code\//i],
+  // Claude's connectors for claude.ai and the Claude apps.
+  ["claude-ai", /\bClaude-User\b/i],
+  ["cursor", /^Cursor\//i],
+  ["opencode", /^opencode\//i],
+  // Executor's own requests: apps, MCP sources and skills reads, and its telemetry exporters.
+  ["executor", /^(?:Executor|executor-skills)$|^effect-opentelemetry-/],
+  ["bot", /bot\b|crawl|spider|slurp|facebookexternalhit/i],
+  ["browser", /^(?:Mozilla|Opera)\//],
+  ["cli", /^(?:curl|Wget|HTTPie|xh|PowerShell|PostmanRuntime|insomnia)\//i],
+  // An HTTP library or runtime's default agent: an SDK or script that names no client.
+  [
+    "sdk",
+    /^(?:node|undici|Bun|Deno|axios|node-fetch|got|python-|aiohttp|httpx|Go-http-client|okhttp|Java|Apache-HttpClient|reqwest|fasthttp|Dart|RestSharp|Ruby|Faraday)\b/i,
+  ],
+] as const;
+type ClientFamily = (typeof clientFamilies)[number][0] | "none" | "other";
+
+/** `none` for a request without a user agent; `other` for one that names no known client. */
+const clientFamily = (userAgent: string | undefined): ClientFamily => {
+  if (userAgent === undefined || userAgent.trim() === "") return "none";
+  return clientFamilies.find(([, pattern]) => pattern.test(userAgent))?.[0] ?? "other";
+};
+
+/** The surface attributes of one HTTP invocation, from its request's URL and user agent. */
+export const invocationSurface = (
+  hosts: Option.Option<CloudHosts>,
+  request: { readonly url?: string | undefined; readonly userAgent?: string | undefined },
+) => {
+  const url = request.url === undefined ? null : URL.parse(request.url);
+  const role = Option.match(hosts, {
+    onNone: () => "other" as const,
+    onSome: (layout) => hostRoleOf(layout, url?.host),
+  });
+  return {
+    "executor.host_role": role,
+    "executor.route.group": url === null ? "other" : routeGroup(url.pathname, role !== "other"),
+    "executor.client.family": clientFamily(request.userAgent),
+  };
+};
diff --git a/apps/hosted/cloud/src/implementation/mcp-forward.ts b/apps/hosted/cloud/src/implementation/mcp-forward.ts
index f333102f6b..d041ee669e 100644
--- a/apps/hosted/cloud/src/implementation/mcp-forward.ts
+++ b/apps/hosted/cloud/src/implementation/mcp-forward.ts
@@ -1,6 +1,138 @@
-import { Cause, Effect, Schema } from "effect";
-import { HttpServerRequest, type HttpServerResponse } from "effect/http";
+import { Cause, Effect, Option, Schema, Stream } from "effect";
+import { HttpBody, HttpServerRequest, HttpServerResponse } from "effect/http";
 import type { HttpServerError } from "effect/http/HttpServerError";
+import { providerFailureCode } from "./provider-failure.ts";
+
+/**
+ * Cloudflare refuses a call to a Worker or Durable Object once its request has entered the
+ * Workers runtime too many times (at most 32 Worker invocations per request). A client calling
+ * from deep inside its own Worker chain, often one that calls itself, reaches that limit at the
+ * gateway's call to the session object. The object never ran, and the same request from the same
+ * depth is refused again, so the client is told why instead of getting an empty 500.
+ */
+export const refuseTooDeep = <E, R>(
+  forward: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
+) =>
+  forward.pipe(
+    Effect.catchCause((cause) => {
+      const error = Cause.squash(cause);
+      if (
+        Cause.hasInterrupts(cause) ||
+        !(error instanceof Error) ||
+        !error.message.startsWith("Subrequest depth limit exceeded.")
+      )
+        return Effect.failCause(cause);
+      return Effect.annotateCurrentSpan("executor.mcp.refused", "subrequest-depth").pipe(
+        Effect.as(
+          HttpServerResponse.jsonUnsafe(
+            {
+              jsonrpc: "2.0",
+              id: null,
+              error: {
+                code: -32000,
+                message:
+                  "Subrequest depth limit exceeded: this request reached Executor after passing through Cloudflare Workers too many times, so Cloudflare refused Executor's next step. The Worker or Durable Object that called Executor is nested too deeply, often because it calls itself or other Workers recursively. Call Executor from a shallower point in that chain",
+              },
+            },
+            { status: 508, headers: { "cache-control": "no-store" } },
+          ),
+        ),
+      );
+    }),
+  );
+
+const RpcMessage = Schema.Struct({
+  id: Schema.optional(Schema.Union([Schema.String, Schema.Number])),
+});
+/** A POST body's message, or batch of messages. */
+const Requests = Schema.Union([RpcMessage, Schema.Array(RpcMessage)]);
+
+const memoryLimitMessage =
+  "Executor's MCP session ran out of memory while answering this request, so its response was lost: the Durable Object running it, or another in the same isolate, exceeded Cloudflare's 128 MB memory limit and was reset. A very large result is the usual cause. Executor sets no limit on a result, but Cloud holds one several times over while sending it, so a result of a few tens of megabytes can exceed the limit. Return less, such as selected fields, a count or one page. Tool calls made before this may have completed, so check current state before running the same work again";
+
+/**
+ * The errors answering each request in a POST body whose response was lost, one event each on a
+ * stream, and as JSON in the shape the body had. Undefined when no message expects a response.
+ */
+const memoryLimitAnswer = (body: Option.Option<unknown>) =>
+  Option.getOrUndefined(
+    Option.flatMap(Option.flatMap(body, Schema.decodeUnknownOption(Requests)), (requests) => {
+      const errors = (Array.isArray(requests) ? requests : [requests]).flatMap(({ id }) =>
+        id === undefined
+          ? []
+          : [{ jsonrpc: "2.0", id, error: { code: -32603, message: memoryLimitMessage } }],
+      );
+      return errors.length === 0
+        ? Option.none()
+        : Option.some({ errors, json: Array.isArray(requests) ? errors : errors[0] });
+    }),
+  );
+
+/**
+ * When the session object exceeds its isolate's memory limit while answering, its response is
+ * lost: the object's fetch fails, or its event stream ends without the answer. The gateway runs
+ * in another isolate and sees that failure, so it answers each request in the POST with an error
+ * that names the limit. Without it the client waits for an answer until its own timeout. Apply
+ * it outside `observeMcpStream`, which records the failure. `body` is the POST body as JSON
+ * (`parseMcpBody`).
+ */
+export const answerMemoryLimit =
+  (body: Option.Option<unknown>) =>
+  <E, R>(forward: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) => {
+    const answer = memoryLimitAnswer(body);
+    if (answer === undefined) return forward;
+    const exceeded = (cause: Cause.Cause<unknown>) =>
+      !Cause.hasInterruptsOnly(cause) &&
+      providerFailureCode(Cause.squash(cause)) === "memory_limit";
+    const refused = Effect.annotateCurrentSpan("executor.mcp.refused", "memory-limit");
+    return forward.pipe(
+      Effect.catchCause((cause) =>
+        exceeded(cause)
+          ? refused.pipe(
+              Effect.as(
+                HttpServerResponse.jsonUnsafe(answer.json, {
+                  headers: { "cache-control": "no-store" },
+                }),
+              ),
+            )
+          : Effect.failCause(cause),
+      ),
+      Effect.map((response) => {
+        const body = response.body;
+        if (!(body instanceof HttpBody.Stream) || !body.contentType.startsWith("text/event-stream"))
+          return response;
+        // The last two bytes sent. An event the failure cut off is ended first, so the error is
+        // an event of its own.
+        let tail = [10, 10];
+        const events = new TextEncoder().encode(
+          answer.errors.map((error) => `data: ${JSON.stringify(error)}\n\n`).join(""),
+        );
+        return HttpServerResponse.setBody(
+          response,
+          HttpBody.stream(
+            body.stream.pipe(
+              Stream.tap((chunk) =>
+                Effect.sync(() => {
+                  tail = [...tail, ...chunk.subarray(-2)].slice(-2);
+                }),
+              ),
+              Stream.catchCause((cause) =>
+                // The stream's close records the failure; this only answers the client.
+                exceeded(cause)
+                  ? Stream.make(
+                      tail[0] === 10 && tail[1] === 10
+                        ? events
+                        : new Uint8Array([10, 10, ...events]),
+                    )
+                  : Stream.failCause(cause),
+              ),
+            ),
+            body.contentType,
+          ),
+        );
+      }),
+    );
+  };
 
 const Initialize = Schema.Struct({
   jsonrpc: Schema.Literal("2.0"),
diff --git a/apps/hosted/cloud/src/implementation/mcp-request-method.ts b/apps/hosted/cloud/src/implementation/mcp-request-method.ts
new file mode 100644
index 0000000000..bc0a605021
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/mcp-request-method.ts
@@ -0,0 +1,114 @@
+/**
+ * The JSON-RPC method an MCP POST carries, for the gateway's spans, so MCP latency and failures
+ * can be split by method. Every value is from a closed set; nothing the caller chose is recorded.
+ */
+import type { BrowserMcpToolkit, McpToolkit, NativeMcpToolkit } from "@executor-js/mcp";
+import { Option, Schema } from "effect";
+import type { McpSchema } from "effect/ai";
+
+/**
+ * What 2026-07-28 adds to a client's methods, the events extension's included
+ * (`patches/effect-mcp-events.md`). Its adapter's RPC group is internal to Effect, so these are
+ * copied from it.
+ */
+type StatelessClientMethod =
+  | "server/discover"
+  | "subscriptions/listen"
+  | "events/list"
+  | "events/subscribe"
+  | "events/unsubscribe";
+/** Requests and notifications the earlier revisions take from a client, as `McpSchema` types them. */
+type ClientMethod =
+  | McpSchema.ClientRequestEncoded["method"]
+  | McpSchema.ClientNotificationEncoded["method"]
+  | StatelessClientMethod;
+/**
+ * Every method a client can send Executor's MCP server in a revision it serves (`protocols` in
+ * `packages/mcp/src/implementation/server.ts`). Any other is `other`, including one only a server
+ * sends, such as `sampling/createMessage` or `notifications/subscriptions/acknowledged`. The record
+ * type keeps the list equal to `ClientMethod`. It is not read from the protocol adapters at
+ * runtime, because that would load them into the API Worker, which runs the gateway.
+ */
+const methods = new Set(
+  Object.keys({
+    initialize: true,
+    ping: true,
+    "server/discover": true,
+    "tools/list": true,
+    "tools/call": true,
+    "resources/list": true,
+    "resources/templates/list": true,
+    "resources/read": true,
+    "resources/subscribe": true,
+    "resources/unsubscribe": true,
+    "prompts/list": true,
+    "prompts/get": true,
+    "completion/complete": true,
+    "logging/setLevel": true,
+    "subscriptions/listen": true,
+    "events/list": true,
+    "events/subscribe": true,
+    "events/unsubscribe": true,
+    "notifications/initialized": true,
+    "notifications/cancelled": true,
+    "notifications/progress": true,
+    "notifications/roots/list_changed": true,
+  } satisfies Record<ClientMethod, true>),
+);
+
+type ExecutorTool =
+  | keyof (typeof McpToolkit)["tools"]
+  | keyof (typeof NativeMcpToolkit)["tools"]
+  | keyof (typeof BrowserMcpToolkit)["tools"];
+/** Executor's own MCP tools in every elicitation mode; the record type keeps the list complete. */
+const executorTools = new Set(
+  Object.keys({
+    execute: true,
+    call: true,
+    search: true,
+    describe: true,
+    resume: true,
+    skills: true,
+  } satisfies Record<ExecutorTool, true>),
+);
+
+const isRequest = Schema.is(Schema.Struct({ method: Schema.String }));
+const isToolCall = Schema.is(Schema.Struct({ params: Schema.Struct({ name: Schema.String }) }));
+/** A client's answer to the server's own request, such as an elicitation; it has no method. */
+const isResponse = Schema.is(
+  Schema.Union([
+    Schema.Struct({ result: Schema.Unknown }),
+    Schema.Struct({ error: Schema.Unknown }),
+  ]),
+);
+
+const Json = Schema.fromJsonString(Schema.Unknown);
+/** A POST body as JSON. The gateway parses it once, for these attributes and `answerMemoryLimit`. */
+export const parseMcpBody = (body: string | undefined): Option.Option<unknown> =>
+  body === undefined ? Option.none() : Schema.decodeUnknownOption(Json)(body);
+
+/**
+ * `rpc.method`: one of `methods`, `batch` for an array of messages, `response` for a client's answer
+ * and `other` for anything else, including a body that is not JSON. A `tools/call` also records
+ * `executor.mcp.tool`: the Executor tool it names, or `other`. Arguments are never read.
+ */
+export const mcpRequestAttributes = (message: Option.Option<unknown>) => {
+  const value = Option.getOrUndefined(message);
+  const method = Array.isArray(value)
+    ? "batch"
+    : isRequest(value)
+      ? methods.has(value.method)
+        ? value.method
+        : "other"
+      : isResponse(value)
+        ? "response"
+        : "other";
+  const attributes: Record<string, string> = {
+    "rpc.system.name": "jsonrpc",
+    "rpc.method": method,
+  };
+  if (method === "tools/call")
+    attributes["executor.mcp.tool"] =
+      isToolCall(value) && executorTools.has(value.params.name) ? value.params.name : "other";
+  return attributes;
+};
diff --git a/apps/hosted/cloud/src/implementation/mcp-session-id.ts b/apps/hosted/cloud/src/implementation/mcp-session-id.ts
index 49233eb607..c713fe25a8 100644
--- a/apps/hosted/cloud/src/implementation/mcp-session-id.ts
+++ b/apps/hosted/cloud/src/implementation/mcp-session-id.ts
@@ -13,8 +13,10 @@ import { Effect, Option } from "effect";
 import { HttpServerResponse } from "effect/http";
 
 /**
- * Carries the organization the object authenticated to the gateway, which records it on its forward
- * and removes it: a request routed by its session id is not authenticated in the gateway.
+ * Carry the organization the object authenticated to the gateway, which records it on its forward
+ * and removes it: a request routed by its session id is not authenticated in the gateway. The
+ * object sets it only once the bearer's own key names it. The user is not carried: an older
+ * gateway during a deploy would pass a new header through to the client.
  */
 export const sessionOrganizationHeader = "x-executor-session-organization";
 
diff --git a/apps/hosted/cloud/src/implementation/migrations.ts b/apps/hosted/cloud/src/implementation/migrations.ts
index 8fa83bc342..5fee598819 100644
--- a/apps/hosted/cloud/src/implementation/migrations.ts
+++ b/apps/hosted/cloud/src/implementation/migrations.ts
@@ -163,6 +163,81 @@ export const migrateV1ImportOrgs = Effect.gen(function* () {
   )`;
 }).pipe(Effect.mapError(migrationFailed("product")));
 
+/**
+ * The v1 session handoff tokens v2 has accepted (`v1-session-handoff.ts`), so each is used once.
+ * A row is needed only until its token expires; the handoff deletes expired rows. Additive: the
+ * running server never reads it.
+ */
+export const migrateV1SessionHandoffs = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`create table if not exists private_v1_session_handoff (
+    jti text primary key,
+    expires_at timestamptz not null,
+    used_at timestamptz not null default now()
+  )`;
+  yield* sql`create index if not exists private_v1_session_handoff_expires
+    on private_v1_session_handoff (expires_at)`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
+/**
+ * The v1 organizations an import may write (`notes/v1-import.md`, `v1-import/writes.ts`): an import
+ * of an organization without a row is refused. A guard apart from the operator token, which alone
+ * allows nothing. No route, operator command or app path writes it; rows are added only by direct
+ * SQL from someone with access to the database. It starts empty and copies nothing, so until rows
+ * are inserted every import is refused. Additive: the running server never reads it.
+ */
+export const migrateV1ImportAllowed = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`create table if not exists private_v1_import_allowed (
+    v1_org_id text primary key,
+    added_at timestamptz not null default now(),
+    note text
+  )`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
+/**
+ * The billing of each paid v1 organization an import moves (`notes/v1-import.md`, "Billing"): its
+ * v2 organization, what v1's subscription was and its Stripe subscription, and how far the
+ * carry-over got. `held` keeps v2 billing from creating the organization's customer while v1's is
+ * carried over, `carried` lets it bill normally, and `returned` means v1 bills the organization
+ * again. The import inserts the row with the organization. Additive: the running server never
+ * reads it.
+ */
+export const migrateV1ImportBilling = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`create table if not exists private_v1_import_billing (
+    organization_id text primary key references organization(id) on delete cascade,
+    v1_org_id text not null unique,
+    state text not null check (state in ('held', 'carried', 'returned')),
+    subscription jsonb not null,
+    stripe_subscription_id text,
+    updated_at timestamptz not null default now()
+  )`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
+/**
+ * The v2 organization an import of the row's v1 organization may rename to take its slug
+ * (`notes/v1-import.md`, "Slug displacement"), written by direct SQL like the rest of the table.
+ * Additive and nullable, without a default, so adding it rewrites nothing; the running server
+ * reads only `v1_org_id`.
+ */
+export const migrateV1ImportDisplacement = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`alter table private_v1_import_allowed add column if not exists displace_v2_org_id text`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
+/**
+ * The existing v2 organization the row's v1 organization moves into instead of a new one, and how
+ * (`notes/v1-import.md`, decision 32), written by direct SQL like the rest of the table. Additive
+ * and nullable, without defaults, so adding them rewrites nothing; the running server reads only
+ * `v1_org_id` and `displace_v2_org_id`.
+ */
+export const migrateV1ImportInto = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`alter table private_v1_import_allowed add column if not exists into_v2_org_id text`;
+  yield* sql`alter table private_v1_import_allowed add column if not exists into_mode text`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
 /**
  * The onboarding experiment's assignments (`notes/posthog.md#onboarding-order-experiment`): one
  * row per member who created their first team through team setup and was assigned a variant,
@@ -180,6 +255,25 @@ export const migrateSetupAssignments = Effect.gen(function* () {
   )`;
 }).pipe(Effect.mapError(migrationFailed("product")));
 
+/**
+ * The onboarding skip experiment's assignments (`notes/posthog.md#onboarding-skip-experiment`): one
+ * row per member who created their first team through team setup and was assigned a variant, when
+ * they first saw it, and when a `required` member finished both setup steps. Kept apart from
+ * `cloud_setup_assignment` because each flag can be unavailable on its own. Additive: the running
+ * server never reads it. Drop it in a later release once the experiment is retired.
+ */
+export const migrateSetupSkipAssignments = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`create table if not exists cloud_setup_skip_assignment (
+    user_id text primary key,
+    organization_id text not null,
+    variant text not null check (variant in ('skippable', 'required')),
+    assigned_at timestamptz not null default now(),
+    exposed_at timestamptz,
+    completed_at timestamptz
+  )`;
+}).pipe(Effect.mapError(migrationFailed("product")));
+
 /** Apply Better Auth and product migrations, then close both database pools. */
 export const migrateCloudDatabase = Effect.scoped(
   Effect.gen(function* () {
@@ -202,6 +296,12 @@ export const migrateCloudDatabase = Effect.scoped(
         "5_v1_import_map": migrateV1ImportMap,
         "6_setup_assignments": migrateSetupAssignments,
         "7_v1_import_orgs": migrateV1ImportOrgs,
+        "8_v1_session_handoffs": migrateV1SessionHandoffs,
+        "9_v1_import_allowed": migrateV1ImportAllowed,
+        "10_setup_skip_assignments": migrateSetupSkipAssignments,
+        "11_v1_import_billing": migrateV1ImportBilling,
+        "12_v1_import_displacement": migrateV1ImportDisplacement,
+        "13_v1_import_into": migrateV1ImportInto,
       });
     });
     yield* migrateHostedDatabase(setup.options, cloudMigrations).pipe(
diff --git a/apps/hosted/cloud/src/implementation/onboarding-handlers.ts b/apps/hosted/cloud/src/implementation/onboarding-handlers.ts
index efdbb44c24..39c9c68340 100644
--- a/apps/hosted/cloud/src/implementation/onboarding-handlers.ts
+++ b/apps/hosted/cloud/src/implementation/onboarding-handlers.ts
@@ -1,4 +1,8 @@
-import { CurrentOrganization, CurrentPrincipal } from "@executor-js/hosted-server";
+import {
+  CurrentOrganization,
+  CurrentPrincipal,
+  memberSetupProgress,
+} from "@executor-js/hosted-server";
 import { Effect, Schema, Stream } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
@@ -58,15 +62,29 @@ export const onboardingHandlers = HttpApiBuilder.group(ExecutorCloudApi, "onboar
   }),
 );
 
-/** The member's setup order for a team they may already read; membership was checked first. */
+/**
+ * The member's setup for a team they may already read, and whether its dashboard is open to them;
+ * membership was checked first.
+ */
 export const setupHandlers = HttpApiBuilder.group(ExecutorCloudApi, "setup", (handlers) =>
   Effect.gen(function* () {
     const onboarding = yield* Onboarding;
-    return handlers.handle("sequence", () =>
-      Effect.gen(function* () {
-        const { userId } = yield* CurrentPrincipal;
-        return yield* onboarding.setup(userId, (yield* CurrentOrganization).organization);
-      }),
-    );
+    return handlers
+      .handle("sequence", () =>
+        Effect.gen(function* () {
+          const { userId } = yield* CurrentPrincipal;
+          return yield* onboarding.setup(userId, (yield* CurrentOrganization).organization);
+        }),
+      )
+      .handle("gate", () =>
+        Effect.gen(function* () {
+          const { userId } = yield* CurrentPrincipal;
+          return yield* onboarding.gate(
+            userId,
+            (yield* CurrentOrganization).organization,
+            memberSetupProgress,
+          );
+        }),
+      );
   }),
 );
diff --git a/apps/hosted/cloud/src/implementation/onboarding-store.ts b/apps/hosted/cloud/src/implementation/onboarding-store.ts
index 90a88bd828..80ecbe079f 100644
--- a/apps/hosted/cloud/src/implementation/onboarding-store.ts
+++ b/apps/hosted/cloud/src/implementation/onboarding-store.ts
@@ -3,7 +3,7 @@ import { SqlClient } from "effect/sql";
 import { fumadb } from "fumadb-effect";
 import { column, idColumn, schema, table } from "fumadb-effect/schema";
 import { sqlAdapter } from "fumadb-effect/sql";
-import { SetupOrder } from "@executor-js/hosted-server/setup";
+import { SetupOrder, SetupSkip } from "@executor-js/hosted-server/setup";
 import {
   CompanyProfile,
   OnboardingReady,
@@ -179,7 +179,41 @@ export const makeOnboardingStore = Effect.gen(function* () {
       Effect.flatMap(Schema.decodeUnknownEffect(Assignment)),
       Effect.map((rows) => rows[0]?.variant),
     );
+  /** Keep the first assignment, as the order's: a retried creation never changes it. */
+  const assignSkip = (userId: string, organizationId: string, variant: SetupSkip) =>
+    sql`insert into cloud_setup_skip_assignment (user_id, organization_id, variant)
+      values (${userId}, ${organizationId}, ${variant})
+      on conflict (user_id) do nothing`.pipe(Effect.asVoid);
+  const SkipAssignment = Schema.Array(
+    Schema.Struct({ variant: SetupSkip, completed: Schema.Boolean }),
+  );
+  /** The member's skip assignment for this team, and whether a required setup finished. */
+  const skipAssignment = (userId: string, organizationId: string) =>
+    sql`select variant, completed_at is not null as completed from cloud_setup_skip_assignment
+      where user_id = ${userId} and organization_id = ${organizationId}`.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(SkipAssignment)),
+      Effect.map((rows) => rows[0]),
+    );
+  /** Marks the skip assignment seen; only the one request that marks it gets the variant back. */
+  const claimSkipExposure = (userId: string, organizationId: string) =>
+    sql`update cloud_setup_skip_assignment set exposed_at = now()
+      where user_id = ${userId} and organization_id = ${organizationId} and exposed_at is null
+      returning variant`.pipe(
+      Effect.flatMap(
+        Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ variant: SetupSkip }))),
+      ),
+      Effect.map((rows) => rows[0]?.variant),
+    );
+  /** Setup finished: from now on the dashboard stays open, whatever later changes. */
+  const completeSetup = (userId: string, organizationId: string) =>
+    sql`update cloud_setup_skip_assignment set completed_at = now()
+      where user_id = ${userId} and organization_id = ${organizationId}
+        and completed_at is null`.pipe(Effect.asVoid);
   return {
+    assignSkip,
+    skipAssignment,
+    claimSkipExposure,
+    completeSetup,
     assignSetup,
     setupAssignment,
     claimSetupExposure,
diff --git a/apps/hosted/cloud/src/implementation/onboarding.ts b/apps/hosted/cloud/src/implementation/onboarding.ts
index f956d43567..197bef065f 100644
--- a/apps/hosted/cloud/src/implementation/onboarding.ts
+++ b/apps/hosted/cloud/src/implementation/onboarding.ts
@@ -10,8 +10,9 @@ import {
   OrganizationLogo,
   organizationHandle,
   organizationSlugMaxLength,
+  type OrganizationId,
 } from "@executor-js/hosted-server";
-import { SetupOrder } from "@executor-js/hosted-server/setup";
+import { SetupOrder, SetupSkip, type SetupStep } from "@executor-js/hosted-server/setup";
 import {
   TeamIconOwner,
   CompanyLookup,
@@ -23,6 +24,8 @@ import {
   TeamIconNotFound,
   V1Membership,
   onboardingExperiment,
+  onboardingSkipExperiment,
+  SetupGate,
 } from "../contracts/onboarding.ts";
 import { FeatureFlags } from "./feature-flags.ts";
 import { makeOnboardingStore } from "./onboarding-store.ts";
@@ -189,7 +192,7 @@ export const makeOnboarding = Effect.fn("onboarding.service")(function* (options
       if (created === undefined || selected.next !== "setup" || confirmed.status !== "ready")
         return confirmed;
       yield* assignSetup(userId, created);
-      // The browser opens the first step straight away, so the order is read, and any exposure
+      // The browser opens the first step straight away, so the setup is read, and any exposures
       // recorded, as that step is shown. A failed read leaves the step to read it.
       const sequence = yield* setup(userId, created).pipe(Effect.option);
       return Option.isSome(sequence) ? { ...confirmed, setup: sequence.value } : confirmed;
@@ -198,43 +201,96 @@ export const makeOnboarding = Effect.fn("onboarding.service")(function* (options
       Effect.withSpan("onboarding.create"),
     );
   /**
-   * Ask PostHog for the new team's setup order and keep its answer, so every later read shows the
-   * same one. An unavailable flag, or a failure keeping the answer, leaves the team unassigned:
-   * it sees the control and is not counted. Creating the team never waits on more than the
-   * evaluation's one-second deadline and never fails because of it.
+   * Ask PostHog, in one evaluation, for the new team's setup order and whether its steps can be
+   * skipped, and keep each answer, so every later read shows the same setup. The two experiments
+   * are independent: an unavailable flag, or a failure keeping its answer, leaves the member
+   * unassigned in that experiment only, where they see its control and are not counted. Creating
+   * the team never waits on more than the evaluation's one-second deadline and never fails
+   * because of it.
    */
   const assignSetup = (userId: string, organization: string) =>
     Effect.gen(function* () {
       const flags = yield* FeatureFlags;
-      const variant = Schema.decodeUnknownOption(SetupOrder)(
-        yield* flags.evaluate(onboardingExperiment.flag, userId),
+      const answers = yield* flags.evaluate(
+        [onboardingExperiment.flag, onboardingSkipExperiment.flag],
+        userId,
       );
-      if (Option.isSome(variant)) yield* store.assignSetup(userId, organization, variant.value);
+      const order = Schema.decodeUnknownOption(SetupOrder)(answers[onboardingExperiment.flag]);
+      if (Option.isSome(order))
+        yield* store
+          .assignSetup(userId, organization, order.value)
+          .pipe(
+            Effect.catch(() =>
+              Effect.logWarning(
+                "Setup order was not assigned; the team sees the control untracked",
+              ),
+            ),
+          );
+      const skip = Schema.decodeUnknownOption(SetupSkip)(answers[onboardingSkipExperiment.flag]);
+      if (Option.isSome(skip))
+        yield* store
+          .assignSkip(userId, organization, skip.value)
+          .pipe(
+            Effect.catch(() =>
+              Effect.logWarning(
+                "Setup skip was not assigned; the member sees the control untracked",
+              ),
+            ),
+          );
+    });
+  /** Exactly one read marks an assignment seen, so each exposure is recorded once. */
+  const exposure = (
+    userId: string,
+    organization: OrganizationId,
+    flag: string,
+    claimed: string | undefined,
+  ) =>
+    claimed === undefined
+      ? Effect.void
+      : recordFlagExposure({ userId, organizationId: organization, flag, variant: claimed });
+  const setup: typeof Onboarding.Service.setup = (userId, organization) =>
+    Effect.gen(function* () {
+      const exposedOrder = yield* store.claimSetupExposure(userId, organization);
+      yield* exposure(userId, organization, onboardingExperiment.flag, exposedOrder);
+      const exposedSkip = yield* store.claimSkipExposure(userId, organization);
+      yield* exposure(userId, organization, onboardingSkipExperiment.flag, exposedSkip);
+      const order = exposedOrder ?? (yield* store.setupAssignment(userId, organization));
+      const skip = exposedSkip ?? (yield* store.skipAssignment(userId, organization))?.variant;
+      return {
+        order: order ?? onboardingExperiment.control,
+        enrolled: order !== undefined,
+        skip: {
+          variant: skip ?? onboardingSkipExperiment.control,
+          enrolled: skip !== undefined,
+        },
+      };
     }).pipe(
-      Effect.catch(() =>
-        Effect.logWarning("Setup order was not assigned; the team sees the control untracked"),
-      ),
+      Effect.mapError(() => new OnboardingUnavailable()),
+      Effect.withSpan("onboarding.setup"),
     );
-  const setup: typeof Onboarding.Service.setup = (userId, organization) =>
+  const gate: typeof Onboarding.Service.gate = (userId, organization, progress) =>
     Effect.gen(function* () {
-      // Exactly one read marks the assignment seen, so the exposure is recorded once.
-      const exposed = yield* store.claimSetupExposure(userId, organization);
-      if (exposed !== undefined) {
-        yield* recordFlagExposure({
-          userId,
-          organizationId: organization,
-          flag: onboardingExperiment.flag,
-          variant: exposed,
-        });
-        return { order: exposed, enrolled: true };
+      const assigned = yield* store.skipAssignment(userId, organization);
+      if (assigned === undefined || assigned.variant !== "required" || assigned.completed)
+        return SetupGate.make({ status: "open" });
+      const done = yield* progress;
+      if (done.accounts && done.agent !== undefined) {
+        yield* store.completeSetup(userId, organization);
+        return SetupGate.make({ status: "open" });
       }
-      const assigned = yield* store.setupAssignment(userId, organization);
-      return assigned === undefined
-        ? { order: onboardingExperiment.control, enrolled: false }
-        : { order: assigned, enrolled: true };
+      const order =
+        (yield* store.setupAssignment(userId, organization)) ?? onboardingExperiment.control;
+      // The next step is the first of the member's order that is not done.
+      const first: SetupStep = order === "assistant_first" ? "assistant" : "accounts";
+      const firstDone = first === "accounts" ? done.accounts : done.agent !== undefined;
+      const step: SetupStep = firstDone ? (first === "accounts" ? "assistant" : "accounts") : first;
+      // The account step carries a connected assistant on to the first prompt.
+      return step === "accounts" && done.agent !== undefined
+        ? SetupGate.make({ status: "setup", step, agent: done.agent })
+        : SetupGate.make({ status: "setup", step });
     }).pipe(
       Effect.mapError(() => new OnboardingUnavailable()),
-      Effect.withSpan("onboarding.setup"),
+      Effect.withSpan("onboarding.gate"),
     );
   const icon: typeof Onboarding.Service.icon = (userId, owner, key) =>
     Effect.gen(function* () {
@@ -269,5 +325,5 @@ export const makeOnboarding = Effect.fn("onboarding.service")(function* (options
       Effect.mapError(() => new OnboardingUnavailable()),
       Effect.withSpan("onboarding.allowsOrganization"),
     );
-  return Onboarding.of({ prepare, create, allowsOrganization, setup, icon });
+  return Onboarding.of({ prepare, create, allowsOrganization, setup, gate, icon });
 });
diff --git a/apps/hosted/cloud/src/implementation/organization-removal.ts b/apps/hosted/cloud/src/implementation/organization-removal.ts
index 6443f4ae69..979cacd22a 100644
--- a/apps/hosted/cloud/src/implementation/organization-removal.ts
+++ b/apps/hosted/cloud/src/implementation/organization-removal.ts
@@ -3,9 +3,9 @@ import {
   beginOrganizationRemoval,
   previewOrganizationRemoval,
   OrganizationId,
-  OrganizationTombstones,
+  type OrganizationRemovalUnavailable,
 } from "@executor-js/hosted-server";
-import { Effect, Schema } from "effect";
+import { Context, Effect, Schema } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HttpServerResponse } from "effect/http";
 import {
@@ -15,22 +15,31 @@ import {
 import { OrganizationRemovalRecovery } from "../infrastructure/organization-removal-recovery.ts";
 import { ExecutorCloudApi } from "../contracts/api.ts";
 
+/** The tombstones among a list of organizations, read together rather than one at a time. */
+export class RemovedOrganizations extends Context.Service<
+  RemovedOrganizations,
+  (
+    organizations: ReadonlyArray<OrganizationId>,
+  ) => Effect.Effect<ReadonlySet<OrganizationId>, OrganizationRemovalUnavailable>
+>()("cloud/RemovedOrganizations") {}
+
 /** Native membership rows outlive acceptance; never put a removed team back in the switcher. */
 export const hideRemovedOrganizations = (response: HttpServerResponse.HttpServerResponse) =>
   Effect.gen(function* () {
     if (response.status !== 200) return response;
-    const removed = yield* OrganizationTombstones;
+    const removedAmong = yield* RemovedOrganizations;
     const entries = yield* Effect.tryPromise(() => HttpServerResponse.toWeb(response).json()).pipe(
       Effect.flatMap(
         Schema.decodeUnknownEffect(Schema.Array(Schema.Record(Schema.String, Schema.Unknown))),
       ),
     );
-    const visible = yield* Effect.filter(entries, (entry) =>
+    const listed = yield* Effect.forEach(entries, (entry) =>
       Schema.decodeUnknownEffect(OrganizationId)(entry.id).pipe(
-        Effect.flatMap(removed),
-        Effect.map((deleted) => !deleted),
+        Effect.map((id) => ({ id, entry })),
       ),
     );
+    const removed = yield* removedAmong(listed.map(({ id }) => id));
+    const visible = listed.flatMap(({ id, entry }) => (removed.has(id) ? [] : [entry]));
     return yield* HttpServerResponse.json(visible, {
       headers: response.headers,
       cookies: response.cookies,
diff --git a/apps/hosted/cloud/src/implementation/product-analytics.ts b/apps/hosted/cloud/src/implementation/product-analytics.ts
index e35cbc13c0..efc2b74b4f 100644
--- a/apps/hosted/cloud/src/implementation/product-analytics.ts
+++ b/apps/hosted/cloud/src/implementation/product-analytics.ts
@@ -18,7 +18,7 @@ import {
   HttpServerRequest,
   HttpServerResponse,
 } from "effect/http";
-import { evaluateFlag, FeatureFlags } from "./feature-flags.ts";
+import { evaluateFlags, FeatureFlags } from "./feature-flags.ts";
 
 const Settings = Schema.Struct({
   token: Schema.String,
@@ -215,7 +215,7 @@ export const withProductAnalytics = <A, E, R>(
         add,
       }),
       Effect.provideService(FeatureFlags, {
-        evaluate: (key, distinctId) => evaluateFlag(config, key, distinctId),
+        evaluate: (keys, distinctId) => evaluateFlags(config, keys, distinctId),
       }),
       Effect.provideService(ProductAnalytics, {
         enabled: true,
diff --git a/apps/hosted/cloud/src/implementation/runtime-actor.ts b/apps/hosted/cloud/src/implementation/runtime-actor.ts
new file mode 100644
index 0000000000..661abdb863
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/runtime-actor.ts
@@ -0,0 +1,19 @@
+/** Whom a Cloud app runtime operation runs for, as its spans record it. */
+import { Context, Effect, Option } from "effect";
+import { CurrentOrganization, CurrentUserId } from "@executor-js/hosted-server";
+
+/**
+ * The opaque user and organization ids the current context holds, read without I/O. Work that runs
+ * for no signed-in caller, such as a webhook delivery, holds neither.
+ */
+export const runtimeActor = Effect.gen(function* () {
+  const context = yield* Effect.context<never>();
+  const user = Context.get(context, CurrentUserId);
+  const organization = Context.getOption(context, CurrentOrganization);
+  return {
+    ...(user === undefined ? {} : { "executor.user.id": user }),
+    ...(Option.isSome(organization)
+      ? { "executor.organization.id": organization.value.organization }
+      : {}),
+  };
+});
diff --git a/apps/hosted/cloud/src/implementation/test-stage-commands.ts b/apps/hosted/cloud/src/implementation/test-stage-commands.ts
index 2a1ed7e03c..68e1bf4c9c 100644
--- a/apps/hosted/cloud/src/implementation/test-stage-commands.ts
+++ b/apps/hosted/cloud/src/implementation/test-stage-commands.ts
@@ -139,6 +139,8 @@ const operation = (name: "deploy" | "plan") =>
       database: Flag.Literals("database", ["neon", "planetscale"]).pipe(Flag.optional),
       retention: Flag.Literals("retention", ["retained", "temporary"]).pipe(Flag.optional),
       background: Flag.Literals("background", ["active", "paused"]).pipe(Flag.optional),
+      // Each deploy chooses again; a redeploy without the flag stops the export.
+      telemetry: Flag.Literals("telemetry", ["export", "off"]).pipe(Flag.withDefault("off")),
       noInput: Flag.Boolean("no-input").pipe(Flag.withDefault(false)),
       yes: Flag.Boolean("yes").pipe(Flag.withDefault(false)),
     },
@@ -203,6 +205,7 @@ const operation = (name: "deploy" | "plan") =>
             TEST_STAGE_DATABASE_PROVIDER: lease.database,
             TEST_STAGE_RETENTION: lease.retention,
             TEST_STAGE_BACKGROUND: metadata.background,
+            TEST_STAGE_TELEMETRY: input.telemetry,
             TEST_STAGE_EXPIRES_AT:
               lease.expiresAt === null ? "" : String(Math.floor(lease.expiresAt)),
           };
diff --git a/apps/hosted/cloud/src/implementation/v1-import/aggregate.ts b/apps/hosted/cloud/src/implementation/v1-import/aggregate.ts
index da291297bc..da6584e6f7 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/aggregate.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/aggregate.ts
@@ -40,6 +40,7 @@ export const emptyAggregate = (runId: string): V1ImportAggregate => ({
   artifacts: [],
   flags: { sso: [], ssoUnread: [], overFreeMemberLimit: [], paid: [] },
   vaultFailures: [],
+  splitIntegrations: [],
 });
 
 const sum = (
@@ -119,7 +120,7 @@ export const addReports = (
     slugChanges: [
       ...aggregate.slugChanges,
       ...reports.flatMap((report) =>
-        report.slug?.changed === true
+        report.slug?.changed === true || report.slug?.displaced !== undefined
           ? [{ organization: report.organization, ...report.slug }]
           : [],
       ),
@@ -193,5 +194,9 @@ export const addReports = (
       ...aggregate.vaultFailures,
       ...listed(reports, (report) => report.vaultFailures),
     ],
+    splitIntegrations: [
+      ...(aggregate.splitIntegrations ?? []),
+      ...listed(reports, (report) => report.splitIntegrations ?? []),
+    ],
   };
 };
diff --git a/apps/hosted/cloud/src/implementation/v1-import/billing.ts b/apps/hosted/cloud/src/implementation/v1-import/billing.ts
new file mode 100644
index 0000000000..c9bade94d8
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-import/billing.ts
@@ -0,0 +1,585 @@
+/**
+ * A paid v1 organization's subscription, carried over to its v2 organization's billing
+ * (`notes/v1-import.md`, "Billing"; decision 5). v1 and v2 bill in the same Autumn account and
+ * Stripe account. The carry-over renames v1's Autumn customer to the v2 organization's customer
+ * id, then attaches v2's Team plan to the same Stripe subscription in place of v1's Team plan: no
+ * new subscription, charge, proration, trial or renewal date. `returnBilling` reverses it.
+ *
+ * Every write is preceded by a read of where Autumn already is, so a step that runs again after
+ * a lost response continues from there instead of writing twice.
+ */
+import type { OrganizationId } from "@executor-js/hosted-server";
+import { Clock, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { AutumnClient, AutumnRequestFailed, AutumnResponses } from "../../contracts/autumn.ts";
+import type { BillingUnavailable } from "../../contracts/billing.ts";
+import {
+  billingCustomerId,
+  teamMemberPrice,
+  type BillingCatalog,
+} from "../../contracts/billing-catalog.ts";
+import { V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import { freePlans } from "../v1-membership.ts";
+
+/**
+ * What a v1 Team subscription on a flat price (USD 49 or 150 a month, with executions metered
+ * on top) becomes. `keep` keeps its price on v2's Team plan, with unlimited members; `per_member`
+ * moves it to v2's own price of USD 15 per member. Executions are never billed on v2, so their
+ * metering ends either way. This is the one place the choice is made.
+ */
+export const flatTeamPricing: "keep" | "per_member" = "keep";
+
+/** v1's Team plan in the Autumn account v1 and v2 share; each version is a pricing of it. */
+export const v1TeamPlan = "team";
+
+/**
+ * How a v1 Team version charges: per member of `feature`, whose usage v1 sets to its seat count,
+ * or a flat monthly price.
+ */
+export const V1TeamPricing = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("per_member"), feature: Schema.String }),
+  Schema.Struct({
+    kind: Schema.Literal("flat"),
+    amount: Schema.Number,
+    interval: Schema.String,
+  }),
+]);
+export type V1TeamPricing = typeof V1TeamPricing.Type;
+
+/**
+ * The v1 subscription a carry-over keeps, as the assessment read it. Times are milliseconds
+ * since the epoch. `trialEndsAt` is set only while the trial runs, and `expiresAt` only when the
+ * subscription is cancelled at the end of its period. `seats` is the per-member usage v1 had
+ * set, which giving the billing back restores.
+ */
+export const V1Subscription = Schema.Struct({
+  planId: Schema.String,
+  version: Schema.Number,
+  pricing: V1TeamPricing,
+  seats: Schema.NullOr(Schema.Number),
+  periodEnd: Schema.Number,
+  trialEndsAt: Schema.NullOr(Schema.Number),
+  expiresAt: Schema.NullOr(Schema.Number),
+});
+export type V1Subscription = typeof V1Subscription.Type;
+
+/** The v2 pricing a v1 subscription moves to, under `flatTeamPricing`. */
+export const v2Pricing = (subscription: V1Subscription): "per_member" | "flat" =>
+  subscription.pricing.kind === "flat" && flatTeamPricing === "keep" ? "flat" : "per_member";
+
+/** What the carry-over needs of v2's billing. */
+export interface V1ImportBilling {
+  readonly autumn: AutumnClient["Service"];
+  readonly catalog: BillingCatalog;
+  /** v1's Team plan in the same Autumn account. */
+  readonly v1TeamPlan: string;
+  /** v2's own seat sync, which runs once the organization's billing is carried over. */
+  readonly syncSeats: (organization: OrganizationId) => Effect.Effect<void, BillingUnavailable>;
+}
+
+type CustomerPlans = NonNullable<(typeof AutumnResponses.getCustomerPlans)["Type"]>;
+type Verified = (typeof AutumnResponses.verifyBilling)["Type"];
+type Preview = (typeof AutumnResponses.previewAttach)["Type"];
+
+/** Why the organization's billing cannot carry over, or did not. Another attempt would not help. */
+export class CarryOverRefused extends Schema.TaggedError<CarryOverRefused>()("CarryOverRefused", {
+  reason: Schema.String,
+}) {}
+
+const refuse = (reason: string) => Effect.fail(new CarryOverRefused({ reason }));
+
+/**
+ * Autumn's answer to a request it refused is final; no answer, a server error or a rate limit
+ * retries the step, which reads back first.
+ */
+const call = <A>(effect: Effect.Effect<A, AutumnRequestFailed>) =>
+  effect.pipe(
+    Effect.mapError((error) =>
+      error.reason === "status" &&
+      error.status !== undefined &&
+      error.status >= 400 &&
+      error.status < 500 &&
+      error.status !== 429
+        ? new CarryOverRefused({
+            reason: `Autumn refused ${error.operation} (${error.status}).`,
+          })
+        : new V1ImportUnavailable(),
+    ),
+  );
+
+const plansOf = (billing: V1ImportBilling, customerId: string) =>
+  call(billing.autumn.getCustomerPlans({ customerId, expand: ["subscriptions.plan"] }));
+
+/**
+ * A plan that bills now. Autumn reports a running trial as `active` with its end; v2's billing
+ * accepts `trialing` as well (`billing.ts`), and so does this.
+ */
+const isLive = (subscription: { readonly status: string }) =>
+  subscription.status === "active" || subscription.status === "trialing";
+
+const live = (customer: CustomerPlans) => customer.subscriptions.filter(isLive);
+
+/**
+ * Whether a v2 organization's own customer pays for a plan: anything live but v2's Free plan. A
+ * copy the opt-in import made has a customer of its own, on Free unless its users bought Team.
+ */
+export const paysInV2 = (catalog: BillingCatalog, customer: CustomerPlans | null) =>
+  customer !== null && live(customer).some((plan) => plan.planId !== catalog.free);
+
+/**
+ * Decide whether v1's subscription can carry over: exactly one live plan, v1's Team plan, on a
+ * pricing this module maps, and nothing pending but the free plan v1 schedules after a
+ * cancellation. `now` decides whether a trial still runs.
+ */
+export const decideCarryOver = (
+  customer: CustomerPlans | null,
+  v1TeamPlan: string,
+  now: number,
+):
+  | { readonly ok: true; readonly subscription: V1Subscription }
+  | { readonly ok: false; readonly reason: string } => {
+  if (customer === null) return { ok: false, reason: "Autumn has no customer for it." };
+  const plans = live(customer);
+  const [current] = plans;
+  if (current === undefined || plans.length !== 1)
+    return { ok: false, reason: `Autumn bills it on ${plans.length} plans; one carries over.` };
+  if (current.planId !== v1TeamPlan)
+    return {
+      ok: false,
+      reason: `Only v1 Team subscriptions carry over; its ${current.planId} plan waits for a decision.`,
+    };
+  const expiresAt = current.canceledAt === null ? null : current.expiresAt;
+  if (current.canceledAt !== null && expiresAt === null)
+    return { ok: false, reason: "Its subscription is cancelled with no end." };
+  const pending = customer.subscriptions.filter(
+    (subscription) =>
+      !isLive(subscription) && !(expiresAt !== null && freePlans.includes(subscription.planId)),
+  );
+  if (pending.length > 0) return { ok: false, reason: "Autumn has a plan change pending for it." };
+  if (current.currentPeriodEnd === null)
+    return { ok: false, reason: "Its subscription has no billing period." };
+  if (current.plan === undefined)
+    return { ok: false, reason: "Autumn did not say which Team version it bills." };
+  const plan = current.plan;
+  const priced = plan.items.flatMap((item) =>
+    item.price === null ? [] : [{ feature: item.featureId, ...item.price }],
+  );
+  const [seat] = priced;
+  const pricing: V1TeamPricing | undefined =
+    plan.price === null
+      ? seat !== undefined &&
+        priced.length === 1 &&
+        seat.billingMethod === "usage_based" &&
+        seat.amount === teamMemberPrice &&
+        seat.interval === "month" &&
+        (seat.billingUnits ?? 1) === 1
+        ? { kind: "per_member", feature: seat.feature }
+        : undefined
+      : // A flat version meters executions on top, which v2 never bills.
+        priced.every((price) => price.billingMethod === "usage_based")
+        ? { kind: "flat", amount: plan.price.amount, interval: plan.price.interval }
+        : undefined;
+  if (pricing === undefined)
+    return {
+      ok: false,
+      reason: `Its Team version ${plan.version} prices in a way that does not map.`,
+    };
+  return {
+    ok: true,
+    subscription: {
+      planId: current.planId,
+      version: plan.version,
+      pricing,
+      seats:
+        pricing.kind === "per_member" ? (customer.balances[pricing.feature]?.usage ?? 0) : null,
+      periodEnd: current.currentPeriodEnd,
+      trialEndsAt:
+        current.trialEndsAt !== null && current.trialEndsAt > now ? current.trialEndsAt : null,
+      expiresAt,
+    },
+  };
+};
+
+/**
+ * Whether two times are the same to the second. Stripe keeps a subscription's dates in seconds,
+ * while Autumn can record the moment it saw them to the millisecond: a trial v1 started reads
+ * `…502964`, and the same trial on the same Stripe subscription reads `…502000` once v2's plan
+ * holds it.
+ */
+const sameSecond = (a: number | null, b: number | null) =>
+  a === null || b === null ? a === b : Math.floor(a / 1000) === Math.floor(b / 1000);
+
+const sameSubscription = (a: V1Subscription, b: V1Subscription) =>
+  a.planId === b.planId &&
+  a.version === b.version &&
+  JSON.stringify(a.pricing) === JSON.stringify(b.pricing) &&
+  sameSecond(a.periodEnd, b.periodEnd) &&
+  sameSecond(a.trialEndsAt, b.trialEndsAt) &&
+  sameSecond(a.expiresAt, b.expiresAt);
+
+/**
+ * Attaching v2's Team plan in place of v1's: on the same Stripe subscription, with no charge and
+ * no checkout. A running trial keeps its end, so its trial is left as it is (Autumn refuses to
+ * remove a running trial without proration); otherwise v2 Team's own trial is removed.
+ */
+export const carriedAttach = (
+  billing: V1ImportBilling,
+  subscription: V1Subscription,
+  customerId: string,
+) => {
+  const pricing = subscription.pricing;
+  const trial = subscription.trialEndsAt === null ? { freeTrial: null } : {};
+  const customize =
+    pricing.kind === "flat" && v2Pricing(subscription) === "flat"
+      ? {
+          price: { amount: pricing.amount, interval: pricing.interval },
+          items: [
+            { featureId: billing.catalog.members, unlimited: true },
+            { featureId: billing.catalog.domainVerification },
+          ],
+          ...trial,
+        }
+      : subscription.trialEndsAt === null
+        ? trial
+        : undefined;
+  return {
+    customerId,
+    planId: billing.catalog.team,
+    removePlanIds: [subscription.planId],
+    prorationBehavior: "none" as const,
+    redirectMode: "never" as const,
+    ...(customize === undefined ? {} : { customize }),
+  };
+};
+
+/** Attaching v1's own Team version back in place of v2's Team plan, the same way. */
+const returnedAttach = (
+  billing: V1ImportBilling,
+  subscription: V1Subscription,
+  customerId: string,
+) => ({
+  customerId,
+  planId: subscription.planId,
+  version: subscription.version,
+  removePlanIds: [billing.catalog.team],
+  prorationBehavior: "none" as const,
+  redirectMode: "never" as const,
+  ...(subscription.trialEndsAt === null ? { customize: { freeTrial: null } } : {}),
+});
+
+/**
+ * What would make an attach unsafe: any charge now, a checkout, another plan changing, or a
+ * renewal date other than the subscription's.
+ */
+export const previewProblem = (
+  preview: Preview,
+  change: { readonly add: string; readonly remove: string; readonly renews: number },
+) => {
+  const ids = (plans: Preview["incoming"]) => plans.map((plan) => plan.planId).join(",");
+  if (preview.total !== 0) return `Autumn would charge ${preview.total} now.`;
+  if (preview.redirectToCheckout) return "Autumn would send the customer to a checkout.";
+  if (ids(preview.incoming) !== change.add || ids(preview.outgoing) !== change.remove)
+    return "Autumn would change other plans.";
+  if (!sameSecond(preview.nextCycle?.startsAt ?? null, change.renews))
+    return "Autumn would move the renewal date.";
+  return undefined;
+};
+
+/** Exactly one Stripe subscription, `expected` when given, billing what Autumn's plans say. */
+export const stripeProblem = (verified: Verified, expected: string | null) => {
+  const [only] = verified.subscriptions;
+  if (only === undefined || verified.subscriptions.length !== 1)
+    return `Stripe has ${verified.subscriptions.length} subscriptions for it; one was expected.`;
+  if (expected !== null && only.stripeSubscriptionId !== expected)
+    return "Its Stripe subscription is not the one v1 billed it on.";
+  // A mismatch Autumn does not mark as a warning means Stripe bills differently from the plan.
+  if (
+    [...only.mismatches, ...verified.customerMismatches].some(
+      (mismatch) => mismatch.severity !== "warning",
+    )
+  )
+    return "Stripe bills it differently from its plan in Autumn.";
+  return undefined;
+};
+
+/**
+ * Where a carried-over customer must end: v2's Team plan alone, renewing, ending a trial and
+ * cancelled as v1's subscription was, on v1's Stripe subscription.
+ */
+export const carriedProblem = (
+  billing: V1ImportBilling,
+  customer: CustomerPlans,
+  verified: Verified,
+  subscription: V1Subscription,
+  stripeSubscription: string,
+) => {
+  const plans = live(customer);
+  const [team] = plans;
+  if (team === undefined || plans.length !== 1 || team.planId !== billing.catalog.team)
+    return "Autumn does not bill it on v2's Team plan alone.";
+  if (!sameSecond(team.currentPeriodEnd, subscription.periodEnd)) return "Its renewal date moved.";
+  if (subscription.trialEndsAt !== null && !sameSecond(team.trialEndsAt, subscription.trialEndsAt))
+    return "Its trial end moved.";
+  if (
+    (subscription.expiresAt === null) !== (team.canceledAt === null) ||
+    (subscription.expiresAt !== null && !sameSecond(team.expiresAt, subscription.expiresAt))
+  )
+    return "Its cancellation did not carry over.";
+  return stripeProblem(verified, stripeSubscription);
+};
+
+// ---------------------------------------------------------------------------------------------
+// The billing hold (`private_v1_import_billing`).
+
+export type V1BillingState = "held" | "carried" | "returned";
+
+const HoldRow = Schema.Struct({
+  state: Schema.Literals(["held", "carried", "returned"]),
+  v1_org_id: Schema.String,
+  subscription: Schema.fromJsonString(V1Subscription),
+  stripe_subscription_id: Schema.NullOr(Schema.String),
+});
+
+/** The organization's carry-over record, if the import made one. */
+export const billingHoldRow = (sql: SqlClient.SqlClient, organization: string) =>
+  sql`
+    select state, v1_org_id, subscription::text as subscription, stripe_subscription_id
+    from private_v1_import_billing where organization_id = ${organization}
+  `.pipe(
+    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(HoldRow))),
+    Effect.map((rows) => rows[0]),
+    Effect.mapError(() => new V1ImportUnavailable()),
+  );
+
+const States = Schema.Array(Schema.Struct({ state: Schema.String }));
+
+/**
+ * Whether v2's billing must leave the organization alone: `held` while v1's subscription is
+ * carried over, `returned` once v1 bills it again. Null for every other organization.
+ */
+export const v1BillingHold = (organization: string) =>
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const rows = yield* sql`
+      select state from private_v1_import_billing where organization_id = ${organization}
+    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(States)));
+    const state = rows[0]?.state;
+    return state === "held" || state === "returned" ? state : null;
+  });
+
+const setState = (sql: SqlClient.SqlClient, organization: string, state: V1BillingState) =>
+  sql`
+    update private_v1_import_billing set state = ${state}, updated_at = now()
+    where organization_id = ${organization}
+  `.pipe(
+    Effect.asVoid,
+    Effect.mapError(() => new V1ImportUnavailable()),
+  );
+
+// ---------------------------------------------------------------------------------------------
+// Carry over, and give back.
+
+interface CarryOverInput {
+  readonly billing: V1ImportBilling;
+  readonly sql: SqlClient.SqlClient;
+  readonly v1Organization: string;
+  readonly organization: OrganizationId;
+  readonly subscription: V1Subscription;
+}
+
+/**
+ * Move v1's subscription to the v2 organization, from wherever an earlier attempt left it:
+ *
+ * 1. Read v1's customer again and check it still bills what the assessment read, on exactly one
+ *    Stripe subscription, which is recorded. Preview the attach on it; any problem stops here,
+ *    with nothing written.
+ * 2. Rename v1's customer to the v2 organization's customer id.
+ * 3. Preview again and attach v2's Team plan (`carriedAttach`), requiring no charge.
+ * 4. Cancel it at the end of its period when v1's was, since the attach does not keep that.
+ * 5. Read back (`carriedProblem`) and record the organization `carried`, which ends the hold.
+ */
+export const carryOver = (input: CarryOverInput) =>
+  Effect.gen(function* () {
+    const { billing, sql, organization, subscription } = input;
+    const hold = yield* billingHoldRow(sql, organization);
+    if (hold === undefined)
+      return yield* refuse("Its v2 organization was created without a billing hold.");
+    if (hold.state === "carried") return;
+    if (hold.state === "returned") return yield* refuse("Its billing was given back to v1.");
+    const target = billingCustomerId(billing.catalog, organization);
+    const change = {
+      add: billing.catalog.team,
+      remove: subscription.planId,
+      renews: subscription.periodEnd,
+    };
+    let stripeSubscription = hold.stripe_subscription_id;
+    let carried = yield* plansOf(billing, target);
+    // A copy the opt-in import made before this has a customer of its own, on v2's Free plan. It
+    // bills nothing, so it goes and v1's customer takes its id. One that pays is never replaced.
+    if (carried !== null && stripeSubscription === null) {
+      const billsNothing =
+        !paysInV2(billing.catalog, carried) &&
+        carried.subscriptions.every((plan) => plan.planId === billing.catalog.free) &&
+        (yield* call(billing.autumn.verifyBilling({ customerId: target }))).subscriptions.length ===
+          0;
+      if (!billsNothing)
+        return yield* refuse("Its v2 organization already pays for its own subscription.");
+      yield* call(billing.autumn.deleteCustomer({ customerId: target }));
+      carried = null;
+    }
+    if (carried === null) {
+      const decided = decideCarryOver(
+        yield* plansOf(billing, input.v1Organization),
+        billing.v1TeamPlan,
+        yield* Clock.currentTimeMillis,
+      );
+      if (!decided.ok) return yield* refuse(decided.reason);
+      if (!sameSubscription(decided.subscription, subscription))
+        return yield* refuse("Its v1 subscription changed after the import assessed it.");
+      const verified = yield* call(
+        billing.autumn.verifyBilling({ customerId: input.v1Organization }),
+      );
+      const stripe = stripeProblem(verified, stripeSubscription);
+      if (stripe !== undefined) return yield* refuse(stripe);
+      stripeSubscription = verified.subscriptions[0]?.stripeSubscriptionId ?? null;
+      yield* sql`
+        update private_v1_import_billing
+        set stripe_subscription_id = ${stripeSubscription}, updated_at = now()
+        where organization_id = ${organization}
+      `.pipe(Effect.mapError(() => new V1ImportUnavailable()));
+      const before = previewProblem(
+        yield* call(
+          billing.autumn.previewAttach(carriedAttach(billing, subscription, input.v1Organization)),
+        ),
+        change,
+      );
+      if (before !== undefined) return yield* refuse(before);
+      yield* call(
+        billing.autumn.renameCustomer({ customerId: input.v1Organization, newCustomerId: target }),
+      );
+      carried = yield* plansOf(billing, target);
+      if (carried === null) return yield* new V1ImportUnavailable();
+    }
+    if (stripeSubscription === null)
+      return yield* refuse("No Stripe subscription was recorded for it before the change.");
+    if (live(carried).some((plan) => plan.planId === subscription.planId)) {
+      const attach = carriedAttach(billing, subscription, target);
+      const problem = previewProblem(yield* call(billing.autumn.previewAttach(attach)), change);
+      if (problem !== undefined) return yield* refuse(problem);
+      const attached = yield* call(billing.autumn.attach(attach));
+      if (attached.paymentUrl !== null || (attached.invoice?.total ?? 0) !== 0)
+        return yield* refuse("Autumn charged it or asked for a payment when the plan changed.");
+      carried = yield* plansOf(billing, target);
+      if (carried === null) return yield* new V1ImportUnavailable();
+    }
+    const team = live(carried).find((plan) => plan.planId === billing.catalog.team);
+    if (subscription.expiresAt !== null && team !== undefined && team.canceledAt === null) {
+      yield* call(
+        billing.autumn.updateSubscription({
+          customerId: target,
+          planId: billing.catalog.team,
+          cancelAction: "cancel_end_of_cycle",
+        }),
+      );
+      carried = yield* plansOf(billing, target);
+      if (carried === null) return yield* new V1ImportUnavailable();
+    }
+    const problem = carriedProblem(
+      billing,
+      carried,
+      yield* call(billing.autumn.verifyBilling({ customerId: target })),
+      subscription,
+      stripeSubscription,
+    );
+    if (problem !== undefined) return yield* refuse(problem);
+    yield* setState(sql, organization, "carried");
+  });
+
+/**
+ * Give the organization's billing back to v1, from wherever the carry-over got: attach v1's Team
+ * version back in place of v2's (`returnedAttach`, requiring no charge), cancel it at the end of
+ * its period when v1's was, and rename the customer back to v1's id. A customer v1 made under that
+ * id meanwhile, which it does when it meters an execution for a customer it cannot find, is
+ * deleted first when it bills nothing: free plans only and no Stripe subscription. Records the
+ * organization `returned`, after which v2's billing leaves it alone, so deleting the v2
+ * organization cancels nothing.
+ */
+export const returnBilling = (input: {
+  readonly billing: V1ImportBilling;
+  readonly sql: SqlClient.SqlClient;
+  readonly organization: OrganizationId;
+}) =>
+  Effect.gen(function* () {
+    const { billing, sql, organization } = input;
+    const hold = yield* billingHoldRow(sql, organization);
+    if (hold === undefined)
+      return yield* refuse("The import recorded no billing carry-over for this organization.");
+    if (hold.state === "returned") return;
+    const subscription = hold.subscription;
+    const v1Organization = hold.v1_org_id;
+    const target = billingCustomerId(billing.catalog, organization);
+    let moved = yield* plansOf(billing, target);
+    if (moved !== null) {
+      const team = live(moved).find((plan) => plan.planId === billing.catalog.team);
+      if (team !== undefined) {
+        if (team.currentPeriodEnd === null)
+          return yield* refuse("Its v2 plan has no billing period.");
+        const attach = returnedAttach(billing, subscription, target);
+        const problem = previewProblem(yield* call(billing.autumn.previewAttach(attach)), {
+          add: subscription.planId,
+          remove: billing.catalog.team,
+          renews: team.currentPeriodEnd,
+        });
+        if (problem !== undefined) return yield* refuse(problem);
+        const attached = yield* call(billing.autumn.attach(attach));
+        if (attached.paymentUrl !== null || (attached.invoice?.total ?? 0) !== 0)
+          return yield* refuse("Autumn charged it or asked for a payment when the plan changed.");
+        moved = yield* plansOf(billing, target);
+        if (moved === null) return yield* new V1ImportUnavailable();
+      }
+      const v1Plan = live(moved).find((plan) => plan.planId === subscription.planId);
+      if (v1Plan === undefined || live(moved).length !== 1)
+        return yield* refuse("Autumn does not bill it on v1's Team plan alone.");
+      if (subscription.expiresAt !== null && v1Plan.canceledAt === null)
+        yield* call(
+          billing.autumn.updateSubscription({
+            customerId: target,
+            planId: subscription.planId,
+            cancelAction: "cancel_end_of_cycle",
+          }),
+        );
+      const occupant = yield* plansOf(billing, v1Organization);
+      if (occupant !== null) {
+        const billsNothing =
+          occupant.subscriptions.every((plan) => freePlans.includes(plan.planId)) &&
+          (yield* call(billing.autumn.verifyBilling({ customerId: v1Organization }))).subscriptions
+            .length === 0;
+        if (!billsNothing)
+          return yield* refuse(
+            "Autumn has another paying customer under the v1 organization's id.",
+          );
+        yield* call(billing.autumn.deleteCustomer({ customerId: v1Organization }));
+      }
+      yield* call(
+        billing.autumn.renameCustomer({ customerId: target, newCustomerId: v1Organization }),
+      );
+    }
+    // v1's plan starts again with no seats; v1 bills the seats it had set.
+    if (subscription.pricing.kind === "per_member" && subscription.seats !== null)
+      yield* call(
+        billing.autumn.updateBalance({
+          customerId: v1Organization,
+          featureId: subscription.pricing.feature,
+          usage: subscription.seats,
+        }),
+      );
+    const back = yield* plansOf(billing, v1Organization);
+    if (back === null || !live(back).some((plan) => plan.planId === subscription.planId))
+      return yield* refuse("v1's customer does not bill it on v1's Team plan.");
+    const stripe = stripeProblem(
+      yield* call(billing.autumn.verifyBilling({ customerId: v1Organization })),
+      hold.stripe_subscription_id,
+    );
+    if (stripe !== undefined) return yield* refuse(stripe);
+    yield* setState(sql, organization, "returned");
+  });
diff --git a/apps/hosted/cloud/src/implementation/v1-import/copied-accounts.ts b/apps/hosted/cloud/src/implementation/v1-import/copied-accounts.ts
new file mode 100644
index 0000000000..29b9cb8a98
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-import/copied-accounts.ts
@@ -0,0 +1,59 @@
+/**
+ * The one-off repair of the accounts of organizations the opt-in import copied before they moved
+ * (`notes/v1-import.md`, "Repair of moved organizations"). Their move deployed apps before it took
+ * v1's final tokens, so a deployment could renew a copied account with the copy's own refresh
+ * token first, and it kept copied accounts whose provider the regenerated app changed. Each
+ * account an earlier run saved now takes v1's final tokens as a move takes them, and follows its
+ * app's provider (`updateCopiedAccount`). v1's tokens are final once it no longer serves the
+ * organization, so only an organization that cut over is repaired.
+ */
+import { AccountId } from "@executor-js/sdk/core";
+import { Effect, Schema } from "effect";
+import { V1ImportDatabase, V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import { updateCopiedAccount } from "./items.ts";
+import { movedOrganizationContext } from "./repair.ts";
+
+const State = Schema.Array(Schema.Struct({ state: Schema.String }));
+
+/** What the repair did with one copied account. */
+export interface CopiedAccountRepair {
+  readonly connection: string;
+  readonly account: string;
+  /** `replaced` when it took v1's tokens. */
+  readonly tokens: "kept" | "replaced";
+  /** Whether it moved to its app's provider. */
+  readonly followed: boolean;
+}
+
+export interface CopiedAccountsRepair {
+  readonly organization: string;
+  readonly status: "repaired" | "not_cut_over" | "not_imported";
+  readonly accounts: readonly CopiedAccountRepair[];
+}
+
+/** Repair the copied accounts of one organization that cut over (see the module comment). */
+export const repairCopiedAccounts = (organization: string) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const [recorded] = yield* sql`
+      select state from private_v1_import_org where v1_org_id = ${organization}
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(State)),
+      Effect.mapError(() => new V1ImportUnavailable()),
+    );
+    if (recorded?.state !== "cutover")
+      return { organization, status: "not_cut_over", accounts: [] } satisfies CopiedAccountsRepair;
+    const moved = yield* movedOrganizationContext(organization);
+    if (moved?.context === undefined)
+      return { organization, status: "not_imported", accounts: [] } satisfies CopiedAccountsRepair;
+    const { context } = moved;
+    const accounts: CopiedAccountRepair[] = [];
+    for (const row of context.snapshot.connections) {
+      const saved = yield* context.store.find("connection", row.row_id);
+      if (saved?.status !== "imported" || saved.v2_id === null) continue;
+      if ((yield* context.store.sinceImported("connection", row.row_id)) === "removed") continue;
+      const updated = yield* updateCopiedAccount(context, row, AccountId.make(saved.v2_id));
+      accounts.push({ connection: row.row_id, account: saved.v2_id, ...updated });
+    }
+    return { organization, status: "repaired", accounts } satisfies CopiedAccountsRepair;
+  });
diff --git a/apps/hosted/cloud/src/implementation/v1-import/formats.ts b/apps/hosted/cloud/src/implementation/v1-import/formats.ts
index 9c86754c0f..9b754e2096 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/formats.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/formats.ts
@@ -239,6 +239,11 @@ export const ToolRow = Schema.Struct({
   name: Schema.String,
   /** The MCP server's own tool name, for MCP tools. */
   upstream: Schema.NullOr(Schema.String),
+  /**
+   * Whether v1 asks before the tool when no policy decides it: the `requiresApproval` its plugin
+   * stamped on the row when it last listed the tools, such as an MCP server's `destructiveHint`.
+   */
+  requires_approval: Schema.Boolean,
   /** When v1 last listed its connection's tools (`tools_synced_at`); null when it is marked stale. */
   listed_at: Schema.NullOr(Millis),
 });
diff --git a/apps/hosted/cloud/src/implementation/v1-import/identity.ts b/apps/hosted/cloud/src/implementation/v1-import/identity.ts
index 4182d89779..1996229806 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/identity.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/identity.ts
@@ -8,6 +8,7 @@ import { organizationHandle, organizationSlugMaxLength } from "@executor-js/host
 import { Effect, Redacted, Schema } from "effect";
 import type { SqlClient } from "effect/sql";
 import { V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import type { V1IntoMode } from "../../contracts/v1-import-run.ts";
 import { ItemFailed } from "./items.ts";
 import type { PlannedMember } from "./members.ts";
 import { sourceHash, type ImportStore } from "./store.ts";
@@ -47,8 +48,13 @@ export const matchUser = (sql: SqlClient.SqlClient, email: string) =>
     unavailable,
   );
 
-/** A suffix derived from the v1 organization's id with the deployment's key, as hex. */
-const slugSuffix = (key: Redacted.Redacted<string>, organization: string, attempt: number) =>
+/** A suffix derived from `label`, an id and an attempt with the deployment's key, as hex. */
+const slugSuffix = (
+  key: Redacted.Redacted<string>,
+  label: "v1-import-slug" | "v2-rename-slug",
+  id: string,
+  attempt: number,
+) =>
   Effect.promise(async () => {
     const hmac = await crypto.subtle.importKey(
       "raw",
@@ -60,7 +66,7 @@ const slugSuffix = (key: Redacted.Redacted<string>, organization: string, attemp
     const signed = await crypto.subtle.sign(
       "HMAC",
       hmac,
-      new TextEncoder().encode(JSON.stringify(["v1-import-slug", organization, attempt])),
+      new TextEncoder().encode(JSON.stringify([label, id, attempt])),
     );
     return Array.from(new Uint8Array(signed), (byte) => byte.toString(16).padStart(2, "0")).join(
       "",
@@ -95,10 +101,83 @@ export const slugCandidates = (
     const candidates = reserved ? [] : [slugBase(slug)];
     const base = suffixBase(slug);
     for (let attempt = 1; attempt < 5; attempt++)
-      candidates.push(`${base}-${(yield* slugSuffix(key, organization, attempt)).slice(0, 6)}`);
+      candidates.push(
+        `${base}-${(yield* slugSuffix(key, "v1-import-slug", organization, attempt)).slice(0, 6)}`,
+      );
     return candidates;
   });
 
+/**
+ * A v2 organization the operator listed to give up the slug a v1 organization moves to
+ * (`notes/v1-import.md`, "Slug displacement"): the holder is renamed to `to`, and the v1
+ * organization takes `from`, in one transaction.
+ */
+export interface Displacement {
+  readonly kind: "rename";
+  readonly holder: string;
+  readonly from: string;
+  readonly to: string;
+}
+
+/** A listed displacement that does not apply, and why; the organization takes its candidates. */
+export interface DisplacementRefused {
+  readonly kind: "refused";
+  readonly holder: string;
+  readonly refused: string;
+}
+
+/**
+ * The listed holder's rename: when it holds `slug`, the first of its suffixed slugs, derived from
+ * its id with the deployment's key, that no v2 organization has and no live v1 organization has
+ * exactly (`liveInV1`), so a later move does not meet it again.
+ */
+export const plannedDisplacement = <E>(
+  sql: SqlClient.SqlClient,
+  key: Redacted.Redacted<string>,
+  liveInV1: (slug: string) => Effect.Effect<boolean, E>,
+  holder: string,
+  slug: string,
+): Effect.Effect<Displacement | DisplacementRefused, E | V1ImportUnavailable> =>
+  Effect.gen(function* () {
+    const held = yield* sql`select id from organization where slug = ${slug}`.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      unavailable,
+    );
+    if (held[0]?.id !== holder)
+      return {
+        kind: "refused",
+        holder,
+        refused: `The listed v2 organization does not hold ${slug}${held[0] === undefined ? ", which is free" : ""}.`,
+      } satisfies DisplacementRefused;
+    // v1 forwards a moved organization to its v2 slug, so another import keeps its own.
+    const imported = yield* sql`
+      select v2_id as id from private_v1_import_map
+      where v1_kind = 'organization' and status = 'imported' and v2_id = ${holder}
+    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Ids)), unavailable);
+    if (imported.length > 0)
+      return {
+        kind: "refused",
+        holder,
+        refused:
+          "The listed v2 organization is another v1 organization's import, which v1 forwards to by its slug.",
+      } satisfies DisplacementRefused;
+    const base = suffixBase(slug);
+    for (let attempt = 1; attempt < 5; attempt++) {
+      const to = `${base}-${(yield* slugSuffix(key, "v2-rename-slug", holder, attempt)).slice(0, 6)}`;
+      const taken = yield* sql`select slug from organization where slug = ${to}`.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Slugs)),
+        unavailable,
+      );
+      if (taken.length === 0 && !(yield* liveInV1(to)))
+        return { kind: "rename", holder, from: slug, to } satisfies Displacement;
+    }
+    return {
+      kind: "refused",
+      holder,
+      refused: "Every new slug for the listed v2 organization is taken.",
+    } satisfies DisplacementRefused;
+  });
+
 /** The v2 slug a v1 slug becomes: the first candidate no v2 organization has. */
 export const plannedSlug = (
   sql: SqlClient.SqlClient,
@@ -238,10 +317,209 @@ export const importMembership = (
       .pipe(unavailable);
   });
 
+/**
+ * The v2 kind of the map row of a v1 organization moved into an existing v2 organization its owner
+ * owns (`notes/v1-import.md`, decision 32). The import did not create it, so a rollback keeps it and
+ * removes only what the import added to it.
+ */
+export const existingOrganization = "existing_organization";
+
+/** The note on an organization's map row when it moved into an existing v2 organization. */
+const intoNotes: Record<V1IntoMode, string> = {
+  nothing_to_copy: "Moved into an existing v2 organization its member owns, with nothing to copy.",
+  leave_v1_data:
+    "Moved into an existing v2 organization its member owns, leaving its v1 data in v1.",
+  copy_into_empty: "Imported into an existing v2 organization its owner owns, which was empty.",
+};
+
+/** The existing v2 organization a v1 organization moves into, and the v2 user its owner is. */
+export interface Into {
+  readonly kind: "into";
+  readonly target: { readonly id: string; readonly name: string; readonly slug: string };
+  readonly user: string;
+}
+
+/** A listed existing organization the v1 organization does not move into, and why. */
+export interface IntoRefused {
+  readonly kind: "refused";
+  readonly refused: string;
+}
+
+const notOwner = "Its owner is not an owner of the listed v2 organization.";
+
+/**
+ * Whether the v1 organization's owner owns `target`, the existing v2 organization the operator
+ * listed: their v2 user is the one an earlier run recorded, or else a v2 user who verified the same
+ * email, never a new one. An earlier run that recorded the organization elsewhere refuses it too.
+ */
+export const intoOwner = (
+  sql: SqlClient.SqlClient,
+  store: ImportStore,
+  input: {
+    readonly organization: string;
+    readonly target: string;
+    /** The owner's WorkOS user id. */
+    readonly member: string;
+    readonly email: string;
+  },
+): Effect.Effect<Into | IntoRefused, V1ImportUnavailable> =>
+  Effect.gen(function* () {
+    const refused = (reason: string) => ({ kind: "refused", refused: reason }) as const;
+    const recorded = yield* store.find("organization", input.organization);
+    if (recorded?.status === "imported" && recorded.v2_id !== input.target)
+      return refused("An earlier run recorded it against another v2 organization.");
+    const mapped = yield* store.find("user", input.member);
+    let user: string;
+    if (mapped?.status === "imported" && mapped.v2_id !== null) user = mapped.v2_id;
+    else {
+      const match = yield* matchUser(sql, input.email);
+      if (match.kind !== "merge")
+        return refused(
+          match.kind === "create"
+            ? "Its owner has no v2 account."
+            : "A v2 account has its owner's email but has not verified it.",
+        );
+      user = match.user;
+    }
+    const target = yield* store.target(input.target);
+    if (target === undefined) return refused("The listed v2 organization does not exist.");
+    const owners = yield* sql`
+      select id from member
+      where "organizationId" = ${target.id} and "userId" = ${user} and role = 'owner'
+    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Ids)), unavailable);
+    if (owners.length === 0) return refused(notOwner);
+    return { kind: "into", target, user } satisfies Into;
+  });
+
+const Contents = Schema.Array(
+  Schema.Struct({
+    apps: Schema.Number,
+    accounts: Schema.Number,
+    connections: Schema.Number,
+    schedules: Schema.Number,
+  }),
+);
+
+/**
+ * What is set up in a v2 organization, or undefined when nothing is: apps besides the Executor app
+ * every organization gets, accounts besides its members' own Executor keys (both recorded in the
+ * organization's metadata when it is set up), live MCP connections and schedules.
+ */
+export const setUpIn = (sql: SqlClient.SqlClient, organization: string) =>
+  sql`
+    select
+      (select count(*)::int from executor_apps a where a.owner = 'organization:' || o.id
+        and a.id is distinct from o.metadata::jsonb -> 'executorDefaults' ->> 'app') as apps,
+      (select count(*)::int from executor_accounts a where a.owner = 'organization:' || o.id
+        and not exists (
+          select 1 from jsonb_each_text(coalesce(o.metadata::jsonb -> 'executorKeyAccounts', '{}'::jsonb)) k
+          where k.value = a.id
+        )) as accounts,
+      (select count(*)::int from "mcpConnection" c where c.resource = o.id and not c.revoked) as connections,
+      (select count(*)::int from executor_schedules s where s.owner = 'organization:' || o.id) as schedules
+    from organization o where o.id = ${organization}
+  `.pipe(
+    Effect.flatMap(Schema.decodeUnknownEffect(Contents)),
+    Effect.map(([found]) => {
+      if (found === undefined) return undefined;
+      const set = Object.entries(found).flatMap(([kind, count]) =>
+        count === 0 ? [] : [`${kind}: ${count}`],
+      );
+      return set.length === 0 ? undefined : set.join(", ");
+    }),
+    unavailable,
+  );
+
+/**
+ * Move the v1 organization into the existing v2 organization its owner owns (decision 32): record
+ * the owner's v2 user and the organization's map row against it, in one transaction that holds the
+ * owner's membership, so an owner who stopped owning it meanwhile records nothing. A first copy into
+ * it requires it to have nothing set up yet (`setUpIn`), checked in the same transaction; with
+ * `billingHold`, the transaction also holds its billing while the paid v1 subscription carries over,
+ * as the statement that creates an organization does. Nothing else in the organization changes: not
+ * its name, slug or members.
+ */
+export const importInto = (
+  sql: SqlClient.SqlClient,
+  store: ImportStore,
+  input: {
+    readonly organization: string;
+    readonly target: string;
+    readonly mode: V1IntoMode;
+    readonly member: PlannedMember;
+    readonly email: string;
+    /** The paid v1 subscription its billing carries over from, as JSON, if any. */
+    readonly billingHold: string | null;
+  },
+) =>
+  Effect.gen(function* () {
+    const decided = yield* intoOwner(sql, store, {
+      organization: input.organization,
+      target: input.target,
+      member: input.member.user,
+      email: input.email,
+    });
+    if (decided.kind === "refused") return yield* new ItemFailed({ reason: decided.refused });
+    const userRecorded = (yield* store.find("user", input.member.user))?.status === "imported";
+    const recorded = (yield* store.find("organization", input.organization))?.status === "imported";
+    const userHash = yield* sourceHash(input.email);
+    const hash = yield* sourceHash({ into: decided.target.id, mode: input.mode });
+    const refusal = yield* sql
+      .withTransaction(
+        Effect.gen(function* () {
+          const owner = yield* sql`
+            select id from member
+            where "organizationId" = ${decided.target.id} and "userId" = ${decided.user}
+              and role = 'owner'
+            for share
+          `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Ids)));
+          if (owner.length === 0) return notOwner;
+          if (!recorded && input.mode === "copy_into_empty") {
+            const set = yield* setUpIn(sql, decided.target.id);
+            if (set !== undefined) return `The listed v2 organization is not empty (${set}).`;
+          }
+          if (!userRecorded)
+            yield* store.record({
+              organization: input.organization,
+              kind: "user",
+              id: input.member.user,
+              result: { status: "imported", v2Kind: "merged_user", v2Id: decided.user },
+              hash: userHash,
+            });
+          if (!recorded)
+            yield* store.record({
+              organization: input.organization,
+              kind: "organization",
+              id: input.organization,
+              result: {
+                status: "imported",
+                v2Kind: existingOrganization,
+                v2Id: decided.target.id,
+                note: intoNotes[input.mode],
+              },
+              hash,
+            });
+          if (input.billingHold !== null)
+            yield* store.holdBilling(decided.target.id, {
+              v1Organization: input.organization,
+              subscription: input.billingHold,
+            });
+          return undefined;
+        }),
+      )
+      .pipe(unavailable);
+    if (refusal !== undefined) return yield* new ItemFailed({ reason: refusal });
+    return decided;
+  });
+
 /**
  * The organization the v1 organization moves into: the one an earlier run recorded, or a new one
  * owned by `owner`, named after the v1 organization, at the first of its slug candidates that is
  * free (`candidates`). The map row commits with it.
+ *
+ * With a `displacement`, the same transaction first renames the holder, only while it still holds
+ * the slug, and creates the organization at that slug; the map row's note records the rename. When
+ * the holder no longer holds it, the organization takes its candidates and `displaced` says why.
  */
 export const importOrganization = (
   sql: SqlClient.SqlClient,
@@ -253,30 +531,78 @@ export const importOrganization = (
     readonly slug: string;
     /** The slugs to try, in order (`slugCandidates`). */
     readonly candidates: readonly string[];
+    /** The paid v1 subscription its billing carries over from, as JSON, if any. */
+    readonly billingHold: string | null;
+    /** The listed holder to rename first, or why that does not apply (`plannedDisplacement`). */
+    readonly displacement?: Displacement | DisplacementRefused | undefined;
   },
 ) =>
   Effect.gen(function* () {
     const recorded = yield* store.find("organization", input.organization);
     if (recorded?.status === "imported" && recorded.v2_id !== null) {
       const target = yield* store.target(recorded.v2_id);
-      if (target !== undefined) return target;
+      if (target !== undefined) {
+        if (input.billingHold !== null)
+          yield* store.holdBilling(target.id, {
+            v1Organization: input.organization,
+            subscription: input.billingHold,
+          });
+        return { target, displaced: undefined };
+      }
       return yield* new ItemFailed({ reason: "Its imported organization was removed in v2." });
     }
-    const candidates = input.candidates;
+    const listed = input.displacement;
+    const displacement = listed?.kind === "rename" ? listed : undefined;
     const hash = yield* sourceHash({ name: input.name, slug: input.slug });
     const created = yield* sql
       .withTransaction(
         Effect.gen(function* () {
-          const target = yield* store.createOrganization(input.owner, input.name, candidates);
-          if (target === undefined) return undefined;
+          const renamed =
+            displacement !== undefined && (yield* store.renameOrganization(displacement));
+          const target = yield* store.createOrganization(
+            input.owner,
+            input.name,
+            renamed ? [displacement.from] : input.candidates,
+            input.billingHold === null
+              ? null
+              : { v1Organization: input.organization, subscription: input.billingHold },
+          );
+          if (target === undefined) {
+            // The renamed holder's slug is ours in this transaction; never keep the rename alone.
+            if (renamed) return yield* new V1ImportUnavailable();
+            return undefined;
+          }
           yield* store.record({
             organization: input.organization,
             kind: "organization",
             id: input.organization,
-            result: { status: "imported", v2Kind: "organization", v2Id: target.id },
+            result: {
+              status: "imported",
+              v2Kind: "organization",
+              v2Id: target.id,
+              ...(renamed
+                ? {
+                    note: `Renamed v2 organization ${displacement.holder} from ${displacement.from} to ${displacement.to} to take its slug.`,
+                  }
+                : {}),
+            },
             hash,
           });
-          return target;
+          return {
+            target,
+            displaced:
+              listed === undefined
+                ? undefined
+                : listed.kind === "refused"
+                  ? { organization: listed.holder, slug: null, reason: listed.refused }
+                  : renamed
+                    ? { organization: listed.holder, slug: listed.to }
+                    : {
+                        organization: listed.holder,
+                        slug: null,
+                        reason: `The listed v2 organization no longer held ${listed.from} when the organization was created.`,
+                      },
+          };
         }),
       )
       .pipe(unavailable);
diff --git a/apps/hosted/cloud/src/implementation/v1-import/items.ts b/apps/hosted/cloud/src/implementation/v1-import/items.ts
index b4d2abe46a..094665eb28 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/items.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/items.ts
@@ -43,13 +43,15 @@ import {
   SourceFiles,
   StorageHost,
   ToolName,
+  type AccountRequirement,
   type DeployedApp,
   type Executor,
+  type ImportOAuthGrant,
   type OAuthGrantNotImportable,
   type OwnerId,
   type OAuthSetupFailed,
 } from "@executor-js/sdk/core";
-import { planOperationNames } from "apps/openapi";
+import { OpenapiCompileError, openapiOperationNames } from "apps/openapi";
 import { Effect, Option, Redacted, Schema } from "effect";
 import type { SqlClient } from "effect/sql";
 import { V1StaleCategory } from "../../contracts/v1-import-run.ts";
@@ -74,7 +76,6 @@ import {
 import { openapiHealth, v1IntrospectionQuery } from "./health.ts";
 import {
   credentialOrigins,
-  documentOperations,
   importedDocument,
   operationBaseUrls,
   parseSpec,
@@ -100,7 +101,19 @@ import {
   type Unsupported,
 } from "./plan.ts";
 import type { V1Snapshot, V1Source } from "./source.ts";
-import { sourceHash, toolkitCopyId, type ImportStore, type MapResult } from "./store.ts";
+import {
+  blockYamlDocument,
+  type Entries,
+  microsoftGraphFormat,
+  parsedDocument,
+} from "./stored-document.ts";
+import {
+  sourceHash,
+  toolkitCopyConnectionId,
+  toolkitCopyId,
+  type ImportStore,
+  type MapResult,
+} from "./store.ts";
 import { v1ToolPaths } from "./v1-tool-paths.ts";
 
 /** v1's OAuth callback; imported clients keep it, and v1's edge forwards it to v2. */
@@ -124,6 +137,12 @@ export interface ItemContext {
   readonly firstParty: FirstPartyClients;
 }
 
+/** The v1 rows a connection's account is decided from. */
+export type ConnectionSnapshot = Pick<
+  V1Snapshot,
+  "tenant" | "subjects" | "integrations" | "connections" | "clients"
+>;
+
 /** The v1 rows an item reads are org rows or one member's own (`subject`). */
 type Owned = { readonly owner: "org" | "user"; readonly subject: string };
 
@@ -148,6 +167,8 @@ export class ItemFailed extends Schema.TaggedError<ItemFailed>()("ItemFailed", {
   reason: Schema.String,
   vault: Schema.optional(Schema.Literals(["missing", "unavailable"])),
   stale: Schema.optional(V1StaleCategory),
+  /** The service did not respond: the item moves when tried again. */
+  outage: Schema.optional(Schema.Literal(true)),
 }) {}
 const fail = (reason: string) => Effect.fail(new ItemFailed({ reason }));
 const failStale = (stale: V1StaleCategory, reason: string) =>
@@ -387,6 +408,71 @@ const droppedFields = (dropped: readonly DroppedFixed[]) =>
 /** The fixed account's name in an app's requirements and its sign-in method. */
 export const fixedRequirement = "fixed";
 
+/** The plans of the integration's connections that move: those whose sign-in v2 can take. */
+export const connectionPlans = (
+  snapshot: ConnectionSnapshot,
+  firstParty: FirstPartyClients,
+  integration: Pick<IntegrationRow, "slug">,
+) =>
+  snapshot.connections
+    .filter((row) => row.integration === integration.slug)
+    .flatMap((row) => {
+      const plan = connectionPlan(snapshot, firstParty, row);
+      return plan.ok ? [plan.value] : [];
+    });
+
+/**
+ * The v1 rows a connection's own app is decided from (decision 33): its integration's other
+ * connections left out, so the app takes only its sign-in method and account.
+ */
+export const connectionSnapshot = <S extends Pick<V1Snapshot, "connections">>(
+  snapshot: S,
+  connection: Pick<ConnectionRow, "row_id" | "integration">,
+): S => ({
+  ...snapshot,
+  connections: snapshot.connections.filter(
+    (row) => row.integration !== connection.integration || row.row_id === connection.row_id,
+  ),
+});
+
+/**
+ * A connection's own app's name (decision 33): its integration's, then the connection's. A
+ * workspace connection that shares its name with a member's says so, as its account does. App
+ * names are unique in an organization, and members often gave their connections the same name, so
+ * each later connection of a name is numbered, in the order v1 made them.
+ */
+export const connectionAppName = (
+  snapshot: Pick<V1Snapshot, "connections">,
+  integration: IntegrationRow,
+  connection: ConnectionRow,
+) => {
+  const own = (row: ConnectionRow) => {
+    const name = row.name.trim() === "" ? "connection" : row.name.trim().slice(0, 56);
+    return accountLabel(snapshot, row) === row.name ? name : `${name}, workspace`;
+  };
+  const base = own(connection);
+  const index = snapshot.connections
+    .filter((row) => row.integration === connection.integration && own(row) === base)
+    .sort((a, b) =>
+      a.created_ms !== b.created_ms
+        ? a.created_ms - b.created_ms
+        : a.row_id < b.row_id
+          ? -1
+          : a.row_id > b.row_id
+            ? 1
+            : 0,
+    )
+    .findIndex((row) => row.row_id === connection.row_id);
+  const label = index > 0 ? `${base} ${index + 1}` : base;
+  return `${integrationLabel(integration).slice(0, 117 - label.length)} (${label})`;
+};
+
+/** An item context narrowed to one connection's own app (decision 33). */
+const connectionContext = <C extends { readonly snapshot: ConnectionSnapshot }>(
+  context: C,
+  connection: ConnectionRow,
+) => ({ ...context, snapshot: connectionSnapshot(context.snapshot, connection), connection });
+
 /**
  * The app's sign-in methods, which one each importable connection uses, and the values each
  * account takes from v1's configuration. When the app takes accounts at all (another connection
@@ -399,7 +485,7 @@ export const fixedRequirement = "fixed";
  * in `dropped` are left out.
  */
 export const appMethods = (
-  snapshot: V1Snapshot,
+  snapshot: ConnectionSnapshot,
   firstParty: FirstPartyClients,
   integration: IntegrationRow,
   dropped: readonly DroppedFixed[] = [],
@@ -408,12 +494,7 @@ export const appMethods = (
   const keys = new Map<string, string>();
   const methodOf = new Map<string, string>();
   const configured = new Map<string, ReadonlyArray<readonly [string, string]>>();
-  const plans = snapshot.connections
-    .filter((row) => row.integration === integration.slug)
-    .flatMap((row) => {
-      const plan = connectionPlan(snapshot, firstParty, row);
-      return plan.ok ? [plan.value] : [];
-    });
+  const plans = connectionPlans(snapshot, firstParty, integration);
   const decoded = integrationPlan(integration);
   const secrets = decoded.ok
     ? integrationValues(decoded.value, droppedFields(dropped)).secrets
@@ -483,15 +564,27 @@ export type AppAccounts = ReturnType<typeof appMethods>;
 // Tool names and approvals.
 
 const rank = { approve: 1, default: 1.5, require_approval: 2, block: 3 } as const;
+/**
+ * What v1 did with a tool no policy decided, when the app's own default would not do the same: ask,
+ * for an MCP tool whose row v1 stamped as needing approval. v1 asked from that stamp, made from the
+ * server's `destructiveHint` when it last listed the tools; the app's default reads the live hint,
+ * which a server may have dropped since, so the app asks always. OpenAPI and GraphQL defaults
+ * come from the generated source (a method or a mutation), which asks wherever v1 stamped one.
+ * A tool v1 did not stamp keeps the app's default.
+ */
+const unruled = (integration: Pick<IntegrationRow, "plugin_id">, tool: ToolRow) =>
+  integration.plugin_id === "mcp" && tool.requires_approval ? "require_approval" : "default";
 /**
  * Each tool's v1 policy result, combined across its connections and the v1 names it had: the most
- * restrictive, where a connection without a matching policy keeps the tool's own default.
- * `aliases` maps a dropped v1 name to the name the tool keeps.
+ * restrictive, where a connection without a matching policy keeps the tool's own default, pinned
+ * as `unruled` says. `aliases` maps a dropped v1 name to the name the tool keeps.
  *
- * A toolkit's own policies applied only to calls through the toolkit, but v2 keeps approvals in
- * the app for every caller. A toolkit that asks before a tool it grants therefore makes the app
- * ask; its `approve` never lowers the workspace's result, and its `block` only leaves the tool out
- * of the toolkit's connection.
+ * A toolkit's own policies applied only to calls through the toolkit, and v1 ignored the
+ * workspace's policies there, but v2 keeps approvals in the app for every caller. A toolkit that
+ * asks before a tool it grants therefore makes the app ask. One that grants it without a rule of its
+ * own left it to the tool's default, so the workspace's `approve` cannot lower it below that
+ * default either. The toolkit's `approve` never lowers the workspace's result, and its `block` only
+ * leaves the tool out of the toolkit's connection.
  */
 export const toolActions = (
   snapshot: V1Snapshot,
@@ -503,12 +596,16 @@ export const toolActions = (
   const toolkits = decodedToolkits(snapshot);
   for (const tool of tools) {
     const id = `${integration.slug}.${tool.owner}.${tool.connection}.${tool.name}`;
-    const own = resolvePolicy(id, snapshot.policies, snapshot.multiMember) ?? "default";
-    const action =
-      rank[own] < rank.require_approval &&
-      toolkits.some((toolkit) => toolkitAction(toolkit, id) === "require_approval")
-        ? "require_approval"
-        : own;
+    const fallback = unruled(integration, tool);
+    const own = resolvePolicy(id, snapshot.policies, snapshot.multiMember) ?? fallback;
+    // The least the app may do for each toolkit that grants the tool: ask when the toolkit asks,
+    // keep the tool's default when the toolkit left it to the default.
+    const action = toolkits.reduce<PolicyAction | "default">((current, toolkit) => {
+      const granted = toolkitAction(toolkit, id);
+      const floor =
+        granted === "require_approval" ? granted : granted === "default" ? fallback : undefined;
+      return floor !== undefined && rank[floor] > rank[current] ? floor : current;
+    }, own);
     const name = Object.hasOwn(aliases, tool.name) ? (aliases[tool.name] ?? tool.name) : tool.name;
     const current = actions.get(name);
     if (current === undefined || rank[action] > rank[current]) actions.set(name, action);
@@ -516,7 +613,8 @@ export const toolActions = (
   return actions;
 };
 
-const approvalRules = (actions: ReadonlyMap<string, PolicyAction | "default">) => {
+/** The app's own rules from each tool's action: left out, `never` or `always`. */
+export const approvalRules = (actions: ReadonlyMap<string, PolicyAction | "default">) => {
   const approvals: Record<string, "always" | "never"> = {};
   const omitted: string[] = [];
   for (const [name, action] of actions) {
@@ -527,6 +625,202 @@ const approvalRules = (actions: ReadonlyMap<string, PolicyAction | "default">) =
   return { approvals, omitted };
 };
 
+/** A tool name no tool row has: only a rule's `*` in the tool's place matches it. */
+const unlistedName = "\u0000";
+
+/** Where v1 listed a tool: its connection's owner, member and name, as in v1's tool ids. */
+type ToolAddress = Pick<ToolRow, "owner" | "subject" | "connection">;
+
+const addressOf = (connection: Pick<ConnectionRow, "owner" | "subject" | "name">): ToolAddress => ({
+  owner: connection.owner,
+  subject: connection.subject,
+  connection: connection.name,
+});
+
+/** Each of the integration's connections, and one made later in either scope. */
+const integrationAddresses = (
+  snapshot: Pick<V1Snapshot, "connections">,
+  integration: Pick<IntegrationRow, "slug">,
+): readonly ToolAddress[] => [
+  ...snapshot.connections
+    .filter((connection) => connection.integration === integration.slug)
+    .map(addressOf),
+  { owner: "org", subject: "", connection: unlistedName },
+  { owner: "user", subject: "", connection: unlistedName },
+];
+
+/**
+ * Rows for tools v1 had no row for, as a connection at each address would list them. v1 decided
+ * such a tool by its rules once a connection listed it, so the app decides it the same way.
+ */
+const unlistedRows = (
+  addresses: readonly ToolAddress[],
+  names: Iterable<string>,
+): readonly ToolRow[] =>
+  [...names].flatMap((name) =>
+    addresses.map((address) => ({
+      ...address,
+      name,
+      upstream: name,
+      requires_approval: false,
+      listed_at: null,
+    })),
+  );
+
+/**
+ * The integration's tools as one connection alone lists them: a row at its address for each name
+ * any of its connections listed. A tool asks by default when v1 stamped any of its rows, so
+ * connections that listed it at different times do not differ by their stamps.
+ */
+const listedAs = (
+  connection: Pick<ConnectionRow, "owner" | "subject" | "name">,
+  tools: readonly ToolRow[],
+): readonly ToolRow[] => {
+  const byName = new Map<string, ToolRow>();
+  for (const tool of tools) {
+    const known = byName.get(tool.name);
+    if (known === undefined || (tool.requires_approval && !known.requires_approval))
+      byName.set(tool.name, tool);
+  }
+  return [...byName.values()].map((tool) => ({ ...tool, ...addressOf(connection) }));
+};
+
+/** The tool names the workspace's and toolkits' rules for an integration spell out in full. */
+const ruleNames = (snapshot: V1Snapshot, integration: Pick<IntegrationRow, "slug">) => {
+  const names = new Set<string>();
+  const patterns = [
+    ...snapshot.policies.map((policy) => policy.pattern),
+    ...decodedToolkits(snapshot).flatMap((toolkit) =>
+      toolkit.policies.map((policy) => policy.pattern),
+    ),
+  ];
+  for (const pattern of patterns) {
+    const segments = pattern.split(".");
+    if (segments[0] !== integration.slug || segments.length < 4) continue;
+    const name = segments.slice(3);
+    if (!name.includes("*")) names.add(name.join("."));
+  }
+  return names;
+};
+
+/**
+ * v1's result for each name `v1ToolRules` decides, and, on a server that lists tools as it runs
+ * (no `exposed`), the result v1's rules give a name none of them spells out (`unnamed`). With a
+ * `connection`, the results are v1's for that connection alone (decision 33).
+ */
+export const v1ToolDecisions = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+  aliases: Readonly<Record<string, string>> = {},
+  exposed?: readonly string[],
+  connection?: Pick<ConnectionRow, "owner" | "subject" | "name">,
+) => {
+  const rows = connection === undefined ? tools : listedAs(connection, tools);
+  const addresses =
+    connection === undefined
+      ? integrationAddresses(snapshot, integration)
+      : [addressOf(connection)];
+  const listed = toolActions(snapshot, integration, rows, aliases);
+  const unlisted = new Set(
+    [...ruleNames(snapshot, integration), ...(exposed ?? [])].filter(
+      (name) => !listed.has(name) && !Object.hasOwn(aliases, name),
+    ),
+  );
+  const actions: ReadonlyMap<string, PolicyAction | "default"> = new Map([
+    ...listed,
+    ...toolActions(snapshot, integration, unlistedRows(addresses, unlisted)),
+  ]);
+  const unnamed =
+    exposed === undefined
+      ? toolActions(snapshot, integration, unlistedRows(addresses, [unlistedName])).get(
+          unlistedName,
+        )
+      : undefined;
+  return { actions, unnamed };
+};
+
+/**
+ * The app's rules from v1's policies: each tool v1 listed (`toolActions`), each tool a rule names
+ * that v1 did not list, such as one the server stopped listing, and each name in `exposed`. v1
+ * decided a tool it listed later by the same rules, so none of these runs with less than v1 gave
+ * it. `exposed` is every name the app can expose, when its source fixes them (OpenAPI); otherwise
+ * the server lists tools as it runs, and a tool no rule names gets what v1's rules give a tool
+ * they do not name (`otherwise`). With a `connection`, the rules are v1's for it alone.
+ */
+export const v1ToolRules = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+  aliases: Readonly<Record<string, string>> = {},
+  exposed?: readonly string[],
+  connection?: Pick<ConnectionRow, "owner" | "subject" | "name">,
+): Pick<GeneratedToolRules, "approvals" | "omitted" | "otherwise"> => {
+  const { actions, unnamed } = v1ToolDecisions(
+    snapshot,
+    integration,
+    tools,
+    aliases,
+    exposed,
+    connection,
+  );
+  const rules = approvalRules(actions);
+  if (exposed !== undefined) return rules;
+  const rule =
+    unnamed === "block" ? "omitted" : unnamed === "require_approval" ? "always" : undefined;
+  return rule === undefined
+    ? rules
+    : { ...rules, otherwise: { rule, known: [...actions.keys()].sort() } };
+};
+
+/**
+ * Whether v1 decided a tool differently for two of the integration's connections (decision 33):
+ * one a connection listed, a rule names or the app exposes, or, on a server that lists its tools as
+ * it runs, one no rule names. Each connection's results are v1's for it alone, toolkits' included,
+ * so any difference in blocking, asking, allowing or the tool's default counts.
+ */
+export const rulesDiffer = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+  connections: ReadonlyArray<Pick<ConnectionRow, "owner" | "subject" | "name">>,
+  aliases: Readonly<Record<string, string>> = {},
+  exposed?: readonly string[],
+) => {
+  const [first, ...rest] = connections.map((connection) =>
+    v1ToolDecisions(snapshot, integration, tools, aliases, exposed, connection),
+  );
+  return (
+    first !== undefined &&
+    rest.some(
+      (other) =>
+        other.unnamed !== first.unnamed ||
+        [...first.actions].some(([name, action]) => other.actions.get(name) !== action),
+    )
+  );
+};
+
+/** How many tools an app's rules leave out, ask before and run without asking, as reported. */
+export interface RuleCounts {
+  readonly omitted: number;
+  readonly always: number;
+  readonly never: number;
+  /** What the rules do with a tool none of them names, on a server that lists tools as it runs. */
+  readonly otherwise: "omitted" | "always" | null;
+}
+
+const ruleCounts = (
+  rules: Pick<GeneratedToolRules, "approvals" | "omitted" | "otherwise">,
+): RuleCounts => {
+  const approvals = Object.values(rules.approvals ?? {});
+  return {
+    omitted: rules.omitted?.length ?? 0,
+    always: approvals.filter((rule) => rule === "always").length,
+    never: approvals.filter((rule) => rule === "never").length,
+    otherwise: rules.otherwise?.rule ?? null,
+  };
+};
+
 const missingNames = (missing: readonly string[]) =>
   `v2 would not provide ${missing.length} of its v1 tools: ${missing
     .slice(0, 10)
@@ -596,7 +890,7 @@ const toolNames = (tools: readonly ToolRow[]) => new Set(tools.map((tool) => too
  * new connection.
  */
 export const compiledTools = (
-  document: Record<string, unknown>,
+  document: Entries,
   operations: readonly OpenApiOperationRow[],
   tools: readonly ToolRow[],
 ): ReadonlyMap<string, string> => {
@@ -616,7 +910,7 @@ export const compiledTools = (
 /** The v1 reads source generation needs. */
 export type GenerationSource = Pick<
   V1Source,
-  "tools" | "openApiOperations" | "openApiBinding" | "blob" | "blobMissing"
+  "tools" | "openApiOperations" | "openApiBinding" | "blob" | "blobMissing" | "specification"
 >;
 
 /**
@@ -641,7 +935,8 @@ export interface StaleTool {
 /**
  * An integration's generated app: its files, what the user should know, its check, the v1 tools
  * of TRACE operations it leaves out (decision 16), the v1 tools it leaves out as stale (decision
- * 21), and the fixed credentials it leaves out (decision 22).
+ * 21), and the fixed credentials it leaves out (decision 22). `split` says its connections' rules
+ * differ, so each connection moves as its own app instead (decision 33); `rules` counts its own.
  */
 export interface GeneratedApp {
   readonly files: SourceFiles;
@@ -650,6 +945,8 @@ export interface GeneratedApp {
   readonly traced: readonly string[];
   readonly stale: readonly StaleTool[];
   readonly dropped: readonly DroppedFixed[];
+  readonly split: boolean;
+  readonly rules: RuleCounts;
 }
 
 const healthOf = (check: GeneratedHealthCheck | undefined) =>
@@ -701,12 +998,89 @@ const leftOutNote = (app: Pick<GeneratedApp, "traced" | "stale" | "dropped">) =>
   return notes.length === 0 ? undefined : notes.join(" ");
 };
 
+/**
+ * The document v1 stored for an OpenAPI integration, read as v1 read it: a Microsoft Graph preset's
+ * entry by entry from its text, as v1 compiled it, and any other whole.
+ */
+const storedDocument = (
+  source: GenerationSource,
+  decoded: Extract<ImportableIntegration, { readonly plugin: "openapi" }>,
+  bytes: Uint8Array,
+) =>
+  Effect.gen(function* () {
+    if (decoded.config.specFormat === microsoftGraphFormat) {
+      const read = blockYamlDocument(bytes);
+      if (!read.ok) return yield* fail(read.reason);
+      return read;
+    }
+    const read = parseSpec(bytes);
+    if (read.ok === false) return yield* failStale("unreadable_spec", read.reason);
+    // v1 stored some specifications as their URL and fetched the document once; so does this.
+    // v1 kept what it fetched, so a document that cannot be fetched or read now still blocks.
+    const parsed =
+      read.ok === "url"
+        ? parseSpec(
+            yield* source
+              .specification(read.url)
+              .pipe(Effect.catchTag("SpecificationUnavailable", (error) => fail(error.reason))),
+          )
+        : read;
+    if (parsed.ok === "url")
+      return yield* fail("v1's stored specification is a URL whose document is another URL.");
+    if (!parsed.ok) return yield* fail(parsed.reason);
+    return {
+      document: parsedDocument(parsed.document),
+      unread: (): string | undefined => undefined,
+    };
+  });
+
+/**
+ * The integration's stored document cut to v1's operations, with v1's operation rows and tool
+ * listing. The stored bytes and the document read from them end with this, before the app is
+ * generated from the cut.
+ */
+const importedSpecification = (
+  context: { readonly snapshot: V1Snapshot; readonly source: GenerationSource },
+  integration: IntegrationRow,
+  decoded: Extract<ImportableIntegration, { readonly plugin: "openapi" }>,
+) =>
+  Effect.gen(function* () {
+    const { tenant, subjects } = context.snapshot;
+    const stored = yield* context.source.blob(tenant, "openapi", `spec/${decoded.specHash}`);
+    if (Option.isNone(stored)) return yield* fail(context.source.blobMissing);
+    const { document, unread } = yield* storedDocument(context.source, decoded, stored.value);
+    const operations = yield* context.source.openApiOperations(tenant, integration.slug);
+    const tools = yield* context.source.tools(tenant, subjects, integration.slug);
+    const compiled = importedDocument(
+      document,
+      operations,
+      compiledTools(document, operations, tools),
+    );
+    // An entry the cut read could not be parsed: v1 could not read it either.
+    const reason = unread();
+    if (reason !== undefined) return yield* failStale("unreadable_spec", reason);
+    return { compiled, operations, tools };
+  });
+
 /** An integration's app source, generated from v1's rows without writing anything. */
 export const generate = (
-  context: { readonly snapshot: V1Snapshot; readonly source: GenerationSource },
+  context: {
+    readonly snapshot: V1Snapshot;
+    readonly source: GenerationSource;
+    /**
+     * False to generate the app as the importer did before it decided tools v1 did not list
+     * (`v1ToolRules`), for the repair of organizations moved before then.
+     */
+    readonly unlistedRules?: boolean;
+    /**
+     * The connection whose own app this is (decision 33), with the snapshot narrowed to it
+     * (`connectionSnapshot`): its rules are v1's for that connection alone.
+     */
+    readonly connection?: ConnectionRow;
+  },
   integration: IntegrationRow,
   decoded: ImportableIntegration,
-  planned: Pick<AppAccounts, "methods" | "shared" | "fixed" | "dropped">,
+  planned: Pick<AppAccounts, "methods" | "shared" | "fixed" | "dropped" | "plans">,
 ) =>
   Effect.gen(function* () {
     const { methods, shared: sharedAccounts, dropped } = planned;
@@ -721,14 +1095,38 @@ export const generate = (
       ...(fixedAccount === undefined ? {} : { fixedAccount }),
     };
     const left = { traced: [], stale: [], dropped } as const;
+    // The app's rules, and for the whole integration whether its connections' rules differ.
+    const toolRules = (
+      tools: readonly ToolRow[],
+      aliases?: Readonly<Record<string, string>>,
+      exposed?: readonly string[],
+    ) => {
+      const rules =
+        context.unlistedRules === false
+          ? approvalRules(toolActions(context.snapshot, integration, tools, aliases))
+          : v1ToolRules(context.snapshot, integration, tools, aliases, exposed, context.connection);
+      const split =
+        context.connection === undefined &&
+        context.unlistedRules !== false &&
+        rulesDiffer(
+          context.snapshot,
+          integration,
+          tools,
+          planned.plans.map((plan) => plan.row),
+          aliases,
+          exposed,
+        );
+      return { rules, split, counts: ruleCounts(rules) };
+    };
     switch (decoded.plugin) {
       case "mcp": {
         const tools = yield* context.source.tools(tenant, subjects, integration.slug);
         const { rename, overrides, aliases, missing } = mcpNaming(tools);
         if (missing.length > 0) return yield* fail(missingNames(missing));
+        const decided = toolRules(tools, aliases);
         const rules: GeneratedToolRules = {
           ...(rename ? { names: { kind: "lower_snake", overrides } } : {}),
-          ...approvalRules(toolActions(context.snapshot, integration, tools, aliases)),
+          ...decided.rules,
         };
         const aliased = Object.entries(aliases).sort(([a], [b]) => (a < b ? -1 : 1));
         const generated = yield* generateMcpSource(
@@ -757,12 +1155,15 @@ export const generate = (
               ? { kind: "dropped" as const, reason: fixedHealthDropped }
               : { kind: "mcp" as const, declared: integration.health_check !== null },
           ...left,
+          split: decided.split,
+          rules: decided.counts,
         } satisfies GeneratedApp;
       }
       case "graphql": {
         const tools = yield* context.source.tools(tenant, subjects, integration.slug);
         const missing = graphqlMissing(tools);
         if (missing.length > 0) return yield* fail(missingNames(missing));
+        const decided = toolRules(tools);
         const check: GeneratedHealthCheck | undefined =
           accounts && decoded.healthCheck && fixedAccount === undefined
             ? { kind: "graphql", query: v1IntrospectionQuery }
@@ -776,7 +1177,7 @@ export const generate = (
           queryParams,
           tools: {
             names: { kind: "graphql_path" },
-            ...approvalRules(toolActions(context.snapshot, integration, tools)),
+            ...decided.rules,
           },
           ...healthOf(check),
         });
@@ -790,20 +1191,15 @@ export const generate = (
                 ? { kind: "dropped" as const, reason: fixedHealthDropped }
                 : { kind: "none" as const },
           ...left,
+          split: decided.split,
+          rules: decided.counts,
         } satisfies GeneratedApp;
       }
       case "openapi": {
-        const stored = yield* context.source.blob(tenant, "openapi", `spec/${decoded.specHash}`);
-        if (Option.isNone(stored)) return yield* fail(context.source.blobMissing);
-        const parsed = parseSpec(stored.value);
-        if (!parsed.ok) return yield* failStale("unreadable_spec", parsed.reason);
-        const { document } = parsed;
-        const operations = yield* context.source.openApiOperations(tenant, integration.slug);
-        const tools = yield* context.source.tools(tenant, subjects, integration.slug);
-        const compiled = importedDocument(
-          document,
-          operations,
-          compiledTools(document, operations, tools),
+        const { compiled, operations, tools } = yield* importedSpecification(
+          context,
+          integration,
+          decoded,
         );
         // v1 sent each operation to its own server unless the integration set a base URL, with the
         // account's credentials on every one, and the app does the same. An operation v1 never
@@ -830,10 +1226,20 @@ export const generate = (
           return yield* fail(
             `Its operations call ${insecure.join(", ")} over plain HTTP, and an imported app sends an account's credentials to more than one host only over HTTPS.`,
           );
-        // v2's names for every operation, as liveOpenapiRouter plans them, mapped to v1's.
+        // The name liveOpenapiRouter gives each operation, as it reads the document, mapped to v1's.
+        const declared = yield* Effect.tryPromise({
+          try: () => openapiOperationNames(prepared.document),
+          catch: (error) => error,
+        }).pipe(
+          Effect.catch((error) =>
+            error instanceof OpenapiCompileError ? fail(error.reason) : Effect.die(error),
+          ),
+        );
         const names: Record<string, string> = {};
-        for (const operation of planOperationNames(documentOperations(prepared)))
-          if (operation.v1 !== undefined) names[operation.name] = operation.v1;
+        for (const operation of declared) {
+          const v1 = prepared.named.get(`${operation.method.toLowerCase()} ${operation.path}`);
+          if (v1 !== undefined) names[operation.name] = v1;
+        }
         const exposed = new Set(Object.values(names));
         // Every tool v1 bound or last listed, except those of the TRACE operations it drops and
         // of the operations v1 never reached.
@@ -867,6 +1273,11 @@ export const generate = (
                   ),
                   origins,
                 });
+        const decided = toolRules(
+          tools.filter((tool) => !staleNames.has(tool.name)),
+          {},
+          [...exposed].filter((name) => !staleNames.has(name)),
+        );
         const generated = yield* openapiAppSource({
           name,
           document: prepared.document,
@@ -876,16 +1287,7 @@ export const generate = (
           ...accountOptions,
           headers,
           queryParams,
-          tools: {
-            names: { kind: "map", names },
-            ...approvalRules(
-              toolActions(
-                context.snapshot,
-                integration,
-                tools.filter((tool) => !staleNames.has(tool.name)),
-              ),
-            ),
-          },
+          tools: { names: { kind: "map", names }, ...decided.rules },
           ...healthOf(checked?.ok === true ? checked.check : undefined),
         });
         const outcome = { traced: prepared.traced, stale, dropped };
@@ -903,6 +1305,8 @@ export const generate = (
                       checked.check.kind === "request" && checked.check.identity !== undefined,
                   }
                 : { kind: "dropped" as const, reason: checked.reason },
+          split: decided.split,
+          rules: decided.counts,
         } satisfies GeneratedApp;
       }
     }
@@ -941,9 +1345,15 @@ const buildFailures = {
     fail(`The generated app did not build. ${error.message}`),
 };
 
+/** Why an integration whose connections' rules differ is still one app. */
+export const splitKept =
+  "Its connections have different v1 rules, but an earlier run imported it as one app, which keeps the strictest rule of each tool.";
+
 /**
  * Deploy the integration's app for the organization: shared with everyone, created by the owner.
- * An earlier run's app gets a new version.
+ * An earlier run's app gets a new version. An integration whose connections' rules differ is not
+ * deployed (`split`): each connection becomes its own app (`importConnectionApp`), unless an
+ * earlier run imported it as one app, which stays one.
  */
 export const importIntegration = (
   context: ItemContext,
@@ -960,6 +1370,7 @@ export const importIntegration = (
       yield* redundantFixed(context, integration),
     );
     const generated = yield* generate(context, integration, plan.value, planned);
+    if (generated.split && existing === undefined) return { kind: "split" as const };
     const owner = organizationOwner(context.target.id);
     const app =
       existing === undefined
@@ -973,8 +1384,12 @@ export const importIntegration = (
               integrationLabel(integration),
             ).pipe(Effect.catch(() => fail("The app package could not be named."))),
           })).app;
+    const note = generated.split
+      ? [generated.note, splitKept].filter((text) => text !== undefined).join(" ")
+      : generated.note;
     return {
-      result: imported("app", app.id, generated.note),
+      kind: "one" as const,
+      result: imported("app", app.id, note),
       app: app.id,
       traced: generated.traced,
       stale: generated.stale,
@@ -989,40 +1404,117 @@ export const importIntegration = (
     Effect.provideService(CurrentUserId, context.owner),
   );
 
+/**
+ * Deploy one connection's own app (decision 33): its integration's app as that connection alone
+ * would have it, named after both. An org connection's app is shared with everyone and created by
+ * the owner; a member's is theirs alone, as their connection was in v1. An earlier run's app gets a
+ * new version.
+ */
+export const importConnectionApp = (
+  context: ItemContext,
+  integration: IntegrationRow,
+  connection: ConnectionRow,
+  existing: AppId | undefined,
+) =>
+  Effect.gen(function* () {
+    const creator = actorOf(context, connection);
+    if (creator === undefined) return yield* fail("Its member is not imported.");
+    const created = Effect.gen(function* () {
+      const plan = integrationPlan(integration);
+      if (!plan.ok) return yield* refused(plan);
+      const own = connectionContext(context, connection);
+      const planned = appMethods(
+        own.snapshot,
+        context.firstParty,
+        integration,
+        yield* redundantFixed(own, integration),
+      );
+      const generated = yield* generate(own, integration, plan.value, planned);
+      const name = connectionAppName(context.snapshot, integration, connection);
+      const app =
+        existing === undefined
+          ? yield* deployNamed(context, name, generated.files)
+          : (yield* context.executor.apps.deploy({
+              owner: organizationOwner(context.target.id),
+              app: existing,
+              files: yield* scopeGeneratedPackage(generated.files, context.target.slug, name).pipe(
+                Effect.catch(() => fail("The app package could not be named.")),
+              ),
+            })).app;
+      return {
+        result: imported("app", app.id, generated.note),
+        app: app.id,
+        name,
+        traced: generated.traced,
+        stale: generated.stale,
+        dropped: generated.dropped,
+        rules: generated.rules,
+      };
+    }).pipe(
+      Effect.catchTags({
+        ...buildFailures,
+        AppNotFound: () => fail("Its imported app was removed."),
+      }),
+    );
+    return yield* (connection.owner === "org" ? sharedAppCreation(created) : created).pipe(
+      Effect.provideService(CurrentUserId, creator),
+    );
+  });
+
+/** The app's fixed account's field names and values, from v1's configuration (decision 22). */
+const fixedAccount = (planned: AppAccounts) =>
+  planned.fixed === undefined
+    ? fail("Its imported app takes fixed credentials its integration no longer has.")
+    : Effect.succeed({
+        names: planned.fixed.account.fields,
+        values: Redacted.make(Object.fromEntries(planned.fixed.configured)),
+      });
+
+/** The map key of a fixed account: its integration's, or its connection's own app's. */
+const fixedKey = (integration: IntegrationRow, connection: ConnectionRow | undefined) =>
+  connection === undefined ? integration.row_id : `${integration.row_id}:${connection.row_id}`;
+
 /**
  * Save the account that holds the integration's fixed credentials, from v1's configuration, and
  * link it to the app's `fixed` requirement for everyone (decision 22), when the app declares one.
  * It is the organization's, created by the owner. Its map row keeps it for a retry, while the app's
- * provider for it is unchanged; linking again changes nothing.
+ * provider for it is unchanged; linking again changes nothing. With a `connection`, the app is that
+ * connection's own (decision 33), which holds its own fixed account.
  */
-export const importFixedAccount = (context: ItemContext, integration: IntegrationRow, app: AppId) =>
+export const importFixedAccount = (
+  context: ItemContext,
+  integration: IntegrationRow,
+  app: AppId,
+  connection?: ConnectionRow,
+) =>
   Effect.gen(function* () {
     const owner = organizationOwner(context.target.id);
     const deployed = yield* context.executor.apps.get({ owner, app });
     const requirement = deployed.requirements.accounts[fixedRequirement];
     if (requirement === undefined) return undefined;
+    const scoped = connection === undefined ? context : connectionContext(context, connection);
     const planned = appMethods(
-      context.snapshot,
+      scoped.snapshot,
       context.firstParty,
       integration,
-      yield* redundantFixed(context, integration),
+      yield* redundantFixed(scoped, integration),
     );
-    if (planned.fixed === undefined)
-      return yield* fail("Its imported app takes fixed credentials its integration no longer has.");
-    const hash = yield* sourceHash({
-      provider: requirement.provider,
-      fields: planned.fixed.account.fields,
-    });
-    const existing = yield* context.store.find("fixed_credentials", integration.row_id);
+    const fixed = yield* fixedAccount(planned);
+    const hash = yield* sourceHash({ provider: requirement.provider, fields: fixed.names });
+    const key = fixedKey(integration, connection);
+    const existing = yield* context.store.find("fixed_credentials", key);
     const record = (result: MapResult) =>
       context.store.record({
         organization: context.snapshot.tenant,
         kind: "fixed_credentials",
-        id: integration.row_id,
+        id: key,
         result,
         hash,
       });
-    const fields = Object.fromEntries(planned.fixed.configured);
+    const label =
+      connection === undefined
+        ? integrationLabel(integration)
+        : connectionAppName(context.snapshot, integration, connection);
     const account =
       existing?.status === "imported" && existing.v2_id !== null && existing.source_hash === hash
         ? AccountId.make(existing.v2_id)
@@ -1033,8 +1525,8 @@ export const importFixedAccount = (context: ItemContext, integration: Integratio
                   owner,
                   provider: requirement.provider,
                   method: fixedRequirement,
-                  label: `${integrationLabel(integration)} fixed credentials`,
-                  fields: Redacted.make(fields),
+                  label: `${label} fixed credentials`,
+                  fields: fixed.values,
                 })
                 .pipe(accountDestination({ kind: "shared", audience: { kind: "everyone" } }));
               yield* record(imported("account", added.id));
@@ -1056,7 +1548,8 @@ export const importFixedAccount = (context: ItemContext, integration: Integratio
 /**
  * Generate and compile the integration's app as an import would, and read the requirements it
  * declares, writing nothing: no app, version or source is saved, and the build is neither kept
- * nor cached (`apps.build`). The dry run's check that every app builds.
+ * nor cached (`apps.build`). The dry run's check that every app builds. `split` says the import
+ * makes an app per connection instead, which the dry run checks with a `connection` each.
  */
 export const checkIntegration = (
   context: Pick<ItemContext, "executor" | "snapshot" | "source" | "firstParty"> & {
@@ -1066,19 +1559,24 @@ export const checkIntegration = (
     readonly slug: string;
   },
   integration: IntegrationRow,
+  connection?: ConnectionRow,
 ) =>
   Effect.gen(function* () {
     const plan = integrationPlan(integration);
     if (!plan.ok) return yield* refused(plan);
+    const scoped = connection === undefined ? context : connectionContext(context, connection);
     const planned = appMethods(
-      context.snapshot,
+      scoped.snapshot,
       context.firstParty,
       integration,
-      yield* redundantFixed(context, integration),
+      yield* redundantFixed(scoped, integration),
     );
-    const generated = yield* generate(context, integration, plan.value, planned);
-    const name = integrationLabel(integration);
-    yield* context.executor.apps.build({
+    const generated = yield* generate(scoped, integration, plan.value, planned);
+    const name =
+      connection === undefined
+        ? integrationLabel(integration)
+        : connectionAppName(context.snapshot, integration, connection);
+    const built = yield* context.executor.apps.build({
       owner: context.owner,
       name,
       files: yield* scopeGeneratedPackage(generated.files, context.slug, name).pipe(
@@ -1086,14 +1584,46 @@ export const checkIntegration = (
       ),
     });
     return {
+      name,
       note: generated.note,
       traced: generated.traced,
       stale: generated.stale,
       dropped: generated.dropped,
       health: generated.health,
+      split: generated.split,
+      rules: generated.rules,
+      accounts: built.requirements.accounts,
     };
   }).pipe(Effect.catchTags(buildFailures));
 
+/**
+ * Check the account `importFixedAccount` would save for the app, against the requirements its
+ * build declares, and save nothing.
+ */
+export const checkFixedAccount = (
+  context: Pick<ItemContext, "executor" | "snapshot" | "source" | "firstParty">,
+  integration: IntegrationRow,
+  accounts: AppAccountRequirements,
+  connection?: ConnectionRow,
+) =>
+  Effect.gen(function* () {
+    const requirement = accounts[fixedRequirement];
+    if (requirement === undefined) return;
+    const scoped = connection === undefined ? context : connectionContext(context, connection);
+    const planned = appMethods(
+      scoped.snapshot,
+      context.firstParty,
+      integration,
+      yield* redundantFixed(scoped, integration),
+    );
+    yield* context.executor[OAuthGrantImport].checkAccountFields({
+      provider: requirement.provider,
+      definition: requirement.definition,
+      method: fixedRequirement,
+      fields: (yield* fixedAccount(planned)).values,
+    });
+  });
+
 // ---------------------------------------------------------------------------------------------
 // Connections.
 
@@ -1216,7 +1746,7 @@ const secretSubjects = (
   row.owner === "org" && itemOwner(itemId) === "user" ? snapshot.subjects : [row.subject];
 
 /** The account's name; an org connection yields its name to a personal one. */
-export const accountLabel = (snapshot: V1Snapshot, row: ConnectionRow) =>
+export const accountLabel = (snapshot: Pick<V1Snapshot, "connections">, row: ConnectionRow) =>
   row.owner === "org" &&
   snapshot.connections.some(
     (other) =>
@@ -1229,82 +1759,106 @@ export const accountLabel = (snapshot: V1Snapshot, row: ConnectionRow) =>
 export const connectionRequirement = (row: Pick<ConnectionRow, "owner">) =>
   row.owner === "org" ? "workspace" : "service";
 
+/** The accounts an integration's app takes, by requirement: a deployed app's or a build's. */
+export type AppAccountRequirements = DeployedApp["requirements"]["accounts"];
+
 /**
- * Save the connection's account: an org connection's is shared with everyone and created by the
- * owner, a member's is their own. The map row commits with it.
+ * The account a connection's import saves, decided from v1's rows and secrets and the app's
+ * requirements, writing nothing: the requirement it fills and the grant or fields it holds, or
+ * why it cannot be saved. The import saves it (`importAccount`) and the dry run checks it
+ * (`checkAccount`), so a dry run refuses every account an import would, with the same reason.
  */
-export const importAccount = (
-  context: ItemContext,
-  plan: ConnectionPlan,
-  app: Pick<DeployedApp, "id" | "requirements">,
-  record: (result: MapResult) => Effect.Effect<void, V1ImportUnavailable>,
+type AccountWrite =
+  | {
+      readonly kind: "grant";
+      readonly requirement: AccountRequirement;
+      readonly input: ImportOAuthGrant;
+      /** The operator's client a first-party grant moves to, which its refusal names. */
+      readonly firstParty?: {
+        readonly name: string;
+        readonly client: { readonly placement: { readonly hosts: readonly string[] } };
+        readonly hosts: readonly string[];
+      };
+    }
+  | {
+      readonly kind: "fields";
+      readonly requirement: AccountRequirement;
+      readonly input: {
+        readonly owner: OwnerId;
+        readonly provider: AccountRequirement["provider"];
+        readonly method: string;
+        readonly label: string;
+        readonly fields: Redacted.Redacted<Record<string, string>>;
+      };
+    };
+
+/** Reads one of a connection's secrets from v1's Vault, as `readSecret` does. */
+export type SecretReader = (itemId: string) => ReturnType<typeof readSecret>;
+
+/**
+ * Whether a connection's account goes to its own app (decision 33), whose sign-in methods are its
+ * alone, or to its integration's one app.
+ */
+export type AppScope = "own" | "integration";
+
+/** The sign-in methods of the app a connection's account goes to. */
+const plannedFor = (
+  context: Pick<ItemContext, "source" | "firstParty"> & { readonly snapshot: ConnectionSnapshot },
+  plan: Pick<ConnectionPlan, "row" | "integration">,
+  scope: AppScope,
 ) =>
   Effect.gen(function* () {
-    const actor = actorOf(context, plan.row);
-    if (actor === undefined) return yield* fail("Its member is not imported.");
-    return yield* saveAccount(context, plan, app, record, actor).pipe(
-      Effect.provideService(CurrentUserId, actor),
+    const scoped = scope === "own" ? connectionContext(context, plan.row) : context;
+    return appMethods(
+      scoped.snapshot,
+      context.firstParty,
+      plan.integration,
+      yield* redundantFixed(scoped, plan.integration),
     );
   });
 
-const saveAccount = (
-  context: ItemContext,
+const accountWrite = (
+  context: Pick<ItemContext, "source" | "firstParty"> & { readonly snapshot: ConnectionSnapshot },
   plan: ConnectionPlan,
-  app: Pick<DeployedApp, "id" | "requirements">,
-  record: (result: MapResult) => Effect.Effect<void, V1ImportUnavailable>,
-  actor: string,
+  accounts: AppAccountRequirements,
+  owner: OwnerId,
+  secret: SecretReader,
+  scope: AppScope,
 ) =>
   Effect.gen(function* () {
-    const requirement = app.requirements.accounts[connectionRequirement(plan.row)];
+    const requirement = accounts[connectionRequirement(plan.row)];
     if (requirement === undefined) return yield* fail("Its imported app takes no account.");
-    const creation =
-      plan.row.owner === "org"
-        ? accountDestination({ kind: "shared", audience: { kind: "everyone" } })
-        : personalAccountCreation(actor);
-    const secret = (itemId: string) => readSecret(context, plan.row, itemId);
-    const planned = appMethods(
-      context.snapshot,
-      context.firstParty,
-      plan.integration,
-      yield* redundantFixed(context, plan.integration),
-    );
+    const planned = yield* plannedFor(context, plan, scope);
     const method = planned.methodOf.get(plan.row.row_id);
     if (method === undefined) return yield* fail("Its sign-in method is not in the imported app.");
-    const owner = organizationOwner(context.target.id);
-    const label = accountLabel(context.snapshot, plan.row);
+    const base = {
+      owner,
+      provider: requirement.provider,
+      method,
+      label: accountLabel(context.snapshot, plan.row),
+    };
+    const expiresAt = plan.row.expires_at === null ? {} : { expiresAt: plan.row.expires_at };
     const access = plan.access;
     if (access.kind === "first_party") {
       const accessToken = yield* secret(access.accessItem);
       const refreshToken =
         plan.row.refresh_item_id === null ? undefined : yield* secret(plan.row.refresh_item_id);
-      const appName = firstPartyName(access.client.id);
       const hosts = requirement.definition.hosts ?? [];
-      const account = yield* context.executor[OAuthGrantImport]
-        .importOAuthGrant({
-          owner,
-          provider: requirement.provider,
-          method,
-          label,
+      return {
+        kind: "grant",
+        requirement,
+        input: {
+          ...base,
           redirectUri: v1OAuthCallback,
           firstParty: access.client.id,
           hosts,
           accessToken,
           refreshToken,
-          ...(plan.row.expires_at === null ? {} : { expiresAt: plan.row.expires_at }),
+          ...expiresAt,
           renewal: access.renewal,
-        })
-        .pipe(
-          creation,
-          Effect.catchTag("OAuthSetupFailed", (error) => fail(oauthSetupReason(error.reason))),
-          Effect.catchTag("AuthMethodInvalid", () =>
-            fail("Its sign-in method is not in the imported app."),
-          ),
-          Effect.catchTag("OAuthGrantNotImportable", (error) =>
-            fail(firstPartyRefusal(appName, access.client, hosts, error)),
-          ),
-        );
-      yield* record(imported("account", account.id));
-      return account.id;
+        },
+        firstParty: { name: firstPartyName(access.client.id), client: access.client, hosts },
+      } satisfies AccountWrite as AccountWrite;
     }
     if (access.kind !== "oauth") {
       // Values from v1's configuration first, then the connection's own from v1's Vault.
@@ -1314,21 +1868,11 @@ const saveAccount = (
       if (access.kind === "secrets")
         for (const [variable, item] of access.items)
           fields[variable] = Redacted.value(yield* secret(item));
-      return yield* context.executor[StorageHost].transaction(
-        Effect.gen(function* () {
-          const account = yield* context.executor.managedAccounts
-            .add({
-              owner,
-              provider: requirement.provider,
-              method,
-              label,
-              fields: Redacted.make(fields),
-            })
-            .pipe(creation);
-          yield* record(imported("account", account.id));
-          return account.id;
-        }),
-      );
+      return {
+        kind: "fields",
+        requirement,
+        input: { ...base, fields: Redacted.make(fields) },
+      } satisfies AccountWrite as AccountWrite;
     }
     const { client, grant } = access;
     const clientSecret =
@@ -1348,33 +1892,275 @@ const saveAccount = (
       grant === "authorization_code" && plan.row.refresh_item_id !== null
         ? yield* secret(plan.row.refresh_item_id)
         : undefined;
-    const account = yield* context.executor[OAuthGrantImport]
-      .importOAuthGrant({
-        owner,
-        provider: requirement.provider,
-        method,
-        label,
+    return {
+      kind: "grant",
+      requirement,
+      input: {
+        ...base,
         ...(grant === "authorization_code"
           ? { redirectUri: client.origin_redirect_uri ?? v1OAuthCallback }
           : {}),
         client: Redacted.make(registration),
         accessToken,
         refreshToken,
-        ...(plan.row.expires_at === null ? {} : { expiresAt: plan.row.expires_at }),
+        ...expiresAt,
         renewal: access.renewal,
-      })
-      .pipe(
-        creation,
-        Effect.catchTag("OAuthSetupFailed", (error) => fail(oauthSetupReason(error.reason))),
-        Effect.catchTag("AuthMethodInvalid", () =>
-          fail("Its sign-in method is not in the imported app."),
-        ),
+      },
+    } satisfies AccountWrite as AccountWrite;
+  });
+
+/** Why v2 refused to save a connection's grant, as the user reads it, for an import and a check. */
+const grantRefusals = (write: Extract<AccountWrite, { kind: "grant" }>) =>
+  Effect.catchTags({
+    OAuthSetupFailed: (error: OAuthSetupFailed) =>
+      Effect.fail(
+        new ItemFailed({
+          reason: oauthSetupReason(error.reason),
+          ...(error.reason === "service_unavailable" || error.reason === "rate_limited"
+            ? { outage: true as const }
+            : {}),
+        }),
+      ),
+    AuthMethodInvalid: () => fail("Its sign-in method is not in the imported app."),
+    OAuthGrantNotImportable: (error: OAuthGrantNotImportable) =>
+      write.firstParty === undefined
+        ? fail("Its sign-in could not be carried over to v2. Reconnect it in v2.")
+        : fail(
+            firstPartyRefusal(
+              write.firstParty.name,
+              write.firstParty.client,
+              write.firstParty.hosts,
+              error,
+            ),
+          ),
+  });
+
+/** Whether a connection's app is public: it takes no account, so the connection needs none. */
+export const needsNoAccount = (plan: ConnectionPlan, accounts: AppAccountRequirements) =>
+  plan.access.kind === "none" && accounts.service === undefined && accounts.workspace === undefined;
+
+/**
+ * Save the connection's account: an org connection's is shared with everyone and created by the
+ * owner, a member's is their own. The map row commits with it.
+ */
+export const importAccount = (
+  context: ItemContext,
+  plan: ConnectionPlan,
+  app: Pick<DeployedApp, "id" | "requirements">,
+  record: (result: MapResult) => Effect.Effect<void, V1ImportUnavailable>,
+  scope: AppScope,
+) =>
+  Effect.gen(function* () {
+    const actor = actorOf(context, plan.row);
+    if (actor === undefined) return yield* fail("Its member is not imported.");
+    return yield* saveAccount(context, plan, app, record, actor, scope).pipe(
+      Effect.provideService(CurrentUserId, actor),
+    );
+  });
+
+const saveAccount = (
+  context: ItemContext,
+  plan: ConnectionPlan,
+  app: Pick<DeployedApp, "id" | "requirements">,
+  record: (result: MapResult) => Effect.Effect<void, V1ImportUnavailable>,
+  actor: string,
+  scope: AppScope,
+) =>
+  Effect.gen(function* () {
+    const creation =
+      plan.row.owner === "org"
+        ? accountDestination({ kind: "shared", audience: { kind: "everyone" } })
+        : personalAccountCreation(actor);
+    const write = yield* accountWrite(
+      context,
+      plan,
+      app.requirements.accounts,
+      organizationOwner(context.target.id),
+      (itemId) => readSecret(context, plan.row, itemId),
+      scope,
+    );
+    if (write.kind === "fields")
+      return yield* context.executor[StorageHost].transaction(
+        Effect.gen(function* () {
+          const account = yield* context.executor.managedAccounts.add(write.input).pipe(creation);
+          yield* record(imported("account", account.id));
+          return account.id;
+        }),
       );
+    const account = yield* context.executor[OAuthGrantImport]
+      .importOAuthGrant(write.input)
+      .pipe(creation, grantRefusals(write));
     // Discovery ran outside a transaction; the account is recorded as soon as it exists.
     yield* record(imported("account", account.id));
     return account.id;
   });
 
+/**
+ * The account of a connection an earlier run imported, given v1's tokens as they are now. An
+ * organization copied before it moved ran in both products, and both renewed the connection's
+ * grant; a service that rotates refresh tokens keeps only the last renewal's. Once the
+ * organization moves, v1 no longer renews, so its tokens are final, and the account takes them
+ * when its own grant needs reconnecting or v1 renewed after it did (`refreshImportedGrant`). A
+ * connection without an authorization-code grant, or whose tokens v1's Vault no longer holds, is
+ * left as it is.
+ */
+export const refreshCopiedGrant = (context: ItemContext, row: ConnectionRow, account: AccountId) =>
+  Effect.gen(function* () {
+    const plan = connectionPlan(context.snapshot, context.firstParty, row);
+    if (!plan.ok) return "kept" as const;
+    const { access } = plan.value;
+    const accessItem =
+      access.kind === "first_party" ||
+      (access.kind === "oauth" && access.grant === "authorization_code")
+        ? access.accessItem
+        : undefined;
+    if (accessItem === undefined || row.refresh_item_id === null) return "kept" as const;
+    const tokens = {
+      accessToken: yield* readSecret(context, row, accessItem),
+      refreshToken: yield* readSecret(context, row, row.refresh_item_id),
+      ...(row.expires_at === null ? {} : { expiresAt: row.expires_at }),
+    };
+    return yield* context.executor[OAuthGrantImport].refreshImportedGrant(account, tokens);
+  }).pipe(Effect.catchTag("ItemFailed", () => Effect.succeed("kept" as const)));
+
+/**
+ * Keep the account of a connection an earlier run imported fitting its app once the app is
+ * generated again. The app declares one provider for every sign-in method its connections use, so
+ * a connection v1 gained or lost since, or a new name, makes it another provider, which the saved
+ * account does not fit. The account moves to it, under the method its connection signs in with
+ * now, when that method is the one it was saved for (`moveImportedAccount`); otherwise it is left
+ * as it is. Returns whether it moved.
+ */
+export const followAppProvider = (
+  context: ItemContext,
+  row: ConnectionRow,
+  accounts: AppAccountRequirements,
+  account: AccountId,
+  scope: AppScope,
+) =>
+  Effect.gen(function* () {
+    const requirement = accounts[connectionRequirement(row)];
+    const plan = connectionPlan(context.snapshot, context.firstParty, row);
+    if (requirement === undefined || !plan.ok) return false;
+    const planned = yield* plannedFor(context, plan.value, scope);
+    const method = planned.methodOf.get(row.row_id);
+    if (method === undefined) return false;
+    return yield* context.executor[OAuthGrantImport].moveImportedAccount({
+      account,
+      provider: requirement.provider,
+      method,
+    });
+  }).pipe(Effect.catchTag("ItemFailed", () => Effect.succeed(false)));
+
+/**
+ * How an earlier run imported an integration: as one app, or as an app per connection (decision
+ * 32), by the connection's row id. An integration imported as one app stays one, and one imported
+ * per connection stays so, on every later run.
+ */
+export const importedApps = (
+  store: Pick<ImportStore, "find">,
+  snapshot: Pick<V1Snapshot, "connections">,
+  integration: Pick<IntegrationRow, "row_id" | "slug">,
+) =>
+  Effect.gen(function* () {
+    const found = yield* store.find("integration", integration.row_id);
+    if (found?.status === "imported" && found.v2_id !== null)
+      return { kind: "one", app: AppId.make(found.v2_id) } as const;
+    const apps = new Map<string, AppId>();
+    for (const connection of snapshot.connections) {
+      if (connection.integration !== integration.slug) continue;
+      const own = yield* store.find("connection_app", connection.row_id);
+      if (own?.status === "imported" && own.v2_id !== null)
+        apps.set(connection.row_id, AppId.make(own.v2_id));
+    }
+    return apps.size > 0 ? ({ kind: "split", apps } as const) : undefined;
+  });
+
+/**
+ * The app an earlier run imported a connection's tools into: its own app, or its integration's
+ * one app, with which (`scope`), or none.
+ */
+export const connectionAppOf = (
+  store: Pick<ImportStore, "find">,
+  snapshot: Pick<V1Snapshot, "connections" | "integrations">,
+  row: ConnectionRow,
+) =>
+  Effect.gen(function* () {
+    const integration = snapshot.integrations.find(
+      (candidate) => candidate.slug === row.integration,
+    );
+    if (integration === undefined) return undefined;
+    const found = yield* importedApps(store, snapshot, integration);
+    const app = found?.kind === "one" ? found.app : found?.apps.get(row.row_id);
+    if (found === undefined || app === undefined) return undefined;
+    const scope: AppScope = found.kind === "one" ? "integration" : "own";
+    return { app, scope, integration };
+  });
+
+/** The app an earlier run imported the connection's tools into, unless its users removed it. */
+const importedAppOf = (context: ItemContext, row: ConnectionRow) =>
+  Effect.gen(function* () {
+    const found = yield* connectionAppOf(context.store, context.snapshot, row);
+    if (found === undefined) return undefined;
+    const app = yield* context.executor.apps
+      .get({ owner: organizationOwner(context.target.id), app: found.app })
+      .pipe(Effect.catchTag("AppNotFound", () => Effect.succeed(undefined)));
+    return app === undefined ? undefined : { app, scope: found.scope };
+  });
+
+/**
+ * Bring the account of a connection an earlier run imported up to date with v1 and its app: it
+ * takes v1's final tokens if they are newer (`refreshCopiedGrant`), and follows its app's provider
+ * (`followAppProvider`).
+ */
+export const updateCopiedAccount = (context: ItemContext, row: ConnectionRow, account: AccountId) =>
+  Effect.gen(function* () {
+    const tokens = yield* refreshCopiedGrant(context, row, account);
+    const found = yield* importedAppOf(context, row);
+    const followed =
+      found !== undefined &&
+      (yield* followAppProvider(
+        context,
+        row,
+        found.app.requirements.accounts,
+        account,
+        found.scope,
+      ));
+    return { tokens, followed };
+  });
+
+/**
+ * Check the connection's account as `importAccount` would save it, against the requirements its
+ * app's build declares, and save nothing: the dry run's check that every account moves. Its
+ * refusals are the import's, with the same reasons. `secret` reads what the import would read
+ * from v1's Vault, such as the values the dry run has already read.
+ */
+export const checkAccount = (
+  context: Pick<ItemContext, "executor" | "source" | "firstParty"> & {
+    readonly snapshot: ConnectionSnapshot;
+    /** Names the check in its errors; nothing is saved under it. */
+    readonly owner: OwnerId;
+  },
+  plan: ConnectionPlan,
+  accounts: AppAccountRequirements,
+  secret: SecretReader,
+  scope: AppScope,
+) =>
+  Effect.gen(function* () {
+    const write = yield* accountWrite(context, plan, accounts, context.owner, secret, scope);
+    const host = context.executor[OAuthGrantImport];
+    if (write.kind === "fields")
+      return yield* host.checkAccountFields({
+        provider: write.input.provider,
+        definition: write.requirement.definition,
+        method: write.input.method,
+        fields: write.input.fields,
+      });
+    return yield* host
+      .checkOAuthGrant({ ...write.input, definition: write.requirement.definition })
+      .pipe(grantRefusals(write));
+  });
+
 /**
  * Link the connection's account to its app as linking it in v2 does: an org connection's to the
  * app's `workspace` requirement for everyone, by the owner; a member's to its `service`
@@ -1410,13 +2196,22 @@ export const linkConnectionAccount = (
 
 type RunTarget = ConnectionApp["runsAs"][number];
 
+/** How an earlier item request imported an integration: one app, or an app per connection. */
+export type ImportedIntegration =
+  | { readonly kind: "one"; readonly id: string }
+  | { readonly kind: "split" };
+
 /**
- * What an earlier item request imported: an integration's app, and a connection's account and the
- * target its tools run as (its linked account, or the app itself for a public app).
+ * What an earlier item request imported: an integration's app, or for an integration imported as
+ * an app per connection (decision 33) each connection's own app, and a connection's account and
+ * the target its tools run as (its linked account, or the app itself for a public app).
  */
 export interface ImportedLookup {
   readonly app: (
     integration: IntegrationRow,
+  ) => Effect.Effect<ImportedIntegration | undefined, V1ImportUnavailable>;
+  readonly connectionApp: (
+    connection: ConnectionRow,
   ) => Effect.Effect<string | undefined, V1ImportUnavailable>;
   readonly connection: (
     connection: ConnectionRow,
@@ -1445,10 +2240,23 @@ export const connectionTarget = (
  * from before profiles were removed, the profile, which the item's result replaces with that
  * account.
  */
-export const mapLookup = (store: ImportStore): ImportedLookup => ({
+export const mapLookup = (
+  store: ImportStore,
+  snapshot: Pick<V1Snapshot, "connections">,
+): ImportedLookup => ({
   app: (integration) =>
+    importedApps(store, snapshot, integration).pipe(
+      Effect.map((found): ImportedIntegration | undefined =>
+        found === undefined
+          ? undefined
+          : found.kind === "one"
+            ? { kind: "one", id: found.app }
+            : { kind: "split" },
+      ),
+    ),
+  connectionApp: (connection) =>
     store
-      .find("integration", integration.row_id)
+      .find("connection_app", connection.row_id)
       .pipe(
         Effect.map((found) =>
           found?.status === "imported" && found.v2_id !== null ? found.v2_id : undefined,
@@ -1478,7 +2286,8 @@ const plural = (count: number, one: string, many: string) => `${count} ${count =
  * served through it (`selected`, by the app's names) and what the connections it granted run as:
  * the app itself for an org connection or a public app's, and a member's own account for theirs. v2 selects an app's tools and accounts
  * separately, so a tool v1 granted for only some of those connections becomes available through
- * all of them; the note says so.
+ * all of them; the note says so. An integration imported as an app per connection (decision 33)
+ * gives each connection's app the tools granted through that connection, under its own rules.
  *
  * Each member gets their own copy (decision 11), which reaches org connections and, for the
  * member's own toolkit, their own connections; never another member's.
@@ -1493,30 +2302,33 @@ export const toolkitPolicy = (
     const { snapshot, source } = context;
     const apps: ConnectionApp[] = [];
     const notes: string[] = [];
-    const missingApps: string[] = [];
+    const missingApps = new Set<string>();
     const missingConnections = new Set<string>();
     const blockedElsewhere = new Set<string>();
-    const widened: string[] = [];
+    const widened = new Set<string>();
     const visible = visibleTo(member);
     const reached = toolkitConnections(snapshot, toolkit).filter(visible);
     for (const integration of snapshot.integrations) {
       if (!reached.some((connection) => connection.integration === integration.slug)) continue;
-      const appId = yield* lookup.app(integration);
+      const imported = yield* lookup.app(integration);
       const label = integrationLabel(integration);
-      if (appId === undefined) {
-        missingApps.push(label);
+      if (imported === undefined) {
+        missingApps.add(label);
         continue;
       }
       // Approvals are the app's, for every member, so they read every member's tools.
       const all = yield* source.tools(snapshot.tenant, snapshot.subjects, integration.slug);
       const aliases = integration.plugin_id === "mcp" ? mcpNaming(all).aliases : {};
-      const omitted = new Set(
-        approvalRules(toolActions(snapshot, integration, all, aliases)).omitted,
-      );
+      const omittedOf = (tools: readonly ToolRow[]) =>
+        new Set(approvalRules(toolActions(snapshot, integration, tools, aliases)).omitted);
+      const integrationOmitted = imported.kind === "one" ? omittedOf(all) : undefined;
+      const ownOmitted = new Map<string, ReadonlySet<string>>();
       const tools = all.filter(visible);
-      const names = new Set<string>();
-      const granted = new Map<string, ConnectionRow>();
-      const pairs = new Set<string>();
+      // The tools granted through each app, the connections granted, and which tool through which.
+      const byApp = new Map<
+        string,
+        { names: Set<string>; granted: Map<string, ConnectionRow>; pairs: Set<string> }
+      >();
       for (const tool of tools) {
         const action = toolkitAction(
           toolkit,
@@ -1526,10 +2338,6 @@ export const toolkitPolicy = (
         const name = Object.hasOwn(aliases, tool.name)
           ? (aliases[tool.name] ?? tool.name)
           : tool.name;
-        if (omitted.has(name)) {
-          blockedElsewhere.add(`${label} ${name}`);
-          continue;
-        }
         const connection = snapshot.connections.find(
           (candidate) =>
             candidate.integration === integration.slug &&
@@ -1537,29 +2345,53 @@ export const toolkitPolicy = (
             candidate.subject === tool.subject &&
             candidate.name === tool.connection,
         );
+        // A connection's own app leaves out what v1's rules blocked for it alone.
+        let omitted: ReadonlySet<string> | undefined = integrationOmitted;
+        if (omitted === undefined && connection !== undefined) {
+          omitted = ownOmitted.get(connection.row_id) ?? omittedOf(listedAs(connection, all));
+          ownOmitted.set(connection.row_id, omitted);
+        }
+        if (omitted?.has(name) === true) {
+          blockedElsewhere.add(`${label} ${name}`);
+          continue;
+        }
         if (connection === undefined) continue;
-        names.add(name);
-        granted.set(connection.row_id, connection);
-        pairs.add(`${connection.row_id} ${name}`);
+        const appId =
+          imported.kind === "one" ? imported.id : yield* lookup.connectionApp(connection);
+        if (appId === undefined) {
+          missingApps.add(connectionAppName(snapshot, integration, connection));
+          continue;
+        }
+        const entry = byApp.get(appId) ?? {
+          names: new Set<string>(),
+          granted: new Map<string, ConnectionRow>(),
+          pairs: new Set<string>(),
+        };
+        byApp.set(appId, entry);
+        entry.names.add(name);
+        entry.granted.set(connection.row_id, connection);
+        entry.pairs.add(`${connection.row_id} ${name}`);
       }
-      if (names.size === 0) continue;
-      const targets: RunTarget[] = [];
-      for (const connection of granted.values()) {
-        const target = (yield* lookup.connection(connection))?.target;
-        if (target === undefined) missingConnections.add(`${label} ${connection.name}`);
-        else if (!targets.some((other) => sameTarget(other, target))) targets.push(target);
+      for (const [appId, { names, granted, pairs }] of byApp) {
+        const targets: RunTarget[] = [];
+        for (const connection of granted.values()) {
+          const target = (yield* lookup.connection(connection))?.target;
+          if (target === undefined) missingConnections.add(`${label} ${connection.name}`);
+          else if (!targets.some((other) => sameTarget(other, target))) targets.push(target);
+        }
+        const [first, ...rest] = targets;
+        if (first === undefined) continue;
+        if (names.size * granted.size > pairs.size) widened.add(label);
+        apps.push({
+          app: AppId.make(appId),
+          runsAs: [first, ...rest],
+          tools: { kind: "selected", names: [...names].sort().map((name) => ToolName.make(name)) },
+        });
       }
-      const [first, ...rest] = targets;
-      if (first === undefined) continue;
-      if (names.size * granted.size > pairs.size) widened.push(label);
-      apps.push({
-        app: AppId.make(appId),
-        runsAs: [first, ...rest],
-        tools: { kind: "selected", names: [...names].sort().map((name) => ToolName.make(name)) },
-      });
     }
     if (reached.length === 0) notes.push(grantsNoConnection);
-    if (missingApps.length > 0) notes.push(`Not imported, so left out: ${missingApps.join(", ")}.`);
+    if (missingApps.size > 0)
+      notes.push(`Not imported, so left out: ${[...missingApps].join(", ")}.`);
     if (missingConnections.size > 0)
       notes.push(
         `${plural(missingConnections.size, "connection was", "connections were")} not imported and ${missingConnections.size === 1 ? "is" : "are"} left out: ${[...missingConnections].join(", ")}.`,
@@ -1568,9 +2400,9 @@ export const toolkitPolicy = (
       notes.push(
         `${plural(blockedElsewhere.size, "tool", "tools")} v1 allowed only through this toolkit ${blockedElsewhere.size === 1 ? "is" : "are"} blocked in the workspace, so ${blockedElsewhere.size === 1 ? "it is" : "they are"} left out: ${[...blockedElsewhere].sort().join(", ")}.`,
       );
-    if (widened.length > 0)
+    if (widened.size > 0)
       notes.push(
-        `v2 grants an app's selected tools through every selected account, so some tools are now available through more accounts of ${widened.join(", ")} than in v1.`,
+        `v2 grants an app's selected tools through every selected account, so some tools are now available through more accounts of ${[...widened].join(", ")} than in v1.`,
       );
     if (toolkit.access.some((pattern) => pattern.split(".")[0] === "executor"))
       notes.push("It granted v1's built-in tools, which v2 does not have.");
@@ -1582,8 +2414,8 @@ export const toolkitPolicy = (
  * updates it.
  */
 export const toolkitConnectionId = (organization: string, toolkit: V1Toolkit, member: string) =>
-  sourceHash([organization, toolkit.row.row_id, member]).pipe(
-    Effect.map((hash) => ConnectionId.make(`v1-${hash.slice(0, 40)}`)),
+  toolkitCopyConnectionId(organization, toolkit.row.row_id, member).pipe(
+    Effect.map((id) => ConnectionId.make(id)),
   );
 
 /** The members who get a copy of a toolkit: everyone for an org toolkit, else its owner. */
@@ -1596,19 +2428,31 @@ export const toolkitMembers = (toolkit: V1Toolkit, members: readonly string[]) =
 export const toolkitCopyKey = (toolkit: Pick<V1Toolkit, "row">, member: string) =>
   toolkitCopyId(toolkit.row.row_id, member);
 
-/** Create or update a member's copy of the toolkit: a scoped MCP connection they own. */
-export const importToolkit = (context: ItemContext, toolkit: V1Toolkit, member: string) =>
+/**
+ * Create or update a member's copy of the toolkit: a scoped MCP connection they own. `copy` is the
+ * connection the import map already records for it, which for a copy the opt-in import made is not
+ * the id an import gives a copy now.
+ */
+export const importToolkit = (
+  context: ItemContext,
+  toolkit: V1Toolkit,
+  member: string,
+  copy?: string,
+) =>
   Effect.gen(function* () {
     const user = context.users.get(member);
     if (user === undefined) return yield* fail("Its member is not imported.");
     const { policy, notes } = yield* toolkitPolicy(
       context,
-      mapLookup(context.store),
+      mapLookup(context.store, context.snapshot),
       toolkit,
       member,
     );
     const owner = { userId: user, resource: context.target.id };
-    const id = yield* toolkitConnectionId(context.target.id, toolkit, member);
+    const id =
+      copy === undefined
+        ? yield* toolkitConnectionId(context.target.id, toolkit, member)
+        : ConnectionId.make(copy);
     const name = (toolkit.data.name.trim() === "" ? toolkit.data.slug : toolkit.data.name).slice(
       0,
       80,
@@ -1638,7 +2482,14 @@ export interface ArtifactRoleMapping {
   readonly problem: string | null;
 }
 
-/** Each role's imported app and linked account, read from the import map. */
+/** Why a role v1 left unbound maps to no app of an integration imported per connection. */
+const unboundSplit =
+  "v1 bound no connection to it, and its integration became an app per connection.";
+
+/**
+ * Each role's imported app and linked account, read from the import map. A role of an integration
+ * imported as an app per connection (decision 33) maps to its bound connection's own app.
+ */
 export const artifactMapping = (
   snapshot: Pick<V1Snapshot, "integrations" | "connections">,
   lookup: ImportedLookup,
@@ -1661,9 +2512,28 @@ export const artifactMapping = (
         });
         if (integration === undefined)
           return mapping({ problem: "Its integration no longer exists in v1." });
-        const appId = yield* lookup.app(integration);
-        if (appId === undefined) return mapping({ problem: "Its integration was not imported." });
-        const app = { id: appId, name: integrationLabel(integration) };
+        const found = yield* lookup.app(integration);
+        if (found === undefined) return mapping({ problem: "Its integration was not imported." });
+        if (found.kind === "split") {
+          if (use.binding === undefined) return mapping({ problem: unboundSplit });
+          if (connection === undefined)
+            return mapping({ problem: "Its connection no longer exists in v1." });
+        }
+        const appId =
+          found.kind === "one"
+            ? found.id
+            : connection === undefined
+              ? undefined
+              : yield* lookup.connectionApp(connection);
+        if (appId === undefined)
+          return mapping({ problem: "Its connection's app was not imported." });
+        const app = {
+          id: appId,
+          name:
+            found.kind === "one" || connection === undefined
+              ? integrationLabel(integration)
+              : connectionAppName(snapshot, integration, connection),
+        };
         if (use.binding === undefined)
           return mapping({ app, problem: "v1 bound no connection to it." });
         if (connection === undefined)
diff --git a/apps/hosted/cloud/src/implementation/v1-import/members.ts b/apps/hosted/cloud/src/implementation/v1-import/members.ts
index 3e1f6c4bfc..b5b490fa23 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/members.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/members.ts
@@ -92,12 +92,23 @@ export type V1Billing =
   | { readonly kind: "free" }
   /** Enterprise orgs move by hand, after their v2 SSO is set up (decision 15). */
   | { readonly kind: "enterprise"; readonly plans: readonly string[] }
+  /**
+   * v1's grandfathered Hobby and Professional plans, which no Stripe subscription bills. The
+   * organization moves to v2's Free plan, as a free one does, with nothing to carry over.
+   */
+  | { readonly kind: "grandfathered"; readonly plans: readonly string[] }
   | { readonly kind: "paid"; readonly plans: readonly string[] };
 
 const enterprisePlan = (plan: string) => plan === "enterprise" || plan.startsWith("enterprise-");
 
+/** v1 plans that move to v2's Free plan (decision 30). */
+export const grandfatheredPlans: ReadonlyArray<string> = ["hobby", "professional"];
+
 export const v1Billing = (plans: readonly string[]): V1Billing => {
   if (plans.some(enterprisePlan)) return { kind: "enterprise", plans };
   const paid = plans.filter((plan) => !freePlans.includes(plan));
-  return paid.length === 0 ? { kind: "free" } : { kind: "paid", plans: paid };
+  if (paid.length === 0) return { kind: "free" };
+  return paid.every((plan) => grandfatheredPlans.includes(plan))
+    ? { kind: "grandfathered", plans: paid }
+    : { kind: "paid", plans: paid };
 };
diff --git a/apps/hosted/cloud/src/implementation/v1-import/openapi.ts b/apps/hosted/cloud/src/implementation/v1-import/openapi.ts
index 3304c6c1ca..6be74c7eff 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/openapi.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/openapi.ts
@@ -9,6 +9,7 @@ import { JSON_SCHEMA, YAMLException, load as loadYaml } from "js-yaml";
 import { isLoopbackHostname } from "@executor-js/utils/url-policy";
 import type { V1StaleCategory } from "../../contracts/v1-import-run.ts";
 import type { OpenApiConfig, OpenApiOperationRow } from "./formats.ts";
+import { Entries, mapEntries, noEntries, parserReason } from "./stored-document.ts";
 
 type Json = Record<string, unknown>;
 const isObject = (value: unknown): value is Json =>
@@ -16,20 +17,25 @@ const isObject = (value: unknown): value is Json =>
 
 const methods = ["get", "put", "post", "delete", "patch", "head", "options", "trace"] as const;
 
-/** A stored specification as an object, or why it is not one, without any of its text. */
+/**
+ * A stored specification as an object, the URL v1 stored in its place, or why it is neither,
+ * without any of its text.
+ */
 export type ParsedSpec =
   | { readonly ok: true; readonly document: Json }
+  | { readonly ok: "url"; readonly url: string }
   | { readonly ok: false; readonly reason: string };
 
+/** A specification v1 stored only as its URL, which v1 fetched when the integration was added. */
+const specificationUrl = (value: unknown) => {
+  if (typeof value !== "string") return undefined;
+  const url = value.trim();
+  return /^https?:\/\//iu.test(url) && URL.canParse(url) ? url : undefined;
+};
+
 const kindOf = (value: unknown) =>
   value === null ? "null" : Array.isArray(value) ? "a list" : `a ${typeof value}`;
 
-/**
- * The parser's reason up to the first quoted name, tag or value it carries, so a failure names the
- * kind of error and never the specification's text.
- */
-const parserReason = (reason: string) => reason.split(/[:"'`!<]/)[0]?.trim() ?? "";
-
 const utf8 = new TextDecoder("utf-8", { fatal: true });
 const lossyUtf8 = new TextDecoder("utf-8");
 
@@ -64,9 +70,12 @@ export const parseSpec = (bytes: Uint8Array): ParsedSpec => {
   // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the YAML parser throws on input it cannot read
   try {
     const yaml = loadYaml(text, { schema: JSON_SCHEMA, json: true });
+    const url = specificationUrl(yaml);
     return isObject(yaml)
       ? { ok: true, document: yaml }
-      : unreadable(`it is ${kindOf(yaml)}, not an object`);
+      : url !== undefined
+        ? { ok: "url", url }
+        : unreadable(`it is ${kindOf(yaml)}, not an object`);
   } catch (error) {
     if (!(error instanceof YAMLException))
       return unreadable(
@@ -276,29 +285,44 @@ export const plainHttpHosts = (origins: readonly string[]) =>
     return url.protocol === "https:" || isLoopbackHostname(url.hostname) ? [] : [url.host];
   });
 
-/** Every `#/components/...` reference reachable from a value. */
+/**
+ * The component each `#/components/<section>/<name>` reference reachable from a value names, as
+ * `[section, name]` in JSON. A reference's tokens are read as the compiler reads them: percent
+ * decoded, then unescaped, so `#/components/schemas/Paper%20Input` names `Paper Input`.
+ */
 const references = (value: unknown, found: Set<string>) => {
   if (Array.isArray(value)) for (const item of value) references(item, found);
   else if (isObject(value))
     for (const [key, item] of Object.entries(value))
-      if (key === "$ref" && typeof item === "string" && item.startsWith("#/components/"))
-        found.add(item);
-      else references(item, found);
+      if (key === "$ref" && typeof item === "string" && item.startsWith("#/components/")) {
+        const [section, name] = item
+          .slice("#/components/".length)
+          .split("/")
+          .map((token) => unescape(safeDecode(token)));
+        if (section !== undefined && name !== undefined) found.add(JSON.stringify([section, name]));
+      } else references(item, found);
 };
 const unescape = (token: string) => token.replaceAll("~1", "/").replaceAll("~0", "~");
 
-/** Keep only components the rest of the document reaches, directly or through other components. */
+/**
+ * Keep only components the rest of the document reaches, directly or through other components.
+ * The components can be the stored document's, read entry by entry, so that only those the rest
+ * reaches are parsed.
+ */
 const pruneComponents = (document: Json) => {
-  const components = isObject(document.components) ? document.components : undefined;
+  const components = mapEntries(document.components);
   if (components === undefined) return document;
   const reached = new Set<string>();
   const { components: _components, ...rest } = document;
   references(rest, reached);
+  const targets = new Map<string, unknown>();
   const queue = [...reached];
   for (let next = queue.pop(); next !== undefined; next = queue.pop()) {
-    const [section, name] = next.slice("#/components/".length).split("/").map(unescape);
-    const sectionValue = section === undefined ? undefined : components[section];
-    const target = isObject(sectionValue) && name !== undefined ? sectionValue[name] : undefined;
+    const [section, name] = Schema.decodeUnknownSync(Schema.Tuple([Schema.String, Schema.String]))(
+      JSON.parse(next),
+    );
+    const target = child(components.get(section), name);
+    targets.set(next, target);
     const more = new Set<string>();
     references(target, more);
     for (const reference of more)
@@ -308,17 +332,56 @@ const pruneComponents = (document: Json) => {
       }
   }
   const kept: Json = {};
-  for (const [section, entries] of Object.entries(components)) {
-    if (section === "securitySchemes" || !isObject(entries)) continue;
-    const names = Object.keys(entries).filter((name) =>
-      reached.has(`#/components/${section}/${name.replaceAll("~", "~0").replaceAll("/", "~1")}`),
-    );
+  for (const section of components.keys) {
+    const entries = mapEntries(components.get(section));
+    if (section === "securitySchemes" || entries === undefined) continue;
+    const names = entries.keys.filter((name) => reached.has(JSON.stringify([section, name])));
     if (names.length > 0)
-      kept[section] = Object.fromEntries(names.map((name) => [name, entries[name]]));
+      kept[section] = Object.fromEntries(
+        names.map((name) => [name, targets.get(JSON.stringify([section, name]))]),
+      );
   }
   return { ...document, components: kept };
 };
 
+/** A map's own value at a key, whether the map is read entry by entry or parsed. */
+const child = (node: unknown, key: string) =>
+  node instanceof Entries
+    ? node.get(key)
+    : isObject(node) && Object.hasOwn(node, key)
+      ? node[key]
+      : undefined;
+
+/**
+ * The object a local reference reaches, following references it reaches in turn, or the value
+ * itself when it is no reference. An operation can be a reference, which the compiler follows: the
+ * cut keeps the operation it reaches, so its security is removed like any other's. A reference
+ * that does not resolve, or a cycle, reaches nothing, and neither does one to a whole map the
+ * document is read through entry by entry, such as `#/paths`, which is no operation.
+ */
+const localTarget = (document: Entries, value: unknown): unknown => {
+  const seen = new Set<string>();
+  let current = value;
+  while (isObject(current) && typeof current.$ref === "string") {
+    const ref = current.$ref;
+    if (seen.has(ref) || !ref.startsWith("#/")) return undefined;
+    seen.add(ref);
+    let node: unknown = document;
+    for (const token of ref.slice(2).split("/").map(unescape))
+      node = child(node, safeDecode(token));
+    current = node instanceof Entries ? undefined : node;
+  }
+  return current;
+};
+const safeDecode = (token: string) => {
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: decodeURIComponent throws on a malformed escape, which is then read literally
+  try {
+    return decodeURIComponent(token);
+  } catch {
+    return token;
+  }
+};
+
 /**
  * The document cut to v1's operations, and v1's tool name for each kept operation by method and
  * document path. An operation matches by method and path template (v1's resolved template when
@@ -327,40 +390,56 @@ const pruneComponents = (document: Json) => {
  * no row matches is kept under the name in `compiled` (by method and document path), for the tools
  * v1 bound by compiling the document because it stored no binding for them. TRACE operations are
  * left out, as v2 sends no TRACE requests, and their v1 tools are returned as `traced` (decision 16).
+ * The stored document is read entry by entry: each path item once, and the components the cut
+ * reaches.
  */
 export const importedDocument = (
-  document: Json,
+  document: Entries,
   operations: readonly OpenApiOperationRow[],
   compiled: ReadonlyMap<string, string>,
 ) => {
   const named = new Map<string, string>();
   const traced = new Set<string>();
   const paths: Record<string, Json> = {};
-  const source = isObject(document.paths) ? document.paths : {};
-  // The tool paths operations name for themselves: a row one of them claims is not another's.
+  const source = mapEntries(document.get("paths")) ?? noEntries;
+  const rows = new Map<string, OpenApiOperationRow[]>();
+  for (const row of operations) {
+    const key = `${row.method.toLowerCase()} ${row.path}`;
+    const same = rows.get(key);
+    if (same === undefined) rows.set(key, [row]);
+    else same.push(row);
+  }
+  const templateOf = (operation: Json, path: string) =>
+    typeof operation["x-executor-pathTemplate"] === "string"
+      ? operation["x-executor-pathTemplate"]
+      : path;
+  // The tool paths operations name for themselves: a row one of them claims is not another's. The
+  // path items with an operation a row or `compiled` names are the only ones the cut keeps from.
   const claimed = new Set<string>();
-  for (const item of Object.values(source))
-    if (isObject(item))
-      for (const method of methods) {
-        const operation = item[method];
-        if (isObject(operation) && typeof operation["x-executor-toolPath"] === "string")
-          claimed.add(operation["x-executor-toolPath"]);
-      }
-  for (const [path, item] of Object.entries(source)) {
+  const bound: Array<readonly [string, Json]> = [];
+  for (const path of source.keys) {
+    const item = source.get(path);
     if (!isObject(item)) continue;
+    let wanted = false;
+    for (const method of methods) {
+      const operation = localTarget(document, item[method]);
+      if (!isObject(operation)) continue;
+      if (typeof operation["x-executor-toolPath"] === "string")
+        claimed.add(operation["x-executor-toolPath"]);
+      wanted ||=
+        rows.has(`${method} ${templateOf(operation, path)}`) || compiled.has(`${method} ${path}`);
+    }
+    if (wanted) bound.push([path, item]);
+  }
+  for (const [path, item] of bound) {
     const shared: Json = {};
     for (const [key, value] of Object.entries(item))
       if (!(methods as readonly string[]).includes(key)) shared[key] = value;
     for (const method of methods) {
-      const operation = item[method];
+      const operation = localTarget(document, item[method]);
       if (!isObject(operation)) continue;
-      const template =
-        typeof operation["x-executor-pathTemplate"] === "string"
-          ? operation["x-executor-pathTemplate"]
-          : path;
-      const candidates = operations.filter(
-        (row) => row.method.toLowerCase() === method && row.path === template,
-      );
+      const template = templateOf(operation, path);
+      const candidates = rows.get(`${method} ${template}`) ?? [];
       // The row of the operation's own tool path, or the only row of its method and template
       // unless another operation names that row's tool as its own: v1 merged documents whose
       // operations share a template, such as Calendar's and Drive's `POST /channels/stop`.
@@ -387,46 +466,10 @@ export const importedDocument = (
     }
   }
   // Webhooks are requests the API sends, never tools v1 exposed.
-  const { security: _security, webhooks: _webhooks, ...rest } = document;
-  return { document: pruneComponents({ ...rest, paths }), named, traced: [...traced].sort() };
-};
-
-const OperationNaming = Schema.Struct({
-  operationId: Schema.optional(Schema.String),
-  tags: Schema.optional(Schema.Array(Schema.Unknown)),
-});
-
-/**
- * Each operation of the imported document as v2's name planner reads it (operationId, first
- * non-empty tag, method and path, in document order), with v1's name for it.
- */
-export const documentOperations = (prepared: {
-  readonly document: Json;
-  readonly named: ReadonlyMap<string, string>;
-}) => {
-  const paths = isObject(prepared.document.paths) ? prepared.document.paths : {};
-  return Object.entries(paths).flatMap(([path, item]) =>
-    isObject(item)
-      ? methods.flatMap((method) => {
-          const operation = item[method];
-          if (!isObject(operation)) return [];
-          const naming = Option.getOrUndefined(
-            Schema.decodeUnknownOption(OperationNaming)(operation),
-          );
-          const tag = naming?.tags?.find(
-            (candidate): candidate is string =>
-              typeof candidate === "string" && candidate.trim() !== "",
-          );
-          return [
-            {
-              operationId: naming?.operationId,
-              tag,
-              method: method.toUpperCase(),
-              path,
-              v1: prepared.named.get(`${method} ${path}`),
-            },
-          ];
-        })
-      : [],
+  const rest = Object.fromEntries(
+    document.keys
+      .filter((key) => key !== "security" && key !== "webhooks")
+      .map((key) => [key, document.get(key)]),
   );
+  return { document: pruneComponents({ ...rest, paths }), named, traced: [...traced].sort() };
 };
diff --git a/apps/hosted/cloud/src/implementation/v1-import/repair.ts b/apps/hosted/cloud/src/implementation/v1-import/repair.ts
new file mode 100644
index 0000000000..e810925188
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-import/repair.ts
@@ -0,0 +1,817 @@
+/**
+ * The one-off repair of organizations moved before the importer took v1's approval stamps and
+ * decided the tools v1 did not list (`notes/v1-import.md`, "Repair of moved organizations"). It
+ * changes what those fixes change and nothing else, with the importer's own code, so a repaired
+ * app holds what an import makes now: an MCP tool whose row v1 stamped as needing approval, and
+ * that no policy decided, gets the app's own `always` rule (`toolActions`), and a tool v1 did not
+ * list gets what v1's rules give it (`v1ToolRules`). The app's source
+ * is generated again, as the importer generates it, and a new version is deployed through the
+ * importer's own deploy call. A file the fixes change is replaced only when the deployed one is
+ * still an importer's output: the importer's now, before each fix, or a version the import
+ * deployed itself.
+ *
+ * An app its users changed in v2 keeps their code. Where they left its approvals as an importer
+ * wrote them, its new version adds v1's approvals beneath it (`v1-approvals.ts`), so no tool asks
+ * less than v1 did. Where they changed its approvals, their choice stands and the app is left as it
+ * is (`approvalsChanged`).
+ *
+ * Without `apply` it reports what it would change and writes nothing.
+ */
+import { CurrentUserId, HostedExecutor, organizationOwner } from "@executor-js/hosted-server";
+import { sharedAppCreation } from "@executor-js/hosted-server/resource-lifecycle";
+import {
+  AppId,
+  isTextFile,
+  scopeGeneratedPackage,
+  VersionId,
+  type SourceFile,
+} from "@executor-js/sdk/core";
+import { Effect, Option, Schema } from "effect";
+import type { SqlClient } from "effect/sql";
+import { V1ImportDatabase, V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import type { IntegrationRow, ToolRow } from "./formats.ts";
+import {
+  appMethods,
+  approvalRules,
+  generate,
+  mcpNaming,
+  redundantFixed,
+  toolActions,
+  v1ToolDecisions,
+  v1ToolRules,
+  type ItemContext,
+} from "./items.ts";
+import { integrationLabel, integrationPlan } from "./plan.ts";
+import { V1ImportEnvironment, firstPartyClients } from "./run.ts";
+import { allSnapshotTables, type V1Snapshot, type V1Source } from "./source.ts";
+import { makeImportStore, type ImportStore } from "./store.ts";
+
+/** An imported member: their WorkOS user, v2 user and role in the v2 organization. */
+const Member = Schema.Struct({ v1: Schema.String, v2: Schema.String, role: Schema.String });
+
+/** Tool rows as the earlier importer read them: without v1's approval stamp. */
+export const unstamped = (tools: readonly ToolRow[]): readonly ToolRow[] =>
+  tools.map((tool) => ({ ...tool, requires_approval: false }));
+
+/**
+ * The tools of an integration's app that the stamp fix makes ask always: the app's `always`
+ * rules with v1's stamps, less those it had without them. Only MCP tools change.
+ */
+export const stampedAlways = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+) => {
+  const aliases = integration.plugin_id === "mcp" ? mcpNaming(tools).aliases : {};
+  const now = approvalRules(toolActions(snapshot, integration, tools, aliases)).approvals;
+  const before = approvalRules(
+    toolActions(snapshot, integration, unstamped(tools), aliases),
+  ).approvals;
+  return Object.keys(now)
+    .filter((name) => now[name] === "always" && before[name] !== "always")
+    .sort();
+};
+
+/**
+ * What deciding the tools v1 did not list changes in an app, beside the stamps: the tools v1's
+ * rules name, or for OpenAPI the operations v1 compiled (`operations`), that it now leaves out or
+ * asks before, and what a tool no rule names gets on a server that lists tools as it runs. Null
+ * when nothing changes.
+ */
+export const unlistedChange = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+  operations?: readonly string[],
+) => {
+  const aliases = integration.plugin_id === "mcp" ? mcpNaming(tools).aliases : {};
+  const before = approvalRules(toolActions(snapshot, integration, tools, aliases));
+  const now = v1ToolRules(snapshot, integration, tools, aliases, operations);
+  const change = {
+    omitted: (now.omitted ?? []).filter((name) => !before.omitted.includes(name)).sort(),
+    always: Object.keys(now.approvals ?? {})
+      .filter((name) => now.approvals?.[name] === "always" && before.approvals[name] !== "always")
+      .sort(),
+    otherwise: now.otherwise?.rule ?? null,
+  };
+  return change.omitted.length === 0 && change.always.length === 0 && change.otherwise === null
+    ? null
+    : change;
+};
+
+/**
+ * What v1 did with an app's tools, by the names the app exposes: the least each may ask in v2.
+ * `known` is every name v1's rules decide; on a server that lists tools as it runs, another tool
+ * gets what v1's rules give a name they do not spell out (`otherwise`).
+ */
+export interface V1Floor {
+  readonly plugin: string;
+  readonly blocked: readonly string[];
+  readonly asked: readonly string[];
+  readonly allowed: readonly string[];
+  readonly known: readonly string[];
+  readonly otherwise: "block" | "require_approval" | "default";
+}
+
+/** An integration's v1 floor, from the rules the importer writes (`v1ToolDecisions`). */
+export const v1Floor = (
+  snapshot: V1Snapshot,
+  integration: IntegrationRow,
+  tools: readonly ToolRow[],
+  operations?: readonly string[],
+): V1Floor => {
+  const aliases = integration.plugin_id === "mcp" ? mcpNaming(tools).aliases : {};
+  const { actions, unnamed } = v1ToolDecisions(snapshot, integration, tools, aliases, operations);
+  const named = (action: string) =>
+    [...actions]
+      .filter(([, decided]) => decided === action)
+      .map(([name]) => name)
+      .sort();
+  return {
+    plugin: integration.plugin_id,
+    blocked: named("block"),
+    asked: named("require_approval"),
+    allowed: named("approve"),
+    known: [...actions.keys()].sort(),
+    otherwise: unnamed === "block" || unnamed === "require_approval" ? unnamed : "default",
+  };
+};
+
+/** The file of v1's approvals beneath an app changed in v2. */
+export const floorPath = "v1-approvals.ts";
+
+/**
+ * Where v1's approvals go in an app changed in v2: into the `withApprovals` its own code chooses
+ * approvals with, so each tool gets one approval, the stricter of the two; or, when its code calls
+ * no `withApprovals`, over every tool its `defineApp` defines.
+ */
+export type FloorPlace = "withApprovals" | "defineApp";
+
+/**
+ * `v1-approvals.ts`: `withApprovals` or `defineApp` from `apps`, with v1's approvals beneath the
+ * app's own. A tool v1 blocked is refused, one v1 asked before asks, and one v1 ran without asking
+ * is left to the app. Any other tool gets v1's default: on MCP, what v1 stamped a tool the server
+ * marks destructive with, or what v1's catch-all rule gives it; on OpenAPI and GraphQL, asking
+ * before a mutation, as v1 did. Combined with the app's own approval, the stricter one decides.
+ */
+export const floorFile = (floor: V1Floor, place: FloorPlace) => {
+  const mcp = floor.plugin === "mcp";
+  const fallback = mcp
+    ? "toolAnnotations(tool)?.destructiveHint === true ? always() : undefined"
+    : 'tool.kind === "mutation" ? always() : undefined';
+  const other =
+    floor.otherwise === "block"
+      ? "refused"
+      : floor.otherwise === "require_approval"
+        ? "always()"
+        : fallback;
+  const set = (values: readonly string[]) => `new Set<string>(${JSON.stringify(values, null, 2)})`;
+  const imports = [
+    ...(place === "defineApp" ? ["defineApp as appsDefineApp"] : []),
+    ...(mcp ? ["toolAnnotations"] : []),
+    "withApprovals as appsWithApprovals",
+  ];
+  const exported =
+    place === "withApprovals"
+      ? `const rank = { approved: 0, "user-approval": 1, denied: 2 } as const
+
+/** The stricter of two approvals; undefined keeps the tool's own. */
+const stricter = (first: Approval | undefined, second: Approval | undefined): Approval | undefined =>
+  first === undefined
+    ? second
+    : second === undefined
+      ? first
+      : async (context) => {
+          const [one, two] = await Promise.all([first(context), second(context)])
+          return rank[one] >= rank[two] ? one : two
+        }
+
+/** withApprovals from apps, with v1's approvals beneath the app's own policy. */
+export const withApprovals: typeof appsWithApprovals = (router, policy) =>
+  appsWithApprovals(router, (tool, name) => stricter(least(tool, name), policy(tool, name)))
+`
+      : `/** defineApp from apps, with v1's approvals over the app's tools, which set none of their own. */
+export const defineApp: typeof appsDefineApp = (requirements, definition) =>
+  appsDefineApp(requirements, async (context) => {
+    const app = typeof definition === "function" ? await definition(context) : definition
+    return app.tools === undefined ? app : { ...app, tools: appsWithApprovals(app.tools, least) }
+  })
+`;
+  return `/**
+ * v1's approvals for this app, from Executor's move from v1. The app was changed in v2, so the move
+ * kept its code and added this file, which the app takes ${place} from instead of apps. It is
+ * the same ${place}, except that each tool asks at least as v1 asked before running it, and a
+ * tool v1 blocked is refused. The app's own rules decide everything else.
+ */
+import { ${imports.join(", ")} } from "apps"
+import { always } from "apps/operations/approval"
+
+type Policy = Parameters<typeof appsWithApprovals>[1]
+type Approval = NonNullable<ReturnType<Policy>>
+
+/** Tools v1 blocked. */
+const blocked = ${set(floor.blocked)}
+
+/** Tools v1 asked before running. */
+const asked = ${set(floor.asked)}
+
+/** Tools v1 ran without asking. */
+const allowed = ${set(floor.allowed)}
+
+/** Every tool v1's rules decide; ${mcp ? "the server may list others" : "any other is one v1 did not have"}. */
+const known = ${set(floor.known)}
+
+const refused: Approval = () => "denied"
+
+/** The least a tool asks, by the name the app exposes, or undefined to leave it to the app. */
+const least: Policy = (tool, name) =>
+  blocked.has(name)
+    ? refused
+    : asked.has(name)
+      ? always()
+      : allowed.has(name)
+        ? undefined
+        : known.has(name)
+          ? ${mcp ? "undefined" : fallback}
+          : ${other}
+
+${exported}`;
+};
+
+/** A named import from `apps`, its specifiers in braces. */
+const appsImport = /import\s*\{([^}]*)\}\s*from\s*(["'])apps\2[ \t]*;?/gu;
+const specifiers = (list: string) =>
+  list
+    .split(",")
+    .map((name) => name.trim())
+    .filter((name) => name !== "");
+/** Whether a specifier imports `name`, under its own name or another. */
+const imports = (specifier: string, name: string) =>
+  specifier === name || specifier.startsWith(`${name} as `);
+
+/**
+ * A file's source taking `name` from v1's approvals instead of `apps`, at `from` relative to it,
+ * keeping any local name it gives it. Unchanged when it does not import `name` from `apps`.
+ */
+export const flooredImports = (content: string, name: FloorPlace, from: string) =>
+  content.replace(appsImport, (statement, list: string) => {
+    const all = specifiers(list);
+    const taken = all.filter((specifier) => imports(specifier, name));
+    if (taken.length === 0) return statement;
+    const rest = all.filter((specifier) => !imports(specifier, name));
+    return `${rest.length === 0 ? "" : `import { ${rest.join(", ")} } from "apps"\n`}import { ${taken.join(", ")} } from "${from}"`;
+  });
+
+const codeFile = /\.[cm]?[jt]sx?$/u;
+
+/**
+ * The files of an app changed in v2 with v1's approvals beneath its own code: the deployed files,
+ * the files that import `withApprovals` (or, without any, `index.ts`'s `defineApp`) taking it from
+ * `v1-approvals.ts`, and that file. `done` when the deployed app already has them. A reason
+ * instead when they cannot be added without changing what the app's own code does.
+ */
+export const flooredFiles = (deployed: readonly SourceFile[], floor: V1Floor) => {
+  const code = deployed.filter(
+    (file) => codeFile.test(file.path) && file.path !== floorPath && isTextFile(file),
+  );
+  const text = (file: SourceFile) => (isTextFile(file) ? file.content : "");
+  const index = code.find((file) => file.path === "index.ts");
+  if (index === undefined) return { reason: "It has no index.ts to take v1's approvals." } as const;
+  // The names a file imports `name` from `apps` under, and whether it calls it by one of them.
+  const local = (specifier: string) => specifier.split(/\s+as\s+/u).at(-1) ?? specifier;
+  const names = (file: SourceFile, name: string) =>
+    [...text(file).matchAll(appsImport)].flatMap((found) =>
+      specifiers(found[1] ?? "")
+        .filter((specifier) => imports(specifier, name))
+        .map(local),
+    );
+  const reaches = (name: string) => code.some((file) => names(file, name).length > 0);
+  const calls = (name: string) =>
+    code.some((file) =>
+      names(file, name).some((alias) => new RegExp(`\\b${alias}\\s*\\(`, "u").test(text(file))),
+    );
+  const from = (path: string) =>
+    `${path.includes("/") ? "../".repeat(path.split("/").length - 1) : "./"}${floorPath}`;
+  // An earlier repair's file says where it went: the imports it rewrote no longer name apps.
+  const kept = deployed.find((file) => file.path === floorPath);
+  const place: FloorPlace =
+    kept === undefined
+      ? calls("withApprovals")
+        ? "withApprovals"
+        : "defineApp"
+      : text(kept).includes("export const withApprovals")
+        ? "withApprovals"
+        : "defineApp";
+  // Each tool must get one approval: through an import these do not rewrite, a second one fails.
+  if (code.some((file) => /import\s+(\*\s+as\s+)?\w+\s+from\s+["']apps["']/u.test(text(file))))
+    return { reason: "It imports apps as a whole, so its approvals cannot take v1's." } as const;
+  if (place === "defineApp" && kept === undefined && !reaches("defineApp"))
+    return { reason: "Its index.ts does not import defineApp from apps." } as const;
+  // Over every tool, the approvals replace each operation, which a schedule or workflow names.
+  if (place === "defineApp" && code.some((file) => /\b(schedules|workflows)\s*:/u.test(text(file))))
+    return {
+      reason:
+        "It schedules or runs workflows over tools that set no approvals, which v1's would replace.",
+    } as const;
+  const approvals = { path: floorPath, content: floorFile(floor, place) };
+  const files: readonly SourceFile[] = [
+    ...deployed.flatMap((file): SourceFile[] => {
+      if (file.path === floorPath) return [];
+      if (!code.includes(file) || !isTextFile(file)) return [file];
+      return [{ ...file, content: flooredImports(file.content, place, from(file.path)) }];
+    }),
+    approvals,
+  ];
+  const changed = files
+    .filter((file) => fileKey(file) !== fileKey(deployed.find((one) => one.path === file.path)))
+    .map((file) => file.path)
+    .sort();
+  return { files, changed, done: changed.length === 0 };
+};
+
+export interface AppRepair {
+  readonly integration: string;
+  readonly app: string;
+  readonly always: readonly string[];
+  readonly unlisted: ReturnType<typeof unlistedChange>;
+  /**
+   * `deploy` a new version, leave it `unchanged`, leave it `kept` as its users changed its
+   * approvals in v2, or leave it for a `manual` decision when v1's approvals cannot be added beneath
+   * its users' code (`reason`).
+   */
+  readonly decision: "deploy" | "unchanged" | "kept" | "manual" | "removed" | "failed";
+  /**
+   * Whether the deployed files the fixes change are an importer's output (`generated`), or were
+   * changed in v2 (`edited`), so the new version adds v1's approvals beneath them.
+   */
+  readonly source?: "generated" | "edited";
+  /** The files the new version changes, or the edited ones. */
+  readonly files: readonly string[];
+  readonly reason?: string;
+  /** For a manual decision, the tools v1 asked before and blocked, by the names the app exposes. */
+  readonly v1?: Pick<V1Floor, "asked" | "blocked">;
+}
+
+export interface OrganizationRepair {
+  readonly organization: string;
+  readonly v2Organization: string | null;
+  readonly applied: boolean;
+  readonly status: "repaired" | "planned" | "not_imported";
+  readonly apps: readonly AppRepair[];
+}
+
+const fileKey = (file: SourceFile | undefined) =>
+  file === undefined ? null : JSON.stringify(file);
+
+/** The files an app's tools and their approvals are declared in. */
+const ruleFiles = ["index.ts", "tools.ts"];
+
+/** Source without comments, white space, semicolons, commas or parentheses: what it says. */
+const unformatted = (content: string) =>
+  content
+    .replace(/\/\*[\s\S]*?\*\//gu, "")
+    .replace(/(^|[^:])\/\/[^\n]*/gu, "$1")
+    .replace(/[\s;,()]/gu, "");
+
+/** The policy each `withApprovals` call in a file passes: its arguments after the router. */
+const policies = (content: string) =>
+  [...content.matchAll(/\bwithApprovals\s*\(/gu)].map((call) => {
+    let depth = 1;
+    let policy = -1;
+    let index = (call.index ?? 0) + call[0].length;
+    for (; index < content.length && depth > 0; index++) {
+      const char = content[index];
+      if (char === "(" || char === "[" || char === "{") depth++;
+      else if (char === ")" || char === "]" || char === "}") depth--;
+      else if (char === "," && depth === 1 && policy < 0) policy = index + 1;
+    }
+    return policy < 0 ? "" : unformatted(content.slice(policy, index - 1));
+  });
+
+/** Code that decides approvals itself: it imports the approval helpers or returns an approval. */
+const decidesApprovals = /apps\/operations\/approval|["'](?:approved|user-approval|denied)["']/u;
+
+/**
+ * What decides an app's approvals, compared without layout: the policy each `withApprovals` call
+ * passes, `tools.ts`, which holds the app's approval rules and the tools it leaves out, and which
+ * other files of its own decide approvals. An earlier repair's `v1-approvals.ts` is not the app's.
+ */
+const approvalCode = (files: readonly SourceFile[]) => {
+  const code = files.filter(
+    (file) => codeFile.test(file.path) && file.path !== floorPath && isTextFile(file),
+  );
+  const text = (file: SourceFile | undefined) =>
+    file !== undefined && isTextFile(file) ? file.content : "";
+  return JSON.stringify({
+    policies: code.flatMap((file) => policies(text(file))).sort(),
+    tools: unformatted(text(code.find((file) => file.path === "tools.ts"))),
+    own: code
+      .filter((file) => !ruleFiles.includes(file.path) && decidesApprovals.test(text(file)))
+      .map((file) => file.path)
+      .sort(),
+  });
+};
+
+/**
+ * Whether an app's users changed its approvals in v2: what decides them is none of the importer's
+ * outputs (`outputs`). Their choice stands, even where it asks less than v1 did (decision 31).
+ */
+export const approvalsChanged = (
+  deployed: readonly SourceFile[],
+  outputs: readonly (readonly SourceFile[])[],
+) => outputs.every((output) => approvalCode(output) !== approvalCode(deployed));
+
+/**
+ * The files of a new version: the deployed ones, with each file the fixes change taken from the
+ * importer's output now. Undefined, with the paths that block it, when a file the fixes change, or
+ * a file the app declares its tools' approvals in, is neither an importer's output now nor an
+ * earlier one: the importer's before each fix (`before`), or a version the import deployed itself
+ * (`imported`). `done` when every file the fixes change is already the importer's output now, as
+ * after an earlier repair.
+ *
+ * A new version also replaces each other file still as an import deployed it, which an earlier
+ * importer may have written differently, so the app holds one importer's output: the output now.
+ */
+export const mergedFiles = (
+  deployed: readonly SourceFile[],
+  before: readonly (readonly SourceFile[])[],
+  after: readonly SourceFile[],
+  imported: readonly (readonly SourceFile[])[] = [],
+) => {
+  const at = (files: readonly SourceFile[], path: string) =>
+    files.find((file) => file.path === path);
+  const same = (files: readonly SourceFile[], path: string) =>
+    fileKey(at(deployed, path)) === fileKey(at(files, path));
+  const paths = [...new Set([...before.flat(), ...after].map((file) => file.path))].filter((path) =>
+    before.some((earlier) => fileKey(at(earlier, path)) !== fileKey(at(after, path))),
+  );
+  const checked = [
+    ...new Set([
+      ...paths,
+      ...ruleFiles.filter(
+        (path) => at(deployed, path) !== undefined || at(after, path) !== undefined,
+      ),
+    ]),
+  ];
+  const older = checked.filter(
+    (path) => !same(after, path) && before.every((earlier) => !same(earlier, path)),
+  );
+  const blocked = older.filter((path) => imported.every((version) => !same(version, path)));
+  const done = blocked.length === 0 && paths.every((path) => same(after, path));
+  if (done || blocked.length > 0) return { changed: paths, blocked, files: undefined, done };
+  const kept = [...new Set([...imported.flat(), ...after].map((file) => file.path))].filter(
+    (path) =>
+      !paths.includes(path) &&
+      !same(after, path) &&
+      imported.some((version) => at(version, path) !== undefined && same(version, path)),
+  );
+  const changed = [...paths, ...kept].sort();
+  const files = [
+    ...deployed.filter((file) => !changed.includes(file.path)),
+    ...changed.flatMap((path) => {
+      const file = at(after, path);
+      return file === undefined ? [] : [file];
+    }),
+  ];
+  return { changed, blocked, files, done };
+};
+
+/** A source whose tool rows read as the earlier importer read them. */
+const withoutStamps = (source: V1Source): V1Source => ({
+  ...source,
+  tools: (tenant, subjects, integration) =>
+    source.tools(tenant, subjects, integration).pipe(Effect.map(unstamped)),
+});
+
+/** The members an import moved: their WorkOS user, v2 user and role in the v2 organization. */
+export const importedMembers = (sql: SqlClient.SqlClient, organization: string) =>
+  sql`
+    select u.v1_id as v1, m."userId" as v2, m.role from member m
+    join private_v1_import_map u on u.v1_kind = 'user' and u.v2_id = m."userId"
+    where m."organizationId" = ${organization} order by m."createdAt", u.v1_id
+  `.pipe(
+    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Member))),
+    Effect.mapError(() => new V1ImportUnavailable()),
+  );
+
+/**
+ * Each imported app of the organization the fixes change: an MCP app whose tools the stamp fix
+ * makes ask always, and an app whose rules decide tools v1 did not list. Also each app that runs
+ * a version deployed since the import (`deployedSince`), whose users may have changed its rules.
+ * An integration imported as an app per connection (decision 33) has no `integration` row: its
+ * apps were generated with both fixes, so none of them is planned.
+ */
+export const planStampedApps = (
+  snapshot: V1Snapshot,
+  source: Pick<V1Source, "tools" | "openApiOperations">,
+  store: Pick<ImportStore, "find" | "deployedSince">,
+) =>
+  Effect.gen(function* () {
+    const planned: {
+      integration: IntegrationRow;
+      app: AppId;
+      always: readonly string[];
+      unlisted: ReturnType<typeof unlistedChange>;
+      floor: V1Floor;
+      deployedSince: boolean;
+    }[] = [];
+    const since = yield* store.deployedSince(snapshot.tenant);
+    for (const integration of snapshot.integrations) {
+      const imported = yield* store.find("integration", integration.row_id);
+      if (imported?.status !== "imported" || imported.v2_id === null) continue;
+      const tools = yield* source.tools(snapshot.tenant, snapshot.subjects, integration.slug);
+      const always =
+        integration.plugin_id === "mcp" ? stampedAlways(snapshot, integration, tools) : [];
+      const operations =
+        integration.plugin_id === "openapi"
+          ? (yield* source.openApiOperations(snapshot.tenant, integration.slug)).map(
+              (operation) => operation.tool,
+            )
+          : undefined;
+      const unlisted = unlistedChange(snapshot, integration, tools, operations);
+      const deployedSince = since.has(integration.row_id);
+      if (always.length > 0 || unlisted !== null || deployedSince)
+        planned.push({
+          integration,
+          app: AppId.make(imported.v2_id),
+          always,
+          unlisted,
+          floor: v1Floor(snapshot, integration, tools, operations),
+          deployedSince,
+        });
+    }
+    return planned;
+  });
+
+/**
+ * The importer's context for a moved organization, as an import reads it: its v2 organization,
+ * its imported members as the owner and subjects, and v1's rows for them. Undefined when it was
+ * not imported; without a context when its v2 organization or owner is gone.
+ */
+export const movedOrganizationContext = (organization: string) =>
+  Effect.gen(function* () {
+    const environment = yield* V1ImportEnvironment;
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const store = makeImportStore(sql);
+    const recorded = yield* store.find("organization", organization);
+    if (recorded?.status !== "imported" || recorded.v2_id === null) return undefined;
+    const target = yield* store.target(recorded.v2_id);
+    const members = target === undefined ? [] : yield* importedMembers(sql, target.id);
+    const owner = members.find((member) => member.role === "owner")?.v2;
+    const [first, ...rest] = members.map((member) => member.v1);
+    if (target === undefined || owner === undefined || first === undefined)
+      return { v2Organization: recorded.v2_id, context: undefined };
+    const subjects = [first, ...rest] as const;
+    const source = yield* environment.source;
+    const snapshot = yield* source.snapshot(
+      organization,
+      subjects,
+      subjects.length > 1,
+      allSnapshotTables,
+    );
+    const executor = yield* Effect.flatten(HostedExecutor);
+    const context: ItemContext = {
+      executor,
+      connections: environment.connections,
+      store,
+      sql,
+      source,
+      snapshot,
+      target: { id: target.id as ItemContext["target"]["id"], slug: target.slug },
+      owner,
+      users: new Map(members.map((member) => [member.v1, member.v2])),
+      firstParty: firstPartyClients(executor, environment.v1FirstPartyClients).lookup,
+    };
+    return { v2Organization: recorded.v2_id, context };
+  });
+
+/**
+ * Repair one moved organization, or plan its repair without writing (`apply` false). The members
+ * are the imported v2 members whose user the import mapped, as the import read them.
+ */
+export const repairOrganization = (organization: string, apply: boolean) =>
+  Effect.gen(function* () {
+    const empty = { organization, applied: false, apps: [] };
+    const moved = yield* movedOrganizationContext(organization);
+    if (moved?.context === undefined)
+      return {
+        ...empty,
+        v2Organization: moved?.v2Organization ?? null,
+        status: "not_imported",
+      } satisfies OrganizationRepair;
+    const { context } = moved;
+    const { snapshot, source, store, target, executor } = context;
+
+    // v1's stamps and its rules for tools it did not list become the app's own.
+    const apps: AppRepair[] = [];
+    const appOwner = organizationOwner(target.id);
+    for (const { integration, app, always, unlisted, floor } of yield* planStampedApps(
+      snapshot,
+      source,
+      store,
+    )) {
+      const base = { integration: integrationLabel(integration), app, always, unlisted };
+      const plan = integrationPlan(integration);
+      if (!plan.ok) {
+        apps.push({ ...base, decision: "failed", files: [], reason: plan.reason });
+        continue;
+      }
+      const planned = appMethods(
+        snapshot,
+        context.firstParty,
+        integration,
+        yield* redundantFixed(context, integration),
+      );
+      const scoped = (files: Parameters<typeof scopeGeneratedPackage>[0]) =>
+        scopeGeneratedPackage(files, target.slug, integrationLabel(integration));
+      const generated = yield* Effect.all({
+        after: generate(context, integration, plan.value, planned).pipe(
+          Effect.flatMap((out) => scoped(out.files)),
+        ),
+        // What the importer generated before each fix: without either, and with the stamps only.
+        before: Effect.all(
+          [withoutStamps(source), source].map((earlier) =>
+            generate(
+              { ...context, source: earlier, unlistedRules: false },
+              integration,
+              plan.value,
+              planned,
+            ).pipe(Effect.flatMap((out) => scoped(out.files))),
+          ),
+        ),
+      }).pipe(Effect.option);
+      if (Option.isNone(generated)) {
+        apps.push({
+          ...base,
+          decision: "failed",
+          files: [],
+          reason: "The importer no longer generates this app.",
+        });
+        continue;
+      }
+      const read = (version?: VersionId) =>
+        executor.apps
+          .source({
+            owner: appOwner,
+            versionOwner: appOwner,
+            app,
+            ...(version === undefined ? {} : { version }),
+          })
+          .pipe(Effect.map((found) => found.files));
+      const deployed = yield* read().pipe(Effect.option);
+      if (Option.isNone(deployed)) {
+        apps.push({ ...base, decision: "removed", files: [] });
+        continue;
+      }
+      // The versions the import deployed itself are an importer's output too, of an earlier
+      // importer than this one.
+      const imported = yield* Effect.forEach(
+        yield* store.importedVersions(integration.row_id),
+        (version) => read(VersionId.make(version)).pipe(Effect.option),
+      ).pipe(Effect.map((found) => found.flatMap((files) => Option.toArray(files))));
+      const merged = mergedFiles(
+        deployed.value,
+        generated.value.before,
+        generated.value.after,
+        imported,
+      );
+      // An app only deployed again since the import, whose fixes change nothing, keeps its rules.
+      const fixed = always.length > 0 || unlisted !== null;
+      if (merged.done || (merged.files !== undefined && !fixed)) {
+        apps.push({ ...base, decision: "unchanged", source: "generated", files: [] });
+        continue;
+      }
+      // An app whose users changed its approvals in v2 keeps them: their choice stands.
+      if (
+        merged.files === undefined &&
+        approvalsChanged(deployed.value, [
+          generated.value.after,
+          ...generated.value.before,
+          ...imported,
+        ])
+      ) {
+        apps.push({
+          ...base,
+          decision: "kept",
+          source: "edited",
+          files: merged.blocked,
+          reason: "Its users changed its approvals in v2, so they stay as they chose.",
+        });
+        continue;
+      }
+      const edited = merged.files === undefined ? flooredFiles(deployed.value, floor) : undefined;
+      if (edited !== undefined && "reason" in edited) {
+        apps.push({
+          ...base,
+          decision: "manual",
+          source: "edited",
+          files: merged.blocked,
+          reason: edited.reason,
+          v1: { asked: floor.asked, blocked: floor.blocked },
+        });
+        continue;
+      }
+      if (edited?.done === true) {
+        apps.push({ ...base, decision: "unchanged", source: "edited", files: [] });
+        continue;
+      }
+      const next =
+        edited === undefined
+          ? { files: merged.files, changed: merged.changed, source: "generated" as const }
+          : { files: edited.files, changed: edited.changed, source: "edited" as const };
+      const [index, ...others] = next.files ?? [];
+      if (apply && index !== undefined) {
+        const failure = yield* executor.apps
+          .deploy({ owner: appOwner, app, files: [index, ...others] })
+          .pipe(
+            Effect.as(undefined),
+            Effect.catchTags({
+              VersionBuildFailed: (error) => Effect.succeed(`It did not build. ${error.message}`),
+            }),
+            sharedAppCreation,
+            Effect.provideService(CurrentUserId, context.owner),
+          );
+        if (failure !== undefined) {
+          apps.push({
+            ...base,
+            decision: "failed",
+            source: next.source,
+            files: next.changed,
+            reason: failure,
+          });
+          continue;
+        }
+      }
+      apps.push({ ...base, decision: "deploy", source: next.source, files: next.changed });
+    }
+    return {
+      organization,
+      v2Organization: target.id,
+      applied: apply,
+      status: apply ? "repaired" : "planned",
+      apps,
+    } satisfies OrganizationRepair;
+  });
+
+/** An earlier version of an imported app to run again, while the app still runs `expected`. */
+export const AppRestore = Schema.Struct({
+  app: AppId,
+  version: VersionId,
+  expected: VersionId,
+});
+
+export interface RestoredApp {
+  readonly organization: string;
+  readonly app: string;
+  readonly version: string;
+  /**
+   * `restored`, or why not: the app runs another version than `expected` (`changed`, with the
+   * version it runs), the app or version is not one of the organization's imported apps' (`not_found`),
+   * or the organization has no live import (`not_imported`).
+   */
+  readonly status: "restored" | "changed" | "not_found" | "not_imported";
+  readonly active?: string | null;
+}
+
+/**
+ * Run an earlier version of one of a moved organization's imported apps again, as its users
+ * would: the product's activation, which moves the app's version and nothing else. Only while it
+ * still runs `expected`, so a version its users deployed since is never replaced. It gives an app
+ * whose users changed its approvals in v2 back the version a repair replaced (decision 31).
+ */
+export const restoreApp = (organization: string, request: typeof AppRestore.Type) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const store = makeImportStore(sql);
+    const base = { organization, app: request.app, version: request.version };
+    const recorded = yield* store.find("organization", organization);
+    const target =
+      recorded?.status === "imported" && recorded.v2_id !== null
+        ? yield* store.target(recorded.v2_id)
+        : undefined;
+    if (target === undefined) return { ...base, status: "not_imported" } satisfies RestoredApp;
+    if (!(yield* store.importedApp(organization, request.app)))
+      return { ...base, status: "not_found" } satisfies RestoredApp;
+    const executor = yield* Effect.flatten(HostedExecutor);
+    return yield* executor.apps
+      .activate({
+        owner: organizationOwner(target.id),
+        app: request.app,
+        version: request.version,
+        expectedVersion: request.expected,
+      })
+      .pipe(
+        Effect.as({ ...base, status: "restored" } satisfies RestoredApp),
+        Effect.catchTags({
+          AppVersionChanged: (error) =>
+            Effect.succeed({
+              ...base,
+              status: "changed",
+              active: error.current,
+            } satisfies RestoredApp),
+          AppNotFound: () => Effect.succeed({ ...base, status: "not_found" } satisfies RestoredApp),
+          VersionNotFound: () =>
+            Effect.succeed({ ...base, status: "not_found" } satisfies RestoredApp),
+        }),
+      );
+  });
diff --git a/apps/hosted/cloud/src/implementation/v1-import/rollback.ts b/apps/hosted/cloud/src/implementation/v1-import/rollback.ts
new file mode 100644
index 0000000000..1e4d48c3a9
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-import/rollback.ts
@@ -0,0 +1,158 @@
+/**
+ * Rolling back a v1 organization that moved into an existing v2 organization (`notes/v1-import.md`,
+ * decision 32). The organization is its owner's own, so it stays; only what the import added to it
+ * goes: its apps, its accounts, members' toolkit copies and the memberships it added. Every one is
+ * found through the import map, so whatever its users added themselves stays.
+ */
+import {
+  CurrentUserId,
+  HostedExecutor,
+  organizationOwner,
+  type McpConnectionStore,
+  type OrganizationId,
+} from "@executor-js/hosted-server";
+import { AccountId, AppId, OAuthGrantImport } from "@executor-js/sdk/core";
+import { ConnectionId } from "@executor-js/mcp-auth/connections";
+import { Effect, Schema } from "effect";
+import { V1ImportDatabase, V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import { makeImportStore } from "./store.ts";
+
+const Actors = Schema.Array(Schema.Struct({ actor: Schema.NullOr(Schema.String) }));
+const ConnectionUsers = Schema.Array(
+  Schema.Struct({ userId: Schema.String, revoked: Schema.Boolean }),
+);
+
+/** What a rollback removed from the existing organization, or why it removed nothing. */
+export type ImportedRemoval =
+  | {
+      readonly removed: {
+        readonly apps: number;
+        readonly accounts: number;
+        readonly toolkitCopies: number;
+        readonly members: number;
+      };
+    }
+  | { readonly refused: string };
+
+/**
+ * Remove from `target` what importing `organization` into it added. Refused, removing nothing,
+ * when its users changed an imported app or toolkit copy since: that is their work now. Accounts go
+ * without revoking their grants at the provider, which v1 holds too and uses again once the
+ * organization is back. Running it again after it stopped part way removes the rest.
+ */
+export const removeImported = (
+  organization: string,
+  target: OrganizationId,
+  connections: McpConnectionStore,
+) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const executor = yield* Effect.flatten(HostedExecutor);
+    const store = makeImportStore(sql);
+    const owner = organizationOwner(target);
+    const rows = (yield* store.rows(organization)).flatMap((row) =>
+      row.status === "imported" && row.v2_id !== null ? [{ ...row, v2_id: row.v2_id }] : [],
+    );
+    // Integrations' apps, connections' own apps (decision 33) and artifacts' apps.
+    const apps = rows.filter(
+      (row) =>
+        (row.v1_kind === "integration" ||
+          row.v1_kind === "connection_app" ||
+          row.v1_kind === "artifact") &&
+        (row.v2_kind === "app" || row.v2_kind === "undeployed_app"),
+    );
+    const copies = rows.filter(
+      (row) => row.v1_kind === "toolkit" && row.v2_kind === "mcp_connection",
+    );
+    const changed: string[] = [];
+    for (const row of [...apps, ...copies]) {
+      const kind =
+        row.v1_kind === "toolkit"
+          ? "toolkit"
+          : row.v1_kind === "artifact"
+            ? "artifact"
+            : row.v1_kind === "connection_app"
+              ? "connection_app"
+              : "integration";
+      if ((yield* store.sinceImported(kind, row.v1_id)) === "changed") changed.push(row.v1_id);
+    }
+    if (changed.length > 0)
+      return {
+        refused: `Its users changed ${changed.length} imported apps or toolkit copies in v2 since; roll it back by hand.`,
+      } satisfies ImportedRemoval;
+
+    let toolkitCopies = 0;
+    for (const row of copies) {
+      const [found] = yield* sql`
+        select "userId", revoked from "mcpConnection" where id = ${row.v2_id} and resource = ${target}
+      `.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(ConnectionUsers)),
+        Effect.mapError(() => new V1ImportUnavailable()),
+      );
+      if (found === undefined || found.revoked) continue;
+      yield* connections
+        .revoke({ userId: found.userId, resource: target }, ConnectionId.make(row.v2_id))
+        .pipe(Effect.catchTag("ConnectionNotFound", () => Effect.void));
+      toolkitCopies++;
+    }
+    // Apps first, which ends their webhooks and workflows, then the accounts they used.
+    const inUse = (kind: string) => () =>
+      Effect.succeed({
+        refused: `An imported ${kind} still has webhooks or workflows running; roll it back once they stop.`,
+      } satisfies ImportedRemoval);
+    for (const row of apps) {
+      const stopped = yield* executor.apps
+        .remove({ owner, app: AppId.make(row.v2_id) })
+        .pipe(
+          Effect.as(undefined),
+          Effect.catchTags({ AppWebhooksActive: inUse("app"), AppWorkflowsActive: inUse("app") }),
+        );
+      if (stopped !== undefined) return stopped;
+    }
+    const accounts = [
+      ...new Set(rows.flatMap((row) => (row.v2_kind === "account" ? [row.v2_id] : []))),
+    ];
+    for (const account of accounts) {
+      // Removed as the member it is personal to, or as its creator, the owner the import acted as.
+      const [access] = yield* sql`
+        select coalesce(personal_user_id, creator_id) as actor from hosted_account_access
+        where account_id = ${account} and organization_id = ${target}
+      `.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Actors)),
+        Effect.mapError(() => new V1ImportUnavailable()),
+      );
+      if (access === undefined) continue;
+      const stopped = yield* executor[OAuthGrantImport]
+        .removeImportedAccount({
+          owner,
+          account: AccountId.make(account),
+        })
+        .pipe(
+          Effect.provideService(CurrentUserId, access.actor ?? undefined),
+          Effect.as(undefined),
+          Effect.catchTags({
+            AccountWebhooksActive: inUse("account"),
+            AccountWorkflowsActive: inUse("account"),
+          }),
+        );
+      if (stopped !== undefined) return stopped;
+    }
+    // Members the import added, never one who was there before it or the organization's owner.
+    const members = yield* sql`
+      delete from member where "organizationId" = ${target} and role <> 'owner'
+        and id in (
+          select v2_id from private_v1_import_map
+          where v1_org_id = ${organization} and v1_kind = 'membership' and status = 'imported'
+            and v2_kind = 'member'
+        )
+      returning id
+    `.pipe(Effect.mapError(() => new V1ImportUnavailable()));
+    return {
+      removed: {
+        apps: apps.length,
+        accounts: accounts.length,
+        toolkitCopies,
+        members: members.length,
+      },
+    } satisfies ImportedRemoval;
+  });
diff --git a/apps/hosted/cloud/src/implementation/v1-import/run.ts b/apps/hosted/cloud/src/implementation/v1-import/run.ts
index 3f9f189685..0ed595ebcc 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/run.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/run.ts
@@ -19,8 +19,18 @@ import {
   type OrganizationId,
 } from "@executor-js/hosted-server";
 import { AccountId, AppId, OAuthGrantImport, OwnerId, type Executor } from "@executor-js/sdk/core";
-import { Context, Effect, Option, Predicate, type Redacted, Schema, type Scope } from "effect";
-import { freeMembers } from "../../contracts/billing-catalog.ts";
+import {
+  Clock,
+  Context,
+  Effect,
+  Option,
+  Predicate,
+  type Redacted,
+  Schema,
+  type Scope,
+} from "effect";
+import type { SqlClient } from "effect/sql";
+import { billingCustomerId, freeMembers } from "../../contracts/billing-catalog.ts";
 import { V1ImportDatabase, V1ImportUnavailable } from "../../contracts/v1-import.ts";
 import {
   V1OrgReport,
@@ -30,6 +40,7 @@ import {
   v1ImportReportKey,
   v1ImportRunPrefix,
   type V1ImportParams,
+  type V1IntoMode,
   type V1OrgOutcome,
 } from "../../contracts/v1-import-run.ts";
 import {
@@ -40,35 +51,56 @@ import {
   type IntegrationRow,
 } from "./formats.ts";
 import {
+  importInto,
   importMembership,
   importOrganization,
   importUser,
+  intoOwner,
   matchUser,
+  plannedDisplacement,
   plannedSlug,
   slugBase,
   slugCandidates,
+  type Displacement,
+  type DisplacementRefused,
+  setUpIn,
+  type Into,
+  type IntoRefused,
   type UserMatch,
 } from "./identity.ts";
 import {
   ItemFailed,
   artifactMapping,
+  checkAccount,
+  checkFixedAccount,
   checkIntegration,
+  connectionAppName,
+  connectionAppOf,
+  connectionPlans,
   connectionTarget,
   importAccount,
   importArtifact,
+  importConnectionApp,
+  importedApps,
   importFixedAccount,
   importIntegration,
   importToolkit,
   linkConnectionAccount,
   mapLookup,
+  needsNoAccount,
   readSecretCompared,
+  refreshCopiedGrant,
   refused,
   toolkitCopyKey,
   toolkitMembers,
+  updateCopiedAccount,
   toolkitPolicy,
+  type AppAccountRequirements,
+  type AppScope,
   type DroppedFixed,
   type ImportedLookup,
   type ItemContext,
+  type RuleCounts,
   type StaleTool,
 } from "./items.ts";
 import {
@@ -94,9 +126,27 @@ import {
   type V1SnapshotTable,
   type V1Source,
 } from "./source.ts";
+import {
+  CarryOverRefused,
+  carriedAttach,
+  carryOver,
+  decideCarryOver,
+  paysInV2,
+  previewProblem,
+  v1TeamPlan,
+  v2Pricing,
+  type V1ImportBilling,
+  type V1Subscription,
+} from "./billing.ts";
 import { makeImportStore, sourceHash, type MapKind, type MapResult } from "./store.ts";
 import { V1MovedState } from "./moved-flag.ts";
-import { importRefusal, movedFlag, type V1ImportWrites } from "./writes.ts";
+import {
+  importRefusal,
+  listedDisplacement,
+  listedInto,
+  movedFlag,
+  type V1ImportWrites,
+} from "./writes.ts";
 
 /** The note on an imported policy that matches none of the tools v1 last listed. */
 export const noToolMatches = "It matches no tool v1 last listed for its integration.";
@@ -105,6 +155,39 @@ export const noToolMatches = "It matches no tool v1 last listed for its integrat
 export const personalApproveDropped =
   "In a workspace with more than one member, a member's own approve rules are not imported, so these tools ask again.";
 
+/** Why a connection or rule of an integration whose app was not imported cannot move. */
+const integrationNotImported = "Its integration was not imported.";
+/** Why an item an earlier run imported is left out: its users removed it in v2 since. */
+const removedInV2 = "Its users removed it in v2 after an earlier run imported it.";
+/** The note on an item an earlier run imported that its users changed in v2 since. */
+const keptInV2 = "Kept as its users changed it in v2 after an earlier run imported it.";
+/** The note on a copied account that took v1's final tokens (`refreshCopiedGrants`). */
+const tookV1Note = "Took v1's newer sign-in.";
+/** The note on a copied account that moved to its regenerated app's provider (`followAppProvider`). */
+const followedNote = "Moved to its app's new sign-in methods.";
+
+/**
+ * Before the import deploys anything, each account an earlier run saved takes v1's final tokens
+ * if they are newer (`refreshCopiedGrant`). A deployment starts work that uses the app's accounts,
+ * such as reconciling its webhook sources, and an account still holding the copy's tokens would
+ * renew with a refresh token v1 has rotated since: a service that ends the grant when an old
+ * refresh token comes back then refuses v1's tokens too. Returns the connections whose account
+ * took v1's tokens.
+ */
+const refreshCopiedGrants = (context: ImportContext, ids: readonly string[]) =>
+  Effect.gen(function* () {
+    const took: string[] = [];
+    for (const id of ids) {
+      const row = context.snapshot.connections.find((candidate) => candidate.row_id === id);
+      const saved = yield* context.store.find("connection", id);
+      if (row === undefined || saved?.status !== "imported" || saved.v2_id === null) continue;
+      if ((yield* context.store.sinceImported("connection", id)) === "removed") continue;
+      if ((yield* refreshCopiedGrant(context, row, AccountId.make(saved.v2_id))) === "replaced")
+        took.push(id);
+    }
+    return took;
+  });
+
 /** The v2 kind of an app imported as source without a version, which needs repair. */
 const undeployedApp = "undeployed_app";
 
@@ -135,7 +218,7 @@ export class V1ImportEnvironment extends Context.Service<
     readonly reports: V1ImportReports;
     /**
      * Which organizations this deployment may import, writing v2 (`writes.ts`); dry runs never
-     * write. The operator routes check it before starting, and the run again.
+     * write. The operator routes check it and the allow table before starting, and the run again.
      */
     readonly writes: V1ImportWrites;
     /**
@@ -147,6 +230,12 @@ export class V1ImportEnvironment extends Context.Service<
     readonly v1FirstPartyClients: Readonly<Record<string, string>>;
     /** The deployment secret slug suffixes are derived with (`slugCandidates`). */
     readonly slugKey: Effect.Effect<Redacted.Redacted<string>>;
+    /**
+     * v2's billing, which a paid organization's v1 subscription carries over to (`billing.ts`).
+     * None where v1 bills in another Autumn account than this Cloud: there a dry run decides
+     * whether a subscription maps, without Autumn's preview, and no import carries one over.
+     */
+    readonly billing: Option.Option<Effect.Effect<V1ImportBilling, V1ImportUnavailable>>;
   }
 >()("cloud/V1ImportEnvironment") {}
 
@@ -170,7 +259,8 @@ export type V1ImportStep<S> = <A, R>(
 
 /**
  * Storage and transport failures retry the step, as do builds that ran out of memory or whose
- * compiler did not answer, which say nothing about the source. Anything v2 refuses fails the item.
+ * compiler did not answer, and source operations Git storage could not complete, which say nothing
+ * about the source. Anything v2 refuses fails the item.
  */
 const transient = (error: unknown) =>
   Predicate.isTagged(error, "StorageError") ||
@@ -178,7 +268,11 @@ const transient = (error: unknown) =>
   Predicate.isTagged(error, "CredentialsError") ||
   Predicate.isTagged(error, "V1ImportUnavailable") ||
   Predicate.isTagged(error, "BuildMemoryExceeded") ||
-  Predicate.isTagged(error, "BuildUnanswered");
+  Predicate.isTagged(error, "BuildUnanswered") ||
+  // Git storage that could not complete an operation says nothing about the source either.
+  (Predicate.isTagged(error, "SourceError") &&
+    Predicate.hasProperty(error, "reason") &&
+    (error.reason === "git" || error.reason === "storage"));
 
 const refusal = (error: unknown) =>
   error instanceof ItemFailed
@@ -196,6 +290,28 @@ const refusalOutcome = (error: unknown): Pick<Outcome, "status" | "reason" | "st
     ? { status: "skipped", reason: clip(error.reason), stale: error.stale }
     : { status: "failed", reason: clip(refusal(error)) };
 
+/**
+ * A connection's result for a refusal. One that v2 cannot take as v1 kept it moves without its
+ * account, for its owner to connect again in v2 (`reconnect`), and does not block the
+ * organization. An outage, a Vault that did not answer, an integration that did not move and a
+ * first-party client this deployment does not hold as v1's (`firstParty`) are failures, which
+ * block it: trying again, or configuring the client, can move the connection with its account.
+ */
+const connectionRefusal = (
+  error: unknown,
+  firstParty: FirstPartyMismatch | undefined,
+): Pick<Outcome, "status" | "reason" | "stale" | "reconnect"> => {
+  const decided = refusalOutcome(error);
+  return decided.status === "failed" &&
+    firstParty === undefined &&
+    error instanceof ItemFailed &&
+    error.outage === undefined &&
+    error.vault !== "unavailable" &&
+    error.reason !== integrationNotImported
+    ? { status: "skipped", reason: decided.reason, reconnect: true }
+    : decided;
+};
+
 /** A rule that matches no tool v1 lists: it still moves, is reported, and does not block. */
 const unmatchedRule = (row: { readonly pattern: string; readonly action: string }) =>
   ({
@@ -242,6 +358,14 @@ interface Assessment {
   readonly status: "ready" | "held_back" | "failed";
   readonly reason: string | null;
   readonly billing: V1Billing | null;
+  /**
+   * A paid organization's v1 subscription and whether it can carry over: the subscription when
+   * it maps, and the problem, from the mapping or the attach's preview, when it cannot.
+   */
+  readonly carryOver: {
+    readonly subscription: V1Subscription | null;
+    readonly problem: string | null;
+  } | null;
   readonly members: readonly PlannedMember[];
   readonly skippedMembers: readonly SkippedMember[];
   readonly organization: { readonly name: string; readonly slug: string } | null;
@@ -260,6 +384,12 @@ interface Assessment {
     readonly match: Exclude<UserMatch["kind"], "create">;
   }>;
   readonly slug: V1OrgReport["slug"];
+  /**
+   * The existing v2 organization the operator listed for it to move into (decision 32), and why
+   * it does not when it may not. Absent when none is listed, and from assessments recorded before
+   * such moves.
+   */
+  readonly into?: V1OrgReport["into"];
   readonly v1Counts: Readonly<Record<string, number>>;
   readonly items: ItemKeys;
 }
@@ -277,6 +407,7 @@ const failedAssessment = (reason: string): Assessment => ({
   status: "failed",
   reason,
   billing: null,
+  carryOver: null,
   members: [],
   skippedMembers: [],
   organization: null,
@@ -314,21 +445,200 @@ const openStep = <T extends V1SnapshotTable>(
 /**
  * The v2 slugs the organization tries (`slugCandidates`). Its unsuffixed slug is left to another
  * live v1 organization whose slug is exactly that: one whose own slug differs from it, or the
- * older of two that both have it.
+ * older of two that both have it. A v2 organization the operator listed to give up the unsuffixed
+ * slug (`listedDisplacement`) is renamed when it holds it (`plannedDisplacement`).
  */
 const slugPlan = (source: V1Source, organization: string, slug: string) =>
   Effect.gen(function* () {
+    // Typed here: a ternary of object literals would widen each with the other's keys.
+    let displacement: Displacement | DisplacementRefused | undefined;
     const environment = yield* V1ImportEnvironment;
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const key = yield* environment.slugKey;
     const base = slugBase(slug);
     const holders = yield* source.slugHolders(organization, base);
     const reserved = holders.some((holder) => slug !== base || holder < organization);
-    return yield* slugCandidates(yield* environment.slugKey, organization, slug, reserved);
+    const candidates = yield* slugCandidates(key, organization, slug, reserved);
+    const holder = yield* listedDisplacement(organization);
+    if (holder !== undefined)
+      displacement = reserved
+        ? {
+            kind: "refused",
+            holder,
+            refused: `Another v1 organization has ${base} exactly and takes it when it moves.`,
+          }
+        : yield* plannedDisplacement(
+            sql,
+            key,
+            (to) => Effect.map(source.slugHolders(organization, to), (found) => found.length > 0),
+            holder,
+            base,
+          );
+    return { candidates, displacement };
+  });
+
+/**
+ * The slug the report plans: the unsuffixed slug and the holder's new one when a listed
+ * displacement applies, otherwise the first free candidate and, for a listed one, why it does not.
+ */
+const plannedSlugReport = (
+  sql: SqlClient.SqlClient,
+  plan: Effect.Success<ReturnType<typeof slugPlan>>,
+  slug: string,
+): Effect.Effect<NonNullable<V1OrgReport["slug"]>, V1ImportUnavailable> =>
+  Effect.gen(function* () {
+    const displacement = plan.displacement;
+    if (displacement?.kind === "rename")
+      return {
+        v1: slug,
+        v2: displacement.from,
+        changed: displacement.from !== slug,
+        displaced: { organization: displacement.holder, slug: displacement.to },
+      } satisfies V1OrgReport["slug"];
+    const planned = yield* plannedSlug(sql, plan.candidates, slug);
+    return {
+      v1: slug,
+      v2: planned.slug,
+      changed: planned.changed,
+      ...(displacement === undefined
+        ? {}
+        : {
+            displaced: {
+              organization: displacement.holder,
+              slug: null,
+              reason: displacement.refused,
+            },
+          }),
+    } satisfies V1OrgReport["slug"];
+  });
+
+/**
+ * Whether a paid organization's v1 subscription can carry over, decided before anything is
+ * copied: it must map (`decideCarryOver`), and Autumn's preview of the attach on v1's own
+ * customer must show no charge, no other plan changing and the same renewal date. A preview reads
+ * only, so dry runs make it too.
+ */
+const assessCarryOver = (
+  source: V1Source,
+  organization: string,
+  copy: OrganizationId | undefined,
+) =>
+  Effect.gen(function* () {
+    const environment = yield* V1ImportEnvironment;
+    const decided = decideCarryOver(
+      yield* source.customerPlans(organization),
+      v1TeamPlan,
+      yield* Clock.currentTimeMillis,
+    );
+    if (!decided.ok) return { subscription: null, problem: decided.reason };
+    const subscription = decided.subscription;
+    if (Option.isNone(environment.billing))
+      return {
+        subscription,
+        problem:
+          "This deployment bills in another Autumn account than v1, so it cannot carry it over.",
+      };
+    const billing = yield* environment.billing.value;
+    // A copy the opt-in import made has its own customer; one that pays is reconciled by a person.
+    if (copy !== undefined) {
+      const own = yield* billing.autumn
+        .getCustomerPlans({
+          customerId: billingCustomerId(billing.catalog, copy),
+          expand: ["subscriptions.plan"],
+        })
+        .pipe(Effect.mapError(() => new V1ImportUnavailable()));
+      if (paysInV2(billing.catalog, own))
+        return {
+          subscription,
+          problem:
+            "Its v2 copy already pays for its own subscription, so it would be billed twice; a person reconciles it first.",
+        };
+    }
+    const problem = yield* billing.autumn
+      .previewAttach(carriedAttach(billing, subscription, organization))
+      .pipe(
+        Effect.map((preview) =>
+          previewProblem(preview, {
+            add: billing.catalog.team,
+            remove: subscription.planId,
+            renews: subscription.periodEnd,
+          }),
+        ),
+        Effect.mapError(() => new V1ImportUnavailable()),
+      );
+    return {
+      subscription,
+      problem: problem === undefined ? null : `Autumn's preview of the change: ${problem}`,
+    };
+  });
+
+/**
+ * Whether the v1 organization moves into the existing v2 organization the operator listed
+ * (`listedInto`, decision 32). Every mode needs its owner to own the listed organization
+ * (`intoOwner`). `nothing_to_copy` and `leave_v1_data` move a free workspace of one active member
+ * with no pending invitation, which WorkOS lists as a pending membership; `nothing_to_copy` also
+ * needs it to have nothing to copy, no item of any kind the import moves. `copy_into_empty` takes
+ * any workspace an import takes, paid or shared, into an organization with nothing set up
+ * (`setUpIn`), or the one an earlier run recorded. An import reads it under the freeze, as the rest
+ * of the assessment.
+ */
+const intoPlan = (
+  sql: SqlClient.SqlClient,
+  input: {
+    readonly organization: string;
+    readonly target: string;
+    readonly mode: V1IntoMode | undefined;
+    readonly billing: V1Billing;
+    readonly members: number;
+    readonly pendingMembers: number;
+    readonly items: ItemKeys;
+    readonly owner: PlannedMember;
+    readonly email: string;
+  },
+): Effect.Effect<Into | IntoRefused, V1ImportUnavailable> =>
+  Effect.gen(function* () {
+    const refused = (reason: string) => ({ kind: "refused", refused: reason }) as const;
+    const mode = input.mode;
+    if (mode === undefined)
+      return refused("The allow table lists a mode the import does not know.");
+    if (mode !== "copy_into_empty") {
+      if (input.billing.kind !== "free")
+        return refused(`It has a paid v1 plan (${input.billing.plans.join(", ")}).`);
+      if (input.members !== 1)
+        return refused(
+          `It has ${input.members} active members; only a workspace of one moves into an existing v2 organization without its data.`,
+        );
+      if (input.pendingMembers > 0)
+        return refused(`It has ${input.pendingMembers} pending invitations.`);
+    }
+    if (mode === "nothing_to_copy") {
+      const toCopy = Object.entries(input.items).flatMap(([kind, ids]) =>
+        ids.length === 0 ? [] : [`${kind}: ${ids.length}`],
+      );
+      if (toCopy.length > 0) return refused(`It has items to copy (${toCopy.join(", ")}).`);
+    }
+    const store = makeImportStore(sql);
+    const decided = yield* intoOwner(sql, store, {
+      organization: input.organization,
+      target: input.target,
+      member: input.owner.user,
+      email: input.email,
+    });
+    if (decided.kind === "refused" || mode !== "copy_into_empty") return decided;
+    // A run that already recorded it continues into what it copied there before.
+    if ((yield* store.find("organization", input.organization))?.status === "imported")
+      return decided;
+    const set = yield* setUpIn(sql, decided.target.id);
+    return set === undefined
+      ? decided
+      : refused(`The listed v2 organization is not empty (${set}).`);
   });
 
 /**
  * Read the organization's members, plan and rows, and decide whether it moves now. Enterprise
- * organizations move by hand (decision 15). An import also holds back paid organizations, which
- * move with their subscription once the billing mapping exists (decision 5).
+ * organizations move by hand (decision 15). A paid organization moves with its v1 subscription
+ * (decision 5) when it can carry over (`assessCarryOver`); an import holds it back otherwise. One
+ * on a grandfathered Hobby or Professional plan moves to v2's Free plan, as a free one does.
  */
 const assess = (params: V1ImportParams) =>
   Effect.gen(function* () {
@@ -351,6 +661,7 @@ const assess = (params: V1ImportParams) =>
     const planned = planMembers(memberships, users);
     const base = {
       billing,
+      carryOver: null,
       sso,
       skippedMembers: planned.skipped,
       apiKeys: { read: false } as const,
@@ -382,6 +693,13 @@ const assess = (params: V1ImportParams) =>
       allSnapshotTables,
     );
     const artifacts = yield* source.artifactSummaries(organization, subjects);
+    const items: ItemKeys = {
+      integrations: snapshot.integrations.map((row) => row.row_id),
+      connections: snapshot.connections.map((row) => row.row_id),
+      policies: snapshot.policies.map((row) => row.row_id),
+      toolkits: snapshot.toolkits.map((row) => row.row_id),
+      artifacts: artifacts.map((row) => row.row_id),
+    };
     const owner = members[0];
     const keys = yield* Effect.option(source.apiKeys(organization));
     const matches = yield* Effect.forEach(members, (member) => {
@@ -391,19 +709,69 @@ const assess = (params: V1ImportParams) =>
         Effect.map((match) => ({ user: member.user, match })),
       );
     });
-    const slug = yield* plannedSlug(
-      sql,
-      yield* slugPlan(source, organization, snapshot.organization.slug),
-      snapshot.organization.slug,
-    );
+    // An organization an earlier run imported keeps that organization and its slug.
+    const store = makeImportStore(sql);
+    const recorded = yield* store.find("organization", organization);
+    const copy =
+      recorded?.status === "imported" && recorded.v2_id !== null
+        ? yield* store.target(recorded.v2_id)
+        : undefined;
+    const listed = yield* listedInto(organization);
+    const ownerUser = users.get(owner.user);
+    if (ownerUser === undefined) return yield* new V1ImportUnavailable();
+    const into =
+      listed === undefined
+        ? undefined
+        : yield* intoPlan(sql, {
+            organization,
+            target: listed.organization,
+            mode: listed.mode,
+            billing,
+            members: base.v1Counts.members,
+            pendingMembers: base.v1Counts.pendingMembers,
+            items,
+            owner,
+            email: memberProfile(ownerUser).email,
+          });
+    const slug: V1OrgReport["slug"] =
+      into?.kind === "into"
+        ? {
+            v1: snapshot.organization.slug,
+            v2: into.target.slug,
+            changed: into.target.slug !== snapshot.organization.slug,
+          }
+        : copy === undefined
+          ? yield* plannedSlugReport(
+              sql,
+              yield* slugPlan(source, organization, snapshot.organization.slug),
+              snapshot.organization.slug,
+            )
+          : {
+              v1: snapshot.organization.slug,
+              v2: copy.slug,
+              changed: copy.slug !== snapshot.organization.slug,
+            };
+    // A copy into an existing organization carries billing over as into a copy: its own customer
+    // must bill nothing.
+    const carry =
+      billing.kind === "paid"
+        ? yield* assessCarryOver(
+            source,
+            organization,
+            copy?.id ?? (into?.kind === "into" ? (into.target.id as OrganizationId) : undefined),
+          )
+        : null;
     const held =
-      billing.kind === "enterprise"
-        ? "Enterprise organizations move by hand, after their v2 SSO is set up."
-        : billing.kind === "paid" && params.mode === "import"
-          ? "Paid organizations move with their subscription once the billing mapping is built."
-          : null;
+      into?.kind === "refused"
+        ? `It does not move into the listed v2 organization: ${into.refused}`
+        : billing.kind === "enterprise"
+          ? "Enterprise organizations move by hand, after their v2 SSO is set up."
+          : carry !== null && carry.problem !== null && params.mode === "import"
+            ? `Its v1 subscription cannot carry over: ${carry.problem}`
+            : null;
     return {
       ...base,
+      carryOver: carry,
       status: held === null ? "ready" : "held_back",
       reason: held,
       members,
@@ -419,7 +787,16 @@ const assess = (params: V1ImportParams) =>
       emailMatches: matches.flatMap(({ user, match }) =>
         match.kind === "create" ? [] : [{ user, match: match.kind }],
       ),
-      slug: { v1: snapshot.organization.slug, v2: slug.slug, changed: slug.changed },
+      slug,
+      ...(listed === undefined || into === undefined
+        ? {}
+        : {
+            into: {
+              organization: listed.organization,
+              mode: listed.mode ?? null,
+              ...(into.kind === "refused" ? { refused: into.refused } : {}),
+            },
+          }),
       v1Counts: {
         ...base.v1Counts,
         importedMembers: members.length,
@@ -430,13 +807,8 @@ const assess = (params: V1ImportParams) =>
         toolkits: snapshot.toolkits.length,
         artifacts: artifacts.length,
       },
-      items: {
-        integrations: snapshot.integrations.map((row) => row.row_id),
-        connections: snapshot.connections.map((row) => row.row_id),
-        policies: snapshot.policies.map((row) => row.row_id),
-        toolkits: snapshot.toolkits.map((row) => row.row_id),
-        artifacts: artifacts.map((row) => row.row_id),
-      },
+      // A move that leaves v1's data in v1 copies none of it.
+      items: listed?.mode === "leave_v1_data" ? noItems : items,
     } satisfies Assessment;
   });
 
@@ -460,6 +832,11 @@ interface Outcome {
   readonly staleTools?: readonly StaleTool[] | undefined;
   /** Fixed credentials an integration's app leaves out (decision 22). */
   readonly droppedCredentials?: readonly DroppedFixed[] | undefined;
+  /**
+   * The accounts a dry run's build of an integration's app takes, which its connections' accounts
+   * are checked against as an import would save them. Provider definitions only, no secret.
+   */
+  readonly accounts?: AppAccountRequirements | undefined;
   /**
    * An org connection whose user-scoped secret members hold with different values: how many hold
    * it and how many distinct values (decision 23).
@@ -469,6 +846,8 @@ interface Outcome {
   readonly vaultFailed?: "missing" | "unavailable" | undefined;
   /** A connection that signed in through a first-party client v2 does not offer as v1's. */
   readonly firstParty?: FirstPartyMismatch | undefined;
+  /** A connection that moves without its account, for its owner to connect again in v2. */
+  readonly reconnect?: true | undefined;
   readonly unmatched?: { readonly pattern: string; readonly action: string } | undefined;
   /**
    * Why v1 cannot run it either (decision 20): a skipped item, or a policy that matches no tool,
@@ -480,8 +859,67 @@ interface Outcome {
   readonly unmappedRoles?: ReadonlyArray<{ readonly role: string; readonly problem: string }>;
   /** Scoped MCP connections a toolkit makes or would make, one per member copy. */
   readonly copies?: number | undefined;
+  /**
+   * An integration whose connections' rules differ, which moves as an app per connection
+   * (decision 33): each connection's app.
+   */
+  readonly apps?: readonly ConnectionAppOutcome[] | undefined;
 }
 
+/** One connection's own app (decision 33): what it did or would do, and its rules' counts. */
+interface ConnectionAppOutcome {
+  /** The connection's row id. */
+  readonly connection: string;
+  readonly label: string;
+  readonly owner: ConnectionRow["owner"];
+  readonly name: string;
+  readonly status: Outcome["status"];
+  readonly reason?: string | undefined;
+  readonly v2Id?: string | undefined;
+  /** Counted when the app was generated; an app an earlier run left as it was has none. */
+  readonly rules?: RuleCounts | undefined;
+  /** As an integration's `accounts`: what a dry run's build of this app takes. */
+  readonly accounts?: AppAccountRequirements | undefined;
+}
+
+/** What the user should know about an integration that moves as an app per connection. */
+const splitNote = (apps: readonly ConnectionAppOutcome[]) =>
+  `Its connections have different v1 rules, so each is its own app: ${apps.map((app) => app.name).join(", ")}.`;
+
+/** Why an integration that moves as an app per connection failed: each app that did. */
+const splitFailure = (apps: readonly ConnectionAppOutcome[]) =>
+  clip(
+    apps
+      .filter((app) => app.status === "failed")
+      .map((app) => `${app.name}: ${app.reason ?? ""}`)
+      .join(" "),
+  );
+
+/** An integration's outcome from its connections' own apps: failed when any of them failed. */
+const splitOutcome = (
+  base: Pick<Outcome, "kind" | "id" | "label" | "context">,
+  done: "planned" | "imported",
+  apps: readonly ConnectionAppOutcome[],
+  left: Pick<Outcome, "note" | "traced" | "staleTools" | "droppedCredentials">,
+): Outcome => {
+  const failed = apps.some((app) => app.status === "failed");
+  const moved = apps.some((app) => app.status === done);
+  return {
+    ...base,
+    ...left,
+    status: failed || apps.length === 0 ? "failed" : moved ? done : "skipped",
+    ...(failed
+      ? { reason: splitFailure(apps) }
+      : apps.length === 0
+        ? { reason: "None of its connections can move to an app of its own." }
+        : moved
+          ? {}
+          : { reason: removedInV2 }),
+    note: [left.note, splitNote(apps)].filter((text) => text !== undefined).join(" "),
+    apps,
+  };
+};
+
 const firstPartyName = (row: ConnectionRow) =>
   row.oauth_client?.startsWith(firstPartyClientPrefix) === true
     ? row.oauth_client.slice(firstPartyClientPrefix.length)
@@ -501,7 +939,7 @@ interface FirstPartyMismatch {
  * The v2 clients v1's first-party connections move to: only one that is v1's own client, with
  * v1's client ID. Any other is a mismatch the report lists, and its connections cannot move.
  */
-const firstPartyClients = (executor: Executor, v1: Readonly<Record<string, string>>) => {
+export const firstPartyClients = (executor: Executor, v1: Readonly<Record<string, string>>) => {
   const offered = (name: string) => executor[OAuthGrantImport].firstPartyClient(name);
   const mismatch = (name: string): FirstPartyMismatch | undefined => {
     const client = offered(name);
@@ -647,15 +1085,30 @@ const policyMatches = (
 
 /**
  * What an import would find in the map, decided from v1's rows: an integration's app when it can
- * be generated, a connection's account when it can be imported. The ids name nothing in v2.
+ * be generated, or for one the dry run plans as an app per connection (`split`), each connection's
+ * own app, and a connection's account when it can be imported. The ids name nothing in v2.
  */
 const plannedLookup = (
   snapshot: Pick<V1Snapshot, "integrations" | "clients">,
   firstParty: FirstPartyClients,
+  split: ReadonlySet<string>,
 ): ImportedLookup => ({
   app: (integration) =>
     Effect.succeed(
-      integrationPlan(integration).ok ? `app_planned_${integration.row_id}` : undefined,
+      !integrationPlan(integration).ok
+        ? undefined
+        : split.has(integration.row_id)
+          ? { kind: "split" }
+          : { kind: "one", id: `app_planned_${integration.row_id}` },
+    ),
+  connectionApp: (connection) =>
+    Effect.succeed(
+      snapshot.integrations.some(
+        (integration) =>
+          integration.slug === connection.integration && split.has(integration.row_id),
+      ) && connectionPlan(snapshot, firstParty, connection).ok
+        ? `app_planned_${connection.row_id}`
+        : undefined,
     ),
   connection: (connection) =>
     Effect.succeed(
@@ -708,28 +1161,59 @@ const dryIntegration = (assessment: Assessment, organization: string, id: string
         reason: "It no longer exists in v1.",
       } satisfies Outcome;
     const label = integrationLabel(row);
-    return yield* checkIntegration(
-      {
-        executor,
-        snapshot,
-        source,
-        firstParty,
-        owner: OwnerId.make(`v1:${organization}`),
-        slug: assessment.slug?.v2 ?? snapshot.organization.slug,
-      },
-      row,
-    ).pipe(
-      Effect.map((checked): Outcome => ({
-        kind: "integration",
-        id,
-        label,
-        context: null,
-        status: "planned",
-        note: checked.note,
-        traced: checked.traced,
-        staleTools: checked.stale,
-        droppedCredentials: checked.dropped,
-      })),
+    const checking = {
+      executor,
+      snapshot,
+      source,
+      firstParty,
+      owner: OwnerId.make(`v1:${organization}`),
+      slug: assessment.slug?.v2 ?? snapshot.organization.slug,
+    };
+    return yield* checkIntegration(checking, row).pipe(
+      Effect.flatMap((checked) => {
+        // Connections whose rules differ move as an app each (decision 33), checked one by one.
+        if (checked.split)
+          return dryConnectionApps(checking, row).pipe(
+            Effect.map((apps) =>
+              splitOutcome({ kind: "integration", id, label, context: null }, "planned", apps, {
+                note: checked.note,
+                traced: checked.traced,
+                staleTools: checked.stale,
+                droppedCredentials: checked.dropped,
+              }),
+            ),
+          );
+        const outcome: Outcome = {
+          kind: "integration",
+          id,
+          label,
+          context: null,
+          status: "planned",
+          note: checked.note,
+          traced: checked.traced,
+          staleTools: checked.stale,
+          droppedCredentials: checked.dropped,
+          accounts: checked.accounts,
+        };
+        // As an import's `withFixedAccount`: a refused fixed account fails the integration, whose
+        // app its connections still get.
+        return checkFixedAccount(
+          { executor, snapshot, source, firstParty },
+          row,
+          checked.accounts,
+        ).pipe(
+          Effect.as(outcome),
+          Effect.catch((error) =>
+            transient(error)
+              ? Effect.fail(error)
+              : Effect.succeed<Outcome>({
+                  ...outcome,
+                  status: "failed",
+                  reason: clip(refusal(error)),
+                }),
+          ),
+        );
+      }),
       Effect.catch((error) =>
         transient(error)
           ? Effect.fail(error)
@@ -744,42 +1228,93 @@ const dryIntegration = (assessment: Assessment, organization: string, id: string
     );
   });
 
-/** The Vault items a connection's import reads. */
-const connectionSecrets = (
-  plan: Extract<ReturnType<typeof connectionPlan>, { ok: true }>["value"],
-) => {
-  const access = plan.access;
-  switch (access.kind) {
-    case "none":
-      return [];
-    case "secrets":
-      return access.items.map(([, item]) => item);
-    case "first_party":
-      return [
-        access.accessItem,
-        ...(plan.row.refresh_item_id === null ? [] : [plan.row.refresh_item_id]),
-      ];
-    case "oauth":
-      return [
-        access.accessItem,
-        ...(access.grant === "authorization_code" && plan.row.refresh_item_id !== null
-          ? [plan.row.refresh_item_id]
-          : []),
-        ...(access.client.client_secret_item_id === null
-          ? []
-          : [access.client.client_secret_item_id]),
-      ];
-  }
+/**
+ * Each connection's own app (decision 33), checked as `checkIntegration` checks an integration's,
+ * with its fixed account: a refused fixed account fails the app, whose connection still gets it.
+ */
+const dryConnectionApps = (checking: Parameters<typeof checkIntegration>[0], row: IntegrationRow) =>
+  Effect.forEach(
+    connectionPlans(checking.snapshot, checking.firstParty, row),
+    ({ row: connection }) => {
+      const app = {
+        connection: connection.row_id,
+        label: connection.name,
+        owner: connection.owner,
+        name: connectionAppName(checking.snapshot, row, connection),
+      };
+      const failed = (
+        error: unknown,
+      ): Effect.Effect<Pick<ConnectionAppOutcome, "status" | "reason">, unknown> =>
+        transient(error)
+          ? Effect.fail(error)
+          : Effect.succeed({ status: "failed", reason: clip(refusal(error)) });
+      return checkIntegration(checking, row, connection).pipe(
+        Effect.flatMap((checked) =>
+          checkFixedAccount(checking, row, checked.accounts, connection).pipe(
+            Effect.as<Pick<ConnectionAppOutcome, "status" | "reason">>({ status: "planned" }),
+            Effect.catch(failed),
+            Effect.map((result): ConnectionAppOutcome => ({
+              ...app,
+              ...result,
+              rules: checked.rules,
+              accounts: checked.accounts,
+            })),
+          ),
+        ),
+        Effect.catch((error) =>
+          failed(error).pipe(Effect.map((result): ConnectionAppOutcome => ({ ...app, ...result }))),
+        ),
+      );
+    },
+  );
+
+/** The integrations a dry run plans as an app per connection, by row id. */
+const splitIntegrations = (outcomes: readonly Outcome[]): ReadonlySet<string> =>
+  new Set(
+    outcomes.flatMap((outcome) =>
+      outcome.kind === "integration" && outcome.apps !== undefined ? [outcome.id] : [],
+    ),
+  );
+
+/**
+ * The apps a dry run built: the accounts the app a connection's account goes to takes, its
+ * integration's or its own (decision 33). An app that did not build has none, as an import would
+ * have imported no app for it.
+ */
+const builtApps = (outcomes: readonly Outcome[]) => {
+  const byIntegration = new Map(
+    outcomes.flatMap((outcome) => (outcome.kind === "integration" ? [[outcome.id, outcome]] : [])),
+  );
+  return (
+    integration: string,
+    connection: string,
+  ): { readonly accounts: AppAccountRequirements; readonly scope: AppScope } | undefined => {
+    const outcome = byIntegration.get(integration);
+    if (outcome?.apps === undefined)
+      return outcome?.accounts === undefined
+        ? undefined
+        : { accounts: outcome.accounts, scope: "integration" };
+    const own = outcome.apps.find((app) => app.connection === connection)?.accounts;
+    return own === undefined ? undefined : { accounts: own, scope: "own" };
+  };
 };
 
+/**
+ * Decide each connection as `importConnectionItem` would, writing nothing: its plan, its app, and
+ * the account `importAccount` would save, checked against its app's build (`checkAccount`), so
+ * every account an import would refuse is refused here with the same reason. Each secret the
+ * import reads is read too and kept nowhere; an org connection's secret a member saved is read in
+ * every member's partition, to report members who hold different values, compared in memory.
+ */
 const dryConnections = (
   assessment: Assessment,
   organization: string,
   ids: readonly string[],
   stale: StaleIntegrations,
+  apps: ReturnType<typeof builtApps>,
 ) =>
   Effect.gen(function* () {
-    const { source, snapshot, firstParty, mismatchOf } = yield* dryContext(
+    const { source, snapshot, executor, firstParty, mismatchOf } = yield* dryContext(
       assessment,
       organization,
       ["integrations", "connections", "clients"],
@@ -808,8 +1343,7 @@ const dryConnections = (
           return plan.stale === null
             ? ({
                 ...base,
-                status: "failed",
-                reason: plan.reason,
+                ...connectionRefusal(new ItemFailed({ reason: plan.reason }), mismatchOf(row)),
                 firstParty: mismatchOf(row),
               } satisfies Outcome)
             : ({
@@ -818,41 +1352,49 @@ const dryConnections = (
                 reason: plan.reason,
                 stale: plan.stale,
               } satisfies Outcome);
-        // Read every secret the import would, and keep none of them. An org connection's secret
-        // a member saved is read in every member's partition, to report members who hold
-        // different values; they are compared in memory.
-        const reads = yield* Effect.forEach(connectionSecrets(plan.value), (item) =>
-          readSecretCompared({ source, snapshot }, row, item).pipe(
-            Effect.map((read) => ({ read, failed: undefined })),
-            Effect.catchTag("ItemFailed", (failed) => Effect.succeed({ read: undefined, failed })),
-          ),
-        );
-        const failures = reads.map((read) => read.failed);
-        const failed =
-          failures.find((failure) => failure?.vault === "unavailable") ??
-          failures.find((failure) => failure !== undefined);
-        const differing = reads.flatMap(({ read }) =>
-          read !== undefined && read.values > 1
-            ? [{ members: read.holders, values: read.values }]
-            : [],
+        const built = integration === undefined ? undefined : apps(integration.row_id, row.row_id);
+        if (built === undefined)
+          return { ...base, status: "failed", reason: integrationNotImported } satisfies Outcome;
+        const { accounts, scope } = built;
+        if (needsNoAccount(plan.value, accounts))
+          return { ...base, status: "planned" } satisfies Outcome;
+        const differing: Array<{ readonly members: number; readonly values: number }> = [];
+        const refusedBy = yield* checkAccount(
+          { executor, source, snapshot, firstParty, owner: OwnerId.make(`v1:${organization}`) },
+          plan.value,
+          accounts,
+          (item) =>
+            readSecretCompared({ source, snapshot }, row, item).pipe(
+              Effect.map((read) => {
+                if (read.values > 1) differing.push({ members: read.holders, values: read.values });
+                return read.value;
+              }),
+            ),
+          scope,
+        ).pipe(
+          Effect.as(undefined),
+          Effect.catch((error) => (transient(error) ? Effect.fail(error) : Effect.succeed(error))),
         );
-        if (failed === undefined)
+        if (refusedBy !== undefined)
           return {
-            kind: "connection",
-            id,
-            label: row.name,
-            context,
-            status: "planned",
-            ...(differing[0] === undefined
-              ? {}
-              : {
-                  memberSecrets: {
-                    members: Math.max(...differing.map((entry) => entry.members)),
-                    values: Math.max(...differing.map((entry) => entry.values)),
-                  },
-                }),
+            ...base,
+            ...connectionRefusal(refusedBy, undefined),
+            ...(refusedBy instanceof ItemFailed && refusedBy.vault !== undefined
+              ? { vaultFailed: refusedBy.vault }
+              : {}),
           } satisfies Outcome;
-        return { ...base, ...refusalOutcome(failed), vaultFailed: failed.vault } satisfies Outcome;
+        return {
+          ...base,
+          status: "planned",
+          ...(differing.length === 0
+            ? {}
+            : {
+                memberSecrets: {
+                  members: Math.max(...differing.map((entry) => entry.members)),
+                  values: Math.max(...differing.map((entry) => entry.values)),
+                },
+              }),
+        } satisfies Outcome;
       }),
     );
   });
@@ -868,7 +1410,10 @@ const dryPolicies = (
       "integrations",
       "policies",
     ]);
-    return yield* Effect.forEach(snapshot.policies, (row) =>
+    // Only the rules the assessment plans, as an import moves: none when v1's data stays in v1.
+    const planned = new Set(assessment.items.policies);
+    const rows = snapshot.policies.filter((row) => planned.has(row.row_id));
+    return yield* Effect.forEach(rows, (row) =>
       Effect.gen(function* () {
         const decided = policyDecision(snapshot, row);
         const base = {
@@ -891,15 +1436,18 @@ const dryPolicies = (
     );
   });
 
-const dryToolkits = (assessment: Assessment, organization: string) =>
+const dryToolkits = (assessment: Assessment, organization: string, split: ReadonlySet<string>) =>
   Effect.gen(function* () {
     const { source, snapshot, firstParty } = yield* dryContext(
       assessment,
       organization,
       allSnapshotTables,
     );
-    const lookup = plannedLookup(snapshot, firstParty);
-    return yield* Effect.forEach(snapshot.toolkits, (row) =>
+    const lookup = plannedLookup(snapshot, firstParty, split);
+    // Only the toolkits the assessment plans, as an import moves: none when v1's data stays in v1.
+    const planned = new Set(assessment.items.toolkits);
+    const rows = snapshot.toolkits.filter((row) => planned.has(row.row_id));
+    return yield* Effect.forEach(rows, (row) =>
       Effect.gen(function* () {
         const toolkit = decodeToolkit(row, snapshot.toolkitRules);
         if (toolkit === undefined)
@@ -940,14 +1488,14 @@ const artifactRows = (
     : source.artifacts(snapshot.tenant, snapshot.subjects, [first, ...rest]);
 };
 
-const dryArtifacts = (assessment: Assessment, organization: string) =>
+const dryArtifacts = (assessment: Assessment, organization: string, split: ReadonlySet<string>) =>
   Effect.gen(function* () {
     const { source, snapshot, firstParty } = yield* dryContext(assessment, organization, [
       "integrations",
       "connections",
       "clients",
     ]);
-    const lookup = plannedLookup(snapshot, firstParty);
+    const lookup = plannedLookup(snapshot, firstParty, split);
     const rows = yield* artifactRows(source, snapshot, assessment.items.artifacts);
     return yield* Effect.forEach(rows, (row) =>
       artifactMapping(snapshot, lookup, row).pipe(
@@ -971,6 +1519,11 @@ const dryArtifacts = (assessment: Assessment, organization: string) =>
 
 interface Identity {
   readonly target: { readonly id: string; readonly slug: string };
+  /**
+   * The slug the organization took, and what became of a listed displacement. Absent from the
+   * identity steps recorded before displacements, whose report keeps the assessment's slug.
+   */
+  readonly slug?: V1OrgReport["slug"];
   readonly owner: string;
   /** WorkOS user id to v2 user id, for every imported member. */
   readonly users: ReadonlyArray<readonly [string, string]>;
@@ -998,6 +1551,45 @@ const writeIdentity = (params: V1ImportParams, assessment: Assessment) =>
     const [owner, ...others] = assessment.members;
     if (owner === undefined || assessment.organization === null)
       return yield* new V1ImportUnavailable();
+    const billingHold =
+      assessment.carryOver === null || assessment.carryOver.subscription === null
+        ? null
+        : JSON.stringify(assessment.carryOver.subscription);
+    // A listed existing organization the assessment allowed, checked again as it is recorded. Its
+    // owner is already there; a copy's other members join it.
+    const into = assessment.into;
+    if (into !== undefined && into.refused === undefined && into.mode !== null) {
+      const moved = yield* importInto(sql, store, {
+        organization,
+        target: into.organization,
+        mode: into.mode,
+        member: owner,
+        email: memberProfile(yield* source.user(owner.user)).email,
+        billingHold,
+      });
+      const joined: Array<readonly [string, string]> = [[owner.user, moved.user]];
+      for (const member of others) {
+        const profile = memberProfile(yield* source.user(member.user));
+        const user = yield* importUser(sql, store, organization, member, profile);
+        yield* importMembership(sql, store, {
+          organization,
+          target: moved.target.id,
+          member,
+          user,
+        });
+        joined.push([member.user, user]);
+      }
+      return {
+        target: { id: moved.target.id, slug: moved.target.slug },
+        slug: {
+          v1: assessment.organization.slug,
+          v2: moved.target.slug,
+          changed: moved.target.slug !== assessment.organization.slug,
+        },
+        owner: moved.user,
+        users: joined,
+      } satisfies Identity;
+    }
     const users: Array<readonly [string, string]> = [];
     // Emails and names are read again here rather than kept in the assessment.
     for (const member of assessment.members) {
@@ -1006,12 +1598,15 @@ const writeIdentity = (params: V1ImportParams, assessment: Assessment) =>
     }
     const ownerUser = users[0]?.[1];
     if (ownerUser === undefined) return yield* new V1ImportUnavailable();
-    const target = yield* importOrganization(sql, store, {
+    const plan = yield* slugPlan(source, organization, assessment.organization.slug);
+    const { target, displaced } = yield* importOrganization(sql, store, {
       organization,
       owner: ownerUser,
       name: assessment.organization.name,
       slug: assessment.organization.slug,
-      candidates: yield* slugPlan(source, organization, assessment.organization.slug),
+      candidates: plan.candidates,
+      displacement: plan.displacement,
+      billingHold,
     });
     for (const [index, member] of others.entries()) {
       const user = users[index + 1]?.[1];
@@ -1020,6 +1615,12 @@ const writeIdentity = (params: V1ImportParams, assessment: Assessment) =>
     }
     return {
       target: { id: target.id, slug: target.slug },
+      slug: {
+        v1: assessment.organization.slug,
+        v2: target.slug,
+        changed: target.slug !== assessment.organization.slug,
+        ...(displaced === undefined ? {} : { displaced }),
+      },
       owner: ownerUser,
       users,
     } satisfies Identity;
@@ -1087,7 +1688,8 @@ const failedItem =
   (error: unknown) =>
     Effect.gen(function* () {
       if (transient(error)) return yield* Effect.fail(error);
-      const decided = refusalOutcome(error);
+      const decided: Pick<Outcome, "status" | "reason" | "stale" | "reconnect"> =
+        kind === "profile" ? connectionRefusal(error, base.firstParty) : refusalOutcome(error);
       const result: MapResult =
         decided.status === "skipped"
           ? { status: "skipped", reason: decided.reason ?? "" }
@@ -1096,6 +1698,7 @@ const failedItem =
       return {
         ...outcomeOf(base, result),
         ...(decided.stale === undefined ? {} : { stale: decided.stale }),
+        ...(decided.reconnect === undefined ? {} : { reconnect: decided.reconnect }),
         ...(base.firstParty === undefined || decided.stale !== undefined
           ? {}
           : { firstParty: base.firstParty }),
@@ -1146,48 +1749,142 @@ const importIntegrationItem = (context: ItemContext, id: string) =>
       } satisfies Outcome;
     const { row, hash } = found;
     const base = { kind: "integration", id, label: integrationLabel(row), context: null } as const;
+    // An integration an earlier run imported as an app per connection stays so (decision 33).
+    if ((yield* importedApps(context.store, context.snapshot, row))?.kind === "split")
+      return yield* importConnectionApps(context, row, hash, base);
     const existing = yield* context.store.find("integration", id);
-    if (
-      existing?.status === "imported" &&
-      existing.source_hash === hash &&
-      existing.v2_id !== null
-    ) {
-      // An earlier attempt may have stopped before the app's fixed account was saved.
+    const app =
+      existing?.status === "imported" && existing.v2_id !== null
+        ? AppId.make(existing.v2_id)
+        : undefined;
+    const since =
+      app === undefined ? "kept" : yield* context.store.sinceImported("integration", id);
+    // An app its users removed in v2 since stays removed.
+    if (since === "removed")
+      return { ...base, status: "skipped", reason: removedInV2 } satisfies Outcome;
+    if (app !== undefined && (existing?.source_hash === hash || since === "changed"))
+      // An earlier attempt may have stopped before the app's fixed account was saved. An app its
+      // users deployed again in v2 since stays as they made it.
       return yield* withFixedAccount(
         context,
         row,
-        AppId.make(existing.v2_id),
+        app,
         outcomeOf(base, {
           status: "imported",
           v2Kind: "app",
-          v2Id: existing.v2_id,
-          ...(existing.reason === null ? {} : { note: existing.reason }),
+          v2Id: app,
+          ...(since === "changed"
+            ? { note: keptInV2 }
+            : existing?.reason === null || existing?.reason === undefined
+              ? {}
+              : { note: existing.reason }),
         }),
       );
-    }
-    const app =
-      existing?.status === "imported" && existing.v2_id !== null
-        ? AppId.make(existing.v2_id)
-        : undefined;
-    return yield* importIntegration(context, row, app).pipe(
-      Effect.tap(({ result }) => recorded(context, "integration", id, hash)(result)),
-      Effect.map(({ result, app: deployed, traced, stale, dropped }) => ({
-        deployed,
-        outcome: {
-          ...outcomeOf(base, result),
-          traced,
-          staleTools: stale,
-          droppedCredentials: dropped,
-        },
-      })),
-      Effect.catch(failedItem(context, "integration", id, hash, base)),
-      // The app's fixed account, once the app is recorded, so a retry keeps the app.
-      Effect.flatMap((done) =>
-        "deployed" in done
-          ? withFixedAccount(context, row, done.deployed, done.outcome)
-          : Effect.succeed(done),
+    const whole = yield* importIntegration(context, row, app).pipe(
+      Effect.tap((done) =>
+        done.kind === "one" ? recorded(context, "integration", id, hash)(done.result) : Effect.void,
+      ),
+      Effect.catch((error) =>
+        failedItem(
+          context,
+          "integration",
+          id,
+          hash,
+          base,
+        )(error).pipe(Effect.map((outcome) => ({ kind: "failed" as const, outcome }))),
       ),
     );
+    if (whole.kind === "failed") return whole.outcome;
+    // Its connections' rules differ, so each moves as its own app (decision 33).
+    if (whole.kind === "split") return yield* importConnectionApps(context, row, hash, base);
+    // The app's fixed account, once the app is recorded, so a retry keeps the app.
+    return yield* withFixedAccount(context, row, whole.app, {
+      ...outcomeOf(base, whole.result),
+      traced: whole.traced,
+      staleTools: whole.stale,
+      droppedCredentials: whole.dropped,
+    });
+  });
+
+/**
+ * Each moving connection's own app (decision 33), as `importIntegrationItem` imports an
+ * integration's one app: each is recorded by its connection (`connection_app`), an app its users
+ * removed in v2 since stays removed, one they deployed again stays as they made it, and an app is
+ * deployed again only when v1 changed. The integration fails when any of its apps does.
+ */
+const importConnectionApps = (
+  context: ItemContext,
+  row: IntegrationRow,
+  hash: string,
+  base: Pick<Outcome, "kind" | "id" | "label" | "context">,
+) =>
+  Effect.gen(function* () {
+    const apps: ConnectionAppOutcome[] = [];
+    let left: Pick<Outcome, "traced" | "staleTools" | "droppedCredentials"> = {};
+    for (const { row: connection } of connectionPlans(context.snapshot, context.firstParty, row)) {
+      const key = connection.row_id;
+      const appHash = yield* sourceHash([hash, key]);
+      const app = {
+        connection: key,
+        label: connection.name,
+        owner: connection.owner,
+        name: connectionAppName(context.snapshot, row, connection),
+      };
+      const existing = yield* context.store.find("connection_app", key);
+      const earlier =
+        existing?.status === "imported" && existing.v2_id !== null
+          ? AppId.make(existing.v2_id)
+          : undefined;
+      const since =
+        earlier === undefined ? "kept" : yield* context.store.sinceImported("connection_app", key);
+      const withAccount = (outcome: ConnectionAppOutcome, deployed: AppId) =>
+        importFixedAccount(context, row, deployed, connection).pipe(
+          Effect.as(outcome),
+          Effect.catch((error) =>
+            transient(error)
+              ? Effect.fail(error)
+              : Effect.succeed<ConnectionAppOutcome>({
+                  ...outcome,
+                  status: "failed",
+                  reason: clip(refusal(error)),
+                }),
+          ),
+        );
+      if (since === "removed") {
+        apps.push({ ...app, status: "skipped", reason: removedInV2, v2Id: earlier });
+        continue;
+      }
+      if (earlier !== undefined && (existing?.source_hash === appHash || since === "changed")) {
+        apps.push(yield* withAccount({ ...app, status: "imported", v2Id: earlier }, earlier));
+        continue;
+      }
+      const done = yield* importConnectionApp(context, row, connection, earlier).pipe(
+        Effect.tap(({ result }) => recorded(context, "connection_app", key, appHash)(result)),
+        Effect.map((imported) => ({ kind: "imported" as const, ...imported })),
+        Effect.catch((error) =>
+          failedItem(
+            context,
+            "connection_app",
+            key,
+            appHash,
+            base,
+          )(error).pipe(Effect.map((outcome) => ({ kind: "failed" as const, outcome }))),
+        ),
+      );
+      if (done.kind === "failed") {
+        apps.push({ ...app, status: done.outcome.status, reason: done.outcome.reason });
+        continue;
+      }
+      if (left.traced === undefined)
+        left = { traced: done.traced, staleTools: done.stale, droppedCredentials: done.dropped };
+      apps.push(
+        yield* withAccount(
+          { ...app, name: done.name, status: "imported", v2Id: done.app, rules: done.rules },
+          done.app,
+        ),
+      );
+    }
+    return splitOutcome(base, "imported", apps, left);
   });
 
 /**
@@ -1214,7 +1911,12 @@ const withFixedAccount = (
  * A connection is imported once its account is saved and linked to its app, which its `profile`
  * row records (see `mapLookup`).
  */
-const importConnectionItem = (context: ImportContext, id: string, stale: StaleIntegrations) =>
+const importConnectionItem = (
+  context: ImportContext,
+  id: string,
+  stale: StaleIntegrations,
+  tookV1: ReadonlySet<string>,
+) =>
   Effect.gen(function* () {
     const { snapshot, store, executor, firstParty } = context;
     const row = snapshot.connections.find((candidate) => candidate.row_id === id);
@@ -1252,34 +1954,47 @@ const importConnectionItem = (context: ImportContext, id: string, stale: StaleIn
     const linked = yield* store.find("profile", id);
     if (linked?.status === "imported" && linked.v2_id !== null) {
       const saved = yield* store.find("connection", id);
+      const account =
+        saved?.status === "imported" && saved.v2_id !== null ? saved.v2_id : undefined;
+      // An account its users removed in v2 since stays removed; verification leaves it out.
+      if (account !== undefined && (yield* store.sinceImported("connection", id)) === "removed")
+        return { ...base, status: "skipped", reason: removedInV2, v2Id: account } satisfies Outcome;
+      // An account an earlier run saved took v1's tokens before anything deployed, if they were
+      // newer (`refreshCopiedGrants`), and follows its app's provider (`updateCopiedAccount`).
+      const updated =
+        account === undefined
+          ? { tokens: "kept" as const, followed: false }
+          : yield* updateCopiedAccount(context, row, AccountId.make(account));
+      const notes = [
+        ...(updated.tokens === "replaced" || tookV1.has(id) ? [tookV1Note] : []),
+        ...(updated.followed ? [followedNote] : []),
+      ];
       return outcomeOf(base, {
         status: "imported",
         v2Kind: "account",
-        v2Id:
-          linked.v2_kind === "profile" && saved?.status === "imported" && saved.v2_id !== null
-            ? saved.v2_id
-            : linked.v2_id,
+        v2Id: linked.v2_kind === "profile" && account !== undefined ? account : linked.v2_id,
+        ...(notes.length === 0 ? {} : { note: notes.join(" ") }),
       });
     }
     return yield* Effect.gen(function* () {
       const plan = connectionPlan(snapshot, firstParty, row);
       if (!plan.ok) return yield* refused(plan);
-      const appRow =
-        integration === undefined
-          ? undefined
-          : yield* store.find("integration", integration.row_id);
-      if (appRow?.status !== "imported" || appRow.v2_id === null)
-        return yield* new ItemFailed({ reason: "Its integration was not imported." });
+      // Its integration's one app, or its own (decision 33).
+      const found = yield* connectionAppOf(store, snapshot, row);
+      if (found === undefined) return yield* new ItemFailed({ reason: integrationNotImported });
+      // The app its users removed in v2 since takes no new connections.
+      const since =
+        found.scope === "own"
+          ? yield* store.sinceImported("connection_app", row.row_id)
+          : yield* store.sinceImported("integration", found.integration.row_id);
+      if (since === "removed")
+        return { ...base, status: "skipped", reason: removedInV2 } satisfies Outcome;
       const app = yield* executor.apps.get({
         owner: organizationOwner(context.target.id),
-        app: AppId.make(appRow.v2_id),
+        app: found.app,
       });
       // A public app needs no account or link.
-      if (
-        plan.value.access.kind === "none" &&
-        app.requirements.accounts.service === undefined &&
-        app.requirements.accounts.workspace === undefined
-      ) {
+      if (needsNoAccount(plan.value, app.requirements.accounts)) {
         const result: MapResult = { status: "imported", v2Kind: "app", v2Id: app.id };
         yield* recorded(context, "profile", id, hash)(result);
         return outcomeOf(base, result);
@@ -1293,6 +2008,7 @@ const importConnectionItem = (context: ImportContext, id: string, stale: StaleIn
               plan.value,
               app,
               recorded(context, "connection", id, hash),
+              found.scope,
             );
       yield* linkConnectionAccount(context, row, app, account);
       const result: MapResult = { status: "imported", v2Kind: "account", v2Id: account };
@@ -1340,14 +2056,17 @@ const importPolicyItem = (
     // The rule is already in each matching app's tools.ts. One that matches none of the tools v1
     // last listed still moves, for tools the server may list again.
     const apps: string[] = [];
-    for (const integration of decided.integrations) {
-      const found = yield* store.find("integration", integration);
-      if (found?.status === "imported" && found.v2_id !== null) apps.push(found.v2_id);
+    for (const id of decided.integrations) {
+      const integration = snapshot.integrations.find((candidate) => candidate.row_id === id);
+      const found =
+        integration === undefined ? undefined : yield* importedApps(store, snapshot, integration);
+      if (found?.kind === "one") apps.push(found.app);
+      else if (found?.kind === "split") apps.push(...found.apps.values());
     }
     const matches = yield* policyMatches(context.source, snapshot, row.pattern, dropped);
     const result: MapResult =
       apps[0] === undefined
-        ? { status: "failed", reason: "Its integration was not imported." }
+        ? { status: "failed", reason: integrationNotImported }
         : {
             status: "imported",
             v2Kind: "app",
@@ -1387,12 +2106,45 @@ const importToolkitItem = (context: ItemContext, id: string) =>
     const members = toolkitMembers(toolkit, snapshot.subjects);
     const copies = yield* Effect.forEach(members, (member) => {
       const key = toolkitCopyKey(toolkit, member);
-      // Its connection follows the apps and accounts imported since; saving it again is safe.
-      return importToolkit(context, toolkit, member).pipe(
-        Effect.tap(recorded(context, "toolkit", key, hash)),
-        Effect.map((result) => outcomeOf(base, result)),
-        Effect.catch(failedItem(context, "toolkit", key, hash, base)),
-      );
+      return Effect.gen(function* () {
+        // The opt-in import keyed its one copy by the toolkit alone; a move into its organization
+        // records that copy under the member's key instead of making them another.
+        const user = context.users.get(member);
+        const found = yield* context.store.find("toolkit", key);
+        const existing =
+          found === undefined &&
+          user !== undefined &&
+          (yield* context.store.adoptToolkitCopy({
+            organization: context.snapshot.tenant,
+            toolkit: toolkit.row.row_id,
+            member,
+            user,
+          }))
+            ? yield* context.store.find("toolkit", key)
+            : found;
+        const since =
+          existing?.status === "imported" && existing.v2_id !== null
+            ? yield* context.store.sinceImported("toolkit", key)
+            : "kept";
+        // A copy its member removed or changed in v2 since stays as they left it.
+        if (since === "removed")
+          return { ...base, status: "skipped", reason: removedInV2 } satisfies Outcome;
+        if (since === "changed" && existing?.v2_id !== null && existing?.v2_id !== undefined)
+          return outcomeOf(base, {
+            status: "imported",
+            v2Kind: "mcp_connection",
+            v2Id: existing.v2_id,
+            note: keptInV2,
+          });
+        // Otherwise its connection follows the apps and accounts imported since; saving it again
+        // is safe.
+        const copy = existing?.status === "imported" ? existing.v2_id : null;
+        return yield* importToolkit(context, toolkit, member, copy ?? undefined).pipe(
+          Effect.tap(recorded(context, "toolkit", key, hash)),
+          Effect.map((result) => outcomeOf(base, result)),
+          Effect.catch(failedItem(context, "toolkit", key, hash, base)),
+        );
+      });
     });
     const failed = copies.find((copy) => copy.status === "failed");
     const first = copies[0];
@@ -1420,16 +2172,31 @@ const importArtifactItem = (context: ItemContext, id: string) =>
         reason: "It no longer exists in v1.",
       } satisfies Outcome;
     const base = { kind: "artifact", id, label: row.title, context: null } as const;
-    const mapping = yield* artifactMapping(snapshot, mapLookup(store), row);
+    const mapping = yield* artifactMapping(snapshot, mapLookup(store, snapshot), row);
     // Its source and the mapping written into it.
     const hash = yield* sourceHash({ artifact: row, mapping });
     const existing = yield* store.find("artifact", id);
-    if (existing?.status === "imported" && existing.source_hash === hash && existing.v2_id !== null)
+    const since =
+      existing?.status === "imported" && existing.v2_id !== null
+        ? yield* store.sinceImported("artifact", id)
+        : "kept";
+    // An app its users removed or deployed again in v2 since stays as they left it.
+    if (since === "removed")
+      return { ...base, status: "skipped", reason: removedInV2 } satisfies Outcome;
+    if (
+      existing?.status === "imported" &&
+      existing.v2_id !== null &&
+      (existing.source_hash === hash || since === "changed")
+    )
       return outcomeOf(base, {
         status: "imported",
         v2Kind: existing.v2_kind ?? undeployedApp,
         v2Id: existing.v2_id,
-        ...(existing.reason === null ? {} : { note: existing.reason }),
+        ...(since === "changed"
+          ? { note: keptInV2 }
+          : existing.reason === null
+            ? {}
+            : { note: existing.reason }),
       });
     const app =
       existing?.status === "imported" && existing.v2_id !== null
@@ -1456,9 +2223,10 @@ interface Verified {
 const MemberCount = Schema.Array(Schema.Struct({ members: Schema.NumberFromString }));
 
 /**
- * Cutover step 4 (`V1ImportVerification`): every planned item has a result and none failed, the
- * v2 organization's members are exactly the planned ones, every imported account's credentials
- * decrypt, and every imported integration's app has an active version. Returns the counts and
+ * Cutover step 4 (`V1ImportVerification`): every planned item has a result and none failed, every
+ * planned member is a member of the v2 organization, every imported account its users have not
+ * removed since has credentials that decrypt, and every imported integration's app has an active
+ * version. Members its users added in v2 after an earlier run are theirs. Returns the counts and
  * each problem found.
  */
 const verify = (
@@ -1484,24 +2252,47 @@ const verify = (
     const failed = outcomes.filter((outcome) => outcome.status === "failed").length;
     if (failed > 0) problems.push(`${failed} items failed.`);
 
-    const inV2 = Number(
-      (yield* context.sql`
-        select count(*)::text as members from member where "organizationId" = ${context.target.id}
+    const plannedUsers = members.flatMap((member) => {
+      const user = context.users.get(member.user);
+      return user === undefined ? [] : [user];
+    });
+    const inV2 =
+      plannedUsers.length === 0
+        ? 0
+        : Number(
+            (yield* context.sql`
+        select count(*)::text as members from member
+        where "organizationId" = ${context.target.id} and ${context.sql.in("userId", plannedUsers)}
       `.pipe(
-        Effect.flatMap(Schema.decodeUnknownEffect(MemberCount)),
-        Effect.mapError(() => new V1ImportUnavailable()),
-      ))[0]?.members ?? 0,
-    );
+              Effect.flatMap(Schema.decodeUnknownEffect(MemberCount)),
+              Effect.mapError(() => new V1ImportUnavailable()),
+            ))[0]?.members ?? 0,
+          );
     const unmapped = members.filter((member) => !context.users.has(member.user)).length;
     if (unmapped > 0) problems.push(`${unmapped} members have no v2 user.`);
     if (inV2 !== members.length)
-      problems.push(`The v2 organization has ${inV2} members; ${members.length} were planned.`);
+      problems.push(`The v2 organization has ${inV2} of the ${members.length} planned members.`);
 
-    const accounts = new Set(
-      (yield* context.store.rows(organization))
-        .filter((row) => row.status === "imported" && row.v2_kind === "account")
-        .flatMap((row) => (row.v2_id === null ? [] : [row.v2_id])),
+    const removed = new Set(
+      outcomes.flatMap((outcome) =>
+        outcome.reason === removedInV2 && outcome.v2Id !== undefined ? [outcome.v2Id] : [],
+      ),
     );
+    // A connection v1 no longer has is not planned; its account is left out too when its users
+    // removed it in v2 since an earlier run imported it.
+    const plannedConnections = new Set(items.connections);
+    const accounts = new Set<string>();
+    for (const row of yield* context.store.rows(organization)) {
+      if (row.status !== "imported" || row.v2_kind !== "account" || row.v2_id === null) continue;
+      if (removed.has(row.v2_id)) continue;
+      if (
+        (row.v1_kind === "connection" || row.v1_kind === "profile") &&
+        !plannedConnections.has(row.v1_id) &&
+        (yield* context.store.sinceImported("connection", row.v1_id)) === "removed"
+      )
+        continue;
+      accounts.add(row.v2_id);
+    }
     let unreadable = 0;
     for (const account of accounts)
       if (!(yield* context.executor[OAuthGrantImport].credentialsReadable(AccountId.make(account))))
@@ -1511,22 +2302,31 @@ const verify = (
 
     let apps = 0;
     let withoutVersion = 0;
-    for (const outcome of outcomes)
-      if (
-        outcome.kind === "integration" &&
-        outcome.status === "imported" &&
-        outcome.v2Id !== undefined
-      ) {
-        apps++;
-        const app = yield* context.executor.apps.get({
-          owner: organizationOwner(context.target.id),
-          app: AppId.make(outcome.v2Id),
-        });
-        if (app.activeVersion === null) {
-          withoutVersion++;
-          problems.push(`${outcome.label} has no active version.`);
-        }
+    // Each integration's app, or each of its connections' own apps (decision 33).
+    const imported = outcomes.flatMap((outcome) =>
+      outcome.kind !== "integration" || outcome.status !== "imported"
+        ? []
+        : outcome.apps === undefined
+          ? outcome.v2Id === undefined
+            ? []
+            : [{ label: outcome.label, id: outcome.v2Id }]
+          : outcome.apps.flatMap((app) =>
+              app.status === "imported" && app.v2Id !== undefined
+                ? [{ label: app.name, id: app.v2Id }]
+                : [],
+            ),
+    );
+    for (const { label, id } of imported) {
+      apps++;
+      const app = yield* context.executor.apps.get({
+        owner: organizationOwner(context.target.id),
+        app: AppId.make(id),
+      });
+      if (app.activeVersion === null) {
+        withoutVersion++;
+        problems.push(`${label} has no active version.`);
       }
+    }
     const verification: V1ImportVerification = {
       items: {
         planned: Object.values(planned).reduce((sum, count) => sum + count, 0),
@@ -1552,7 +2352,7 @@ const verify = (
  */
 const blocking = (report: Omit<V1OrgReport, "status">, assessment: Assessment) =>
   report.integrationFailures.length > 0 ||
-  report.connectionFailures.length > 0 ||
+  report.connectionFailures.some((failure) => failure.reconnect !== true) ||
   report.firstPartyMismatches.length > 0 ||
   assessment.emailMatches.some((match) => match.match === "conflict");
 
@@ -1589,8 +2389,34 @@ interface Imported {
   readonly target: Identity["target"];
   readonly verification?: V1ImportVerification | undefined;
   readonly cutover?: boolean | undefined;
+  /** Whether a paid organization's subscription carried over, once the import tried. */
+  readonly billingCarried?: boolean | undefined;
 }
 
+/** The report's view of a paid organization's carry-over. */
+const billingReport = (assessment: Assessment, imported: Imported | undefined) => {
+  const carry = assessment.carryOver;
+  if (carry === null) return {};
+  const subscription = carry.subscription;
+  return {
+    billing: {
+      subscription:
+        subscription === null
+          ? null
+          : {
+              plan: subscription.planId,
+              version: subscription.version,
+              pricing: subscription.pricing.kind,
+              v2Pricing: v2Pricing(subscription),
+              trialing: subscription.trialEndsAt !== null,
+              cancelling: subscription.expiresAt !== null,
+            },
+      problem: carry.problem,
+      ...(imported?.billingCarried === undefined ? {} : { carried: imported.billingCarried }),
+    },
+  };
+};
+
 const reportOf = (
   params: V1ImportParams,
   assessment: Assessment,
@@ -1598,12 +2424,20 @@ const reportOf = (
   imported: Imported | undefined,
   people: ReportPeople,
 ): V1OrgReport => {
+  // Connections that cannot move with their account: failed ones block, the rest move to reconnect.
   const failedConnections = outcomes.filter(
-    (outcome) => outcome.kind === "connection" && outcome.status === "failed",
+    (outcome) =>
+      outcome.kind === "connection" && (outcome.status === "failed" || outcome.reconnect === true),
   );
-  const reasons = new Map<string, Outcome[]>();
-  for (const outcome of failedConnections)
-    reasons.set(outcome.reason ?? "", [...(reasons.get(outcome.reason ?? "") ?? []), outcome]);
+  const reasons = new Map<string, { reconnect: boolean; outcomes: Outcome[] }>();
+  for (const outcome of failedConnections) {
+    const reconnect = outcome.reconnect === true;
+    const key = JSON.stringify([outcome.reason ?? "", reconnect]);
+    reasons.set(key, {
+      reconnect,
+      outcomes: [...(reasons.get(key)?.outcomes ?? []), outcome],
+    });
+  }
   const firstParty = new Map<string, { mismatch: FirstPartyMismatch; connections: number }>();
   for (const outcome of outcomes)
     if (outcome.firstParty !== undefined) {
@@ -1619,6 +2453,13 @@ const reportOf = (
       (outcome) => outcome.kind === kind && (status === undefined || outcome.status === status),
     ).length;
   const done = params.mode === "import" ? "imported" : "planned";
+  // An integration that moves as an app per connection counts each of its apps (decision 33).
+  const apps = outcomes
+    .filter((outcome) => outcome.kind === "integration" && outcome.status === done)
+    .reduce(
+      (total, outcome) => total + (outcome.apps?.filter((app) => app.status === done).length ?? 1),
+      0,
+    );
   // Toolkits and artifacts are never stale: they move with what they can reach. An app that
   // moves can leave stale tools out.
   const staleItems: V1OrgReport["staleItems"] = outcomes.flatMap((outcome) => [
@@ -1663,7 +2504,7 @@ const reportOf = (
         users: members - merged,
         mergedUsers: merged,
         members,
-        apps: count("integration", done),
+        apps,
         accounts: count("connection", done),
         mcpConnections: outcomes
           .filter((outcome) => outcome.kind === "toolkit" && outcome.status === done)
@@ -1680,6 +2521,7 @@ const reportOf = (
       reason: member.reason,
     })),
     slug: assessment.slug,
+    ...(assessment.into === undefined ? {} : { into: assessment.into }),
     integrationFailures: outcomes.flatMap((outcome) =>
       outcome.kind === "integration" && outcome.status === "failed"
         ? [{ id: outcome.id, label: outcome.label, error: outcome.reason ?? "" }]
@@ -1690,8 +2532,9 @@ const reportOf = (
         ? [{ integration: outcome.label, tools: outcome.traced }]
         : [],
     ),
-    connectionFailures: [...reasons].map(([reason, connections]) => ({
-      reason,
+    connectionFailures: [...reasons.values()].map(({ reconnect, outcomes: connections }) => ({
+      reason: connections[0]?.reason ?? "",
+      ...(reconnect ? { reconnect: true as const } : {}),
       connections: connections.map((outcome) => ({
         id: outcome.id,
         label: outcome.label,
@@ -1737,9 +2580,31 @@ const reportOf = (
         ? [{ id: outcome.id, title: outcome.label, unmappedRoles: outcome.unmappedRoles ?? [] }]
         : [],
     ),
+    splitIntegrations: outcomes.flatMap((outcome) =>
+      outcome.kind === "integration" && outcome.apps !== undefined
+        ? [
+            {
+              id: outcome.id,
+              label: outcome.label,
+              apps: outcome.apps.map((app) => ({
+                connection: app.connection,
+                label: app.label,
+                owner: app.owner,
+                name: app.name,
+                status: app.status,
+                ...(app.v2Id === undefined ? {} : { v2Id: app.v2Id }),
+                ...(app.reason === undefined ? {} : { reason: app.reason }),
+                ...(app.rules === undefined ? {} : { rules: app.rules }),
+              })),
+            },
+          ]
+        : [],
+    ),
     flags: {
       sso: assessment.sso,
-      overFreeMemberLimit: assessment.billing?.kind === "free" && members > freeMembers,
+      overFreeMemberLimit:
+        (assessment.billing?.kind === "free" || assessment.billing?.kind === "grandfathered") &&
+        members > freeMembers,
       paidPlans:
         assessment.billing === null || assessment.billing.kind === "free"
           ? []
@@ -1757,6 +2622,7 @@ const reportOf = (
             },
           ],
     ),
+    ...billingReport(assessment, imported),
     ...(imported === undefined ? {} : { v2Organization: imported.target }),
     ...(imported?.verification === undefined ? {} : { verification: imported.verification }),
     ...(imported?.cutover === undefined ? {} : { cutover: imported.cutover }),
@@ -1907,6 +2773,47 @@ const cutOverInV1 = (organization: string, target: Identity["target"]) =>
     flag.set(organization, V1MovedState.Moved({ v2Organization: target.id, v2Slug: target.slug })),
   );
 
+/**
+ * v2's billing for a carry-over. A deployment without it never assesses a subscription as one that
+ * carries over (`assessCarryOver`), so a run there never asks.
+ */
+const importBilling = Effect.gen(function* () {
+  const environment = yield* V1ImportEnvironment;
+  if (Option.isNone(environment.billing))
+    return yield* Effect.die(new Error("This deployment cannot carry v1 billing over."));
+  return yield* environment.billing.value;
+});
+
+/**
+ * Carry the organization's v1 subscription over to its v2 organization (`carryOver`). Returns why
+ * it was refused, which no retry changes and which keeps the organization frozen; a transient
+ * failure retries the step, which reads Autumn back before it writes again.
+ */
+const carryOverStep = (params: V1ImportParams, identity: Identity, subscription: V1Subscription) =>
+  Effect.gen(function* () {
+    return yield* carryOver({
+      billing: yield* importBilling,
+      sql: yield* Effect.flatten(V1ImportDatabase),
+      v1Organization: params.v1OrgId,
+      organization: identity.target.id as OrganizationId,
+      subscription,
+    }).pipe(
+      Effect.as(undefined),
+      Effect.catchTag("CarryOverRefused", (error: CarryOverRefused) =>
+        Effect.succeed(`Its subscription did not carry over: ${error.reason}`),
+      ),
+    );
+  });
+
+/** v2's seat sync, now that the organization's billing is its own. */
+const syncCarriedSeats = (identity: Identity) =>
+  Effect.gen(function* () {
+    const billing = yield* importBilling;
+    yield* billing
+      .syncSeats(identity.target.id as OrganizationId)
+      .pipe(Effect.mapError(() => new V1ImportUnavailable()));
+  });
+
 /** What a person must do with an organization that could not be cut over. */
 export const notCutOver =
   "It was imported and verified, but v1 could not be told it moved, so it stays frozen in v1.";
@@ -1948,8 +2855,8 @@ export const reportPeopleUnread =
   "Its members' emails could not be read from v1's WorkOS, so the report leaves out its email matches and the owner its API keys act as.";
 
 /**
- * Move or check one organization. Import mode needs the deployment's write switch and, on v1's
- * real data, the organization on the allow-list (`writes.ts`), and holds back what a dry run only
+ * Move or check one organization. Import mode needs the deployment's write switch and the
+ * organization's row in `private_v1_import_allowed` (`writes.ts`), and holds back what a dry run only
  * reports. It follows "Cutover per organization": it freezes the organization in v1 before reading
  * anything it copies, imports it, verifies it, and only then marks it moved, so v1 forwards it. An
  * organization it copies nothing from is unfrozen again; one that fails after copying stays frozen
@@ -1966,8 +2873,17 @@ export const runV1Import = <S>(
 ) =>
   Effect.gen(function* () {
     const environment = yield* V1ImportEnvironment;
+    // Checked again in its own step, so the allow table is read once per instance, not on replay.
     const refusal =
-      params.mode === "import" ? importRefusal(environment.writes, [params.v1OrgId]) : undefined;
+      params.mode === "import"
+        ? yield* step("allowed", importRefusal(environment.writes, [params.v1OrgId])).pipe(
+            Effect.catchTag("V1ImportStepFailed", (error) =>
+              Effect.succeed(
+                `Its row in the allow table could not be read: v2's database kept failing (${error.failure}).`,
+              ),
+            ),
+          )
+        : undefined;
     if (refusal !== undefined) return yield* Effect.die(new Error(refusal));
     const organization = params.v1OrgId;
 
@@ -2077,11 +2993,12 @@ export const runV1Import = <S>(
           ),
         );
       const skippedIntegrations = staleIntegrations(outcomes);
+      const apps = builtApps(outcomes);
       for (const [index, batch] of chunks(items.connections, connectionBatch).entries())
         outcomes.push(
           ...(yield* step(
             `connections ${index}`,
-            dryConnections(assessment, organization, batch, skippedIntegrations).pipe(
+            dryConnections(assessment, organization, batch, skippedIntegrations, apps).pipe(
               unlessUnreadable((reason) =>
                 batch.map((id) => failedOutcome("connection", id, reason)),
               ),
@@ -2093,6 +3010,7 @@ export const runV1Import = <S>(
           )),
         );
       const dropped = droppedTools(outcomes);
+      const split = splitIntegrations(outcomes);
       const later = [
         [
           "policies",
@@ -2100,8 +3018,8 @@ export const runV1Import = <S>(
           "tool_policy",
           items.policies,
         ],
-        ["toolkits", dryToolkits(assessment, organization), "toolkit", items.toolkits],
-        ["artifacts", dryArtifacts(assessment, organization), "artifact", items.artifacts],
+        ["toolkits", dryToolkits(assessment, organization, split), "toolkit", items.toolkits],
+        ["artifacts", dryArtifacts(assessment, organization, split), "artifact", items.artifacts],
       ] as const;
       for (const [name, work, kind, ids] of later)
         outcomes.push(
@@ -2180,6 +3098,14 @@ export const runV1Import = <S>(
           Effect.succeed(ids.map((id) => unavailableOutcome(kind, id, error))),
         ),
       );
+    // Copied accounts take v1's final tokens before any deployment can renew their own.
+    const tookV1 = new Set<string>();
+    for (const [index, batch] of chunks(items.connections, connectionBatch).entries())
+      for (const id of yield* step(
+        `grants ${index}`,
+        Effect.flatMap(context, (ctx) => refreshCopiedGrants(ctx, batch)),
+      ).pipe(Effect.catchTag("V1ImportStepFailed", () => Effect.succeed([]))))
+        tookV1.add(id);
     for (const id of items.integrations)
       outcomes.push(
         yield* one("integration", `integration ${id}`, id, (ctx) => importIntegrationItem(ctx, id)),
@@ -2189,7 +3115,7 @@ export const runV1Import = <S>(
     for (const [index, batch] of chunks(items.connections, connectionBatch).entries())
       outcomes.push(
         ...(yield* many("connection", `connections ${index}`, batch, (ctx, id) =>
-          importConnectionItem(ctx, id, skippedIntegrations),
+          importConnectionItem(ctx, id, skippedIntegrations, tookV1),
         )),
       );
     const dropped = droppedTools(outcomes);
@@ -2221,7 +3147,30 @@ export const runV1Import = <S>(
         }),
       ),
     );
-    const problems = checked.problems;
+    const problems = [...checked.problems];
+    // A paid organization's subscription carries over last, once everything else verified, so v1
+    // bills it until the move is all but done. Its seats sync once it is v2's.
+    const subscription = assessment.carryOver?.subscription ?? null;
+    let billingCarried: boolean | undefined;
+    if (problems.length === 0 && subscription !== null) {
+      const refused = yield* step("billing", carryOverStep(params, identity, subscription)).pipe(
+        Effect.catchTag("V1ImportStepFailed", (error) =>
+          Effect.succeed(
+            `Its subscription could not be carried over: Autumn or v2 kept failing (${error.failure}).`,
+          ),
+        ),
+      );
+      billingCarried = refused === undefined;
+      if (refused !== undefined) problems.push(refused);
+      else
+        yield* step("billing seats", syncCarriedSeats(identity)).pipe(
+          Effect.catchTag("V1ImportStepFailed", () =>
+            Effect.sync(() => {
+              problems.push("Its seats could not be synced with its carried-over subscription.");
+            }),
+          ),
+        );
+    }
     // Cutover step 5, only once verification passed. Step 6 sends no email (decision 13).
     const cutOver =
       problems.length === 0 &&
@@ -2230,13 +3179,15 @@ export const runV1Import = <S>(
         Effect.catchTag("V1ImportStepFailed", () => Effect.succeed(false)),
       ));
     return yield* finish(
-      assessment,
+      // The slug the organization took, which a displacement that no longer applied changes.
+      identity.slug === undefined ? assessment : { ...assessment, slug: identity.slug },
       outcomes,
       {
         problems: problems.length === 0 && !cutOver ? [notCutOver] : problems,
         target: identity.target,
         verification: checked.verification,
         cutover: cutOver,
+        billingCarried,
       },
       identity,
       cutOver ? "cutover" : "failed",
diff --git a/apps/hosted/cloud/src/implementation/v1-import/source.ts b/apps/hosted/cloud/src/implementation/v1-import/source.ts
index 746dc8d244..f98cdf7658 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/source.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/source.ts
@@ -14,6 +14,7 @@ import {
   Schedule,
   Schema,
   Scope,
+  Stream,
 } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { SqlClient } from "effect/sql";
@@ -368,6 +369,8 @@ export const readTools = (
     return yield* sql`
       select owner, subject, connection, name,
         annotations::jsonb -> 'mcp' ->> 'toolName' as upstream,
+        coalesce(annotations::jsonb -> 'requiresApproval' = 'true'::jsonb, false)
+          as requires_approval,
         (select listed.tools_synced_at::float8 from connection listed
           where listed.tenant = tool.tenant and listed.integration = tool.integration
             and listed.owner = tool.owner and listed.subject = tool.subject
@@ -426,6 +429,67 @@ const readOnly = (request: HttpClientRequest.HttpClientRequest) =>
     ? Effect.succeed(request)
     : Effect.die(new Error(`The v1 import reads v1 only; it refused a ${request.method} request.`));
 
+/** The largest specification the import fetches, as large as an OpenAPI app's router downloads. */
+const maxSpecificationBytes = 40_000_000;
+
+/**
+ * Why the document at a specification URL could not be fetched. It never names the URL, which can
+ * carry a key in its user, host, port, path or query.
+ */
+export class SpecificationUnavailable extends Schema.TaggedError<SpecificationUnavailable>()(
+  "SpecificationUnavailable",
+  { reason: Schema.String },
+) {}
+
+/**
+ * The document at the URL v1 stored as an integration's specification, fetched once, as v1 fetched
+ * it when the integration was added: a GET without the integration's credentials, within 60
+ * seconds, of at most `maxSpecificationBytes`. Redirects are followed, as v1 followed them.
+ */
+export const fetchSpecification = (http: HttpClient.HttpClient, url: string) =>
+  Effect.gen(function* () {
+    const unavailable = (why: string) =>
+      new SpecificationUnavailable({
+        reason: `v1 stored its specification as a URL, and ${why}.`,
+      });
+    const response = yield* http
+      .execute(
+        HttpClientRequest.get(url).pipe(
+          HttpClientRequest.setHeader(
+            "accept",
+            "application/json, application/yaml, text/yaml, */*",
+          ),
+        ),
+      )
+      .pipe(Effect.mapError(() => unavailable("fetching it failed")));
+    if (response.status < 200 || response.status >= 300)
+      return yield* unavailable(`fetching it answered HTTP ${response.status}`);
+    const chunks = yield* response.stream.pipe(
+      Stream.mapError(() => unavailable("reading its document failed")),
+      Stream.limitBytes(maxSpecificationBytes, () =>
+        Stream.fail(unavailable(`its document is larger than ${maxSpecificationBytes} bytes`)),
+      ),
+      Stream.runCollect,
+    );
+    const bytes = new Uint8Array(chunks.reduce((size, chunk) => size + chunk.length, 0));
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return bytes;
+  }).pipe(
+    Effect.timeoutOrElse({
+      duration: "60 seconds",
+      orElse: () =>
+        Effect.fail(
+          new SpecificationUnavailable({
+            reason: "v1 stored its specification as a URL, and fetching it took over 60 seconds.",
+          }),
+        ),
+    }),
+  );
+
 /**
  * v1's state for one step: WorkOS, Vault, Postgres, blobs and billing. The scope is the step's: it
  * holds the one read-only Postgres client every read of the step shares, opened on the first, and
@@ -623,6 +687,20 @@ export const makeV1Source = (settings: V1SourceSettings) =>
           ),
           unavailable("billing"),
         ),
+      /**
+       * The organization's Autumn customer with each subscription's dates and the plan version it
+       * bills, for a paid organization whose subscription carries over (`billing.ts`).
+       */
+      customerPlans: (organization: string) =>
+        autumn.pipe(
+          Effect.flatMap((billing) =>
+            billing.getCustomerPlans({
+              customerId: organization,
+              expand: ["subscriptions.plan"],
+            }),
+          ),
+          unavailable("billing"),
+        ),
       /** The organization's row and these of its tables, as `readSnapshot` reads them. */
       snapshot: <T extends V1SnapshotTable>(
         tenant: string,
@@ -654,6 +732,7 @@ export const makeV1Source = (settings: V1SourceSettings) =>
       blob: (tenant: string, plugin: string, key: string) =>
         blobs.get(blobKey(tenant, plugin, key)),
       blobMissing: blobs.missing,
+      specification: (url: string) => fetchSpecification(http, url),
       /**
        * A secret value from v1's Vault. Undefined when the object is missing (WorkOS answers 404,
        * or 400 for a name it rejects). An outage or rate limit (5xx, 429 or no answer) is retried
diff --git a/apps/hosted/cloud/src/implementation/v1-import/store.ts b/apps/hosted/cloud/src/implementation/v1-import/store.ts
index a932527a25..ace63d2430 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/store.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/store.ts
@@ -10,16 +10,19 @@ import { V1ImportUnavailable } from "../../contracts/v1-import.ts";
 /**
  * Map kinds: the item kinds, plus `organization`, `user` and `membership` (the v2 identity),
  * `fixed_credentials`, the account an integration's app holds its fixed credentials in (by the
- * integration), and `profile`, which records a connection's link to its app beside its account.
- * `profile` keeps the name from when connections became profiles, so earlier rows still read; see
- * `mapLookup`. A toolkit has a row per member copy, keyed by the toolkit and the member
- * (`toolkitCopyKey`).
+ * integration, or for a connection's own app by the integration and the connection),
+ * `connection_app`, a connection's own app when its integration became an app per connection
+ * (decision 33, by the connection), and `profile`, which records a connection's link to its app
+ * beside its account. `profile` keeps the name from when connections became profiles, so earlier
+ * rows still read; see `mapLookup`. A toolkit has a row per member copy, keyed by the toolkit and
+ * the member (`toolkitCopyKey`).
  */
 export type MapKind =
   | "organization"
   | "user"
   | "membership"
   | "integration"
+  | "connection_app"
   | "fixed_credentials"
   | "connection"
   | "profile"
@@ -33,6 +36,16 @@ export type MapKind =
  */
 export const toolkitCopyId = (toolkitRow: string, member: string) => `${toolkitRow}:${member}`;
 
+/**
+ * The id the import gives a member's copy of a toolkit in a v2 organization, which v1 computes too
+ * when it forwards the toolkit's URL. A copy the opt-in import made before copies were per member
+ * keeps the id it got then (`adoptToolkitCopy`).
+ */
+export const toolkitCopyConnectionId = (organization: string, toolkitRow: string, member: string) =>
+  sourceHash([organization, toolkitRow, member]).pipe(
+    Effect.map((hash) => `v1-${hash.slice(0, 40)}`),
+  );
+
 export const MapRow = Schema.Struct({
   v1_kind: Schema.String,
   v1_id: Schema.String,
@@ -60,6 +73,8 @@ const Target = Schema.Struct({
   slug: Schema.NonEmptyString,
 });
 const Owned = Schema.Array(Target);
+const Since = Schema.Array(Schema.Struct({ removed: Schema.Boolean, changed: Schema.Boolean }));
+const Ids = Schema.Array(Schema.Struct({ id: Schema.String }));
 
 /** SHA-256 of the v1 rows an item was imported from, to skip it while they stay unchanged. */
 export const sourceHash = (value: unknown) =>
@@ -111,6 +126,120 @@ export const makeImportStore = (sql: SqlClient.SqlClient) => {
       where private_v1_import_map.v1_org_id = excluded.v1_org_id
     `.pipe(Effect.asVoid, unavailable);
   };
+  /**
+   * What became in v2, since its map row was written, of what an earlier run imported an item as:
+   * `removed`, `changed` by its users (an app deployed again, or a toolkit's connection saved
+   * again; the import records each after writing it), or `kept` as the import left it.
+   */
+  const sinceImported = (
+    kind: "integration" | "connection_app" | "artifact" | "connection" | "toolkit",
+    id: string,
+  ) =>
+    (kind === "connection"
+      ? sql`
+          select a.id is null as removed, false as changed from private_v1_import_map m
+          left join executor_accounts a on a.id = m.v2_id
+          where m.v1_kind = ${kind} and m.v1_id = ${id}
+        `
+      : kind === "toolkit"
+        ? // Removing a connection in v2 revokes it and keeps its row.
+          sql`
+            select c.id is null or c.revoked as removed,
+              coalesce(c."updatedAt" > m.updated_at, false) as changed
+            from private_v1_import_map m left join "mcpConnection" c on c.id = m.v2_id
+            where m.v1_kind = ${kind} and m.v1_id = ${id}
+          `
+        : sql`
+            select a.id is null as removed, exists (
+              select 1 from executor_deployments d
+              where d.code = a.code and d.created_at > (m.updated_at at time zone 'UTC')
+            ) as changed
+            from private_v1_import_map m left join executor_apps a on a.id = m.v2_id
+            where m.v1_kind = ${kind} and m.v1_id = ${id}
+          `
+    ).pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Since)),
+      Effect.map(([found]) =>
+        found === undefined || !(found.removed || found.changed)
+          ? ("kept" as const)
+          : found.removed
+            ? ("removed" as const)
+            : ("changed" as const),
+      ),
+      unavailable,
+    );
+  /**
+   * Record under a member's key the copy of a toolkit the opt-in import made for them, which it
+   * keyed by the toolkit alone (`toolkitCopyId`): its connection, result and the time it was
+   * written, so a later save in v2 still reads as theirs. Whether the member has such a copy.
+   */
+  const adoptToolkitCopy = (input: {
+    readonly organization: string;
+    readonly toolkit: string;
+    readonly member: string;
+    readonly user: string;
+  }) =>
+    sql`
+      insert into private_v1_import_map
+        (v1_org_id, v1_kind, v1_id, v2_kind, v2_id, status, reason, source_hash, updated_at)
+      select m.v1_org_id, m.v1_kind, ${toolkitCopyId(input.toolkit, input.member)}, m.v2_kind,
+        m.v2_id, m.status, m.reason, m.source_hash, m.updated_at
+      from private_v1_import_map m join "mcpConnection" c on c.id = m.v2_id
+      where m.v1_kind = 'toolkit' and m.v1_id = ${input.toolkit}
+        and m.v1_org_id = ${input.organization} and m.status = 'imported'
+        and c."userId" = ${input.user}
+      on conflict (v1_kind, v1_id) do nothing
+      returning v2_id as id
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      Effect.map((adopted) => adopted.length > 0),
+      unavailable,
+    );
+  /**
+   * The versions of an integration's app that the import deployed itself, oldest first: those
+   * made before its map row was last written, since the import records an app after deploying it.
+   */
+  const importedVersions = (integration: string) =>
+    sql`
+      select d.id from private_v1_import_map m
+      join executor_apps a on a.id = m.v2_id
+      join executor_deployments d on d.code = a.code
+      where m.v1_kind = 'integration' and m.v1_id = ${integration}
+        and d.created_at <= (m.updated_at at time zone 'UTC')
+      order by d.created_at, d.id
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      Effect.map((found) => found.map((row) => row.id)),
+      unavailable,
+    );
+  /**
+   * The integrations of an organization whose imported app runs a version deployed after the
+   * import recorded it: by its users, or by a repair.
+   */
+  const deployedSince = (organization: string) =>
+    sql`
+      select m.v1_id as id from private_v1_import_map m
+      join executor_apps a on a.id = m.v2_id
+      join executor_deployments d on d.id = a.active_deployment
+      where m.v1_org_id = ${organization} and m.v1_kind = 'integration' and m.status = 'imported'
+        and d.created_at > (m.updated_at at time zone 'UTC')
+      order by m.v1_id
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      Effect.map((found) => new Set(found.map((row) => row.id))),
+      unavailable,
+    );
+  /** Whether the import made this app for one of the organization's integrations. */
+  const importedApp = (organization: string, app: string) =>
+    sql`
+      select m.v1_id as id from private_v1_import_map m
+      where m.v1_org_id = ${organization} and m.v1_kind = 'integration' and m.status = 'imported'
+        and m.v2_id = ${app}
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      Effect.map((found) => found.length > 0),
+      unavailable,
+    );
   const target = (id: string) =>
     sql`select id, name, slug from organization where id = ${id}`.pipe(
       Effect.flatMap(Schema.decodeUnknownEffect(Owned)),
@@ -120,9 +249,16 @@ export const makeImportStore = (sql: SqlClient.SqlClient) => {
   /**
    * A new organization owned by the user, named after the v1 organization, at the first of
    * `candidates` no organization has, or none when every one is taken. Creating it queues the usual team, billing and default-app
-   * jobs. The user's first organization also completes onboarding.
+   * jobs. The user's first organization also completes onboarding. With `hold`, the same
+   * statement records the paid v1 subscription the organization's billing carries over from
+   * (`billing.ts`), so v2's billing never finds the organization without it.
    */
-  const createOrganization = (userId: string, name: string, candidates: readonly string[]) =>
+  const createOrganization = (
+    userId: string,
+    name: string,
+    candidates: readonly string[],
+    hold: { readonly v1Organization: string; readonly subscription: string } | null,
+  ) =>
     Effect.gen(function* () {
       for (const candidate of candidates) {
         const id = yield* Effect.sync(() => crypto.randomUUID());
@@ -140,6 +276,10 @@ export const makeImportStore = (sql: SqlClient.SqlClient) => {
           insert into cloud_organization_setup (user_id, organization_id, domain, applied)
             select ${userId}, owner."organizationId", null, true from owner
             on conflict (user_id) do nothing
+        ), hold as (
+          insert into private_v1_import_billing (organization_id, v1_org_id, state, subscription)
+            select created.id, ${hold?.v1Organization ?? null}, 'held', ${hold?.subscription ?? null}::jsonb
+            from created where ${hold !== null}
         ) select created.id, created.name, created.slug from created join owner
           on owner."organizationId" = created.id
         `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Owned)));
@@ -147,6 +287,51 @@ export const makeImportStore = (sql: SqlClient.SqlClient) => {
       }
       return undefined;
     }).pipe(unavailable);
-  return { rows, find, record, target, createOrganization };
+  /**
+   * Hold the billing of an organization an earlier run made, which may have none: one the
+   * opt-in import copied before its v1 subscription could carry over. A hold already there stays.
+   */
+  const holdBilling = (
+    organization: string,
+    hold: { readonly v1Organization: string; readonly subscription: string },
+  ) =>
+    sql`
+      insert into private_v1_import_billing (organization_id, v1_org_id, state, subscription)
+      values (${organization}, ${hold.v1Organization}, 'held', ${hold.subscription}::jsonb)
+      on conflict (organization_id) do nothing
+    `.pipe(Effect.asVoid, unavailable);
+  /**
+   * Rename a v2 organization from `from` to `to`, only while it still has `from`; whether it did.
+   * A plain update of the slug, as a rename in v2's settings is: the update queues the team's app
+   * domain again (`hosted_provision_team`).
+   */
+  const renameOrganization = (input: {
+    readonly holder: string;
+    readonly from: string;
+    readonly to: string;
+  }) =>
+    sql`
+      update organization set slug = ${input.to}
+      where id = ${input.holder} and slug = ${input.from}
+      returning id
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Ids)),
+      Effect.map((renamed) => renamed.length === 1),
+      unavailable,
+    );
+  return {
+    rows,
+    find,
+    record,
+    sinceImported,
+    adoptToolkitCopy,
+    importedVersions,
+    deployedSince,
+    importedApp,
+    target,
+    createOrganization,
+    holdBilling,
+    renameOrganization,
+  };
 };
 export type ImportStore = ReturnType<typeof makeImportStore>;
diff --git a/apps/hosted/cloud/src/implementation/v1-import/stored-document.ts b/apps/hosted/cloud/src/implementation/v1-import/stored-document.ts
new file mode 100644
index 0000000000..f67beacec0
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-import/stored-document.ts
@@ -0,0 +1,301 @@
+/**
+ * A stored OpenAPI document read one entry at a time: its top-level entries, its path items and its
+ * components, so the cut parses only what it reads. v1's Microsoft Graph presets store Microsoft's
+ * whole Graph document, over 40 MB of YAML, whose whole parse needs several times a Worker's memory.
+ * v1 never parsed it whole either: it compiled it entry by entry from its text (`structuralSplit` in
+ * v1's OpenAPI plugin). Every other document v1 parsed whole, and so does the import.
+ */
+import { JSON_SCHEMA, YAMLException, load as loadYaml } from "js-yaml";
+
+type Json = Record<string, unknown>;
+const isObject = (value: unknown): value is Json =>
+  typeof value === "object" && value !== null && !Array.isArray(value);
+
+/**
+ * A map read one entry at a time: a document, its `paths`, its `components` and each of their
+ * sections. Its keys are in the order a parsed object holds them; every other value is read whole.
+ */
+export class Entries {
+  readonly keys: readonly string[];
+  readonly #has: (key: string) => boolean;
+  readonly #read: (key: string) => unknown;
+  constructor(
+    keys: readonly string[],
+    has: (key: string) => boolean,
+    read: (key: string) => unknown,
+  ) {
+    this.keys = keys;
+    this.#has = has;
+    this.#read = read;
+  }
+  /** The value at a key, or undefined when the map has none. */
+  get(key: string): unknown {
+    return this.#has(key) ? this.#read(key) : undefined;
+  }
+}
+
+/** A map with no entries. */
+export const noEntries = new Entries(
+  [],
+  () => false,
+  () => undefined,
+);
+
+/** A map's entries: read entry by entry, or a parsed object's. Undefined for any other value. */
+export const mapEntries = (value: unknown) =>
+  value instanceof Entries
+    ? value
+    : isObject(value)
+      ? new Entries(
+          Object.keys(value),
+          (key) => Object.hasOwn(value, key),
+          (key) => value[key],
+        )
+      : undefined;
+
+/** A document parsed whole, read through the same entries. */
+export const parsedDocument = (document: Json) => mapEntries(document) ?? noEntries;
+
+/** The format of v1's Microsoft Graph presets, whose documents v1 compiled entry by entry. */
+export const microsoftGraphFormat = "microsoft-graph";
+
+/**
+ * The parser's reason up to the first quoted name, tag or value it carries, so a failure names the
+ * kind of error and never the specification's text.
+ */
+export const parserReason = (reason: string) => reason.split(/[:"'`!<]/)[0]?.trim() ?? "";
+
+// ---------------------------------------------------------------------------------------------
+// Block YAML, read entry by entry.
+
+const newline = 0x0a;
+const space = 0x20;
+const tab = 0x09;
+const carriageReturn = 0x0d;
+const hash = 0x23;
+const dash = 0x2d;
+
+const lossyUtf8 = new TextDecoder("utf-8");
+const yamlOptions = { schema: JSON_SCHEMA, json: true } as const;
+
+/** A line that carries structure: where it starts and ends (before its newline), and its indent. */
+interface Line {
+  readonly start: number;
+  readonly end: number;
+  readonly indent: number;
+  /** Counted from zero. */
+  readonly number: number;
+}
+
+/** Each line of a range but blank and comment lines. */
+function* significantLines(bytes: Uint8Array, from: number, to: number, number: number) {
+  let line = number;
+  for (let start = from; start < to; line++) {
+    const found = bytes.indexOf(newline, start);
+    const end = found === -1 || found >= to ? to : found;
+    let content = start;
+    while (content < end && bytes[content] === space) content++;
+    let rest = content;
+    while (
+      rest < end &&
+      (bytes[rest] === space || bytes[rest] === tab || bytes[rest] === carriageReturn)
+    )
+      rest++;
+    if (rest < end && bytes[content] !== hash)
+      yield { start, end, indent: content - start, number: line } satisfies Line;
+    start = end + 1;
+  }
+}
+
+/** Whether a line is a block list's entry (`- `), which can sit at its parent key's indent. */
+const listEntry = (bytes: Uint8Array, line: Line) => {
+  const at = line.start + line.indent;
+  const after = bytes[at + 1];
+  return (
+    bytes[at] === dash &&
+    (at + 1 >= line.end || after === space || after === carriageReturn || after === tab)
+  );
+};
+
+/**
+ * Where a simple key ends on a line: just after its `:`, for a plain, single- or double-quoted key
+ * followed by a space or the line's end. Undefined for any other line, such as an explicit (`?`),
+ * anchored or tagged key, or a line that holds no key.
+ */
+const keyEnd = (text: string, from: number) => {
+  let at = from;
+  const quote = text[at];
+  if (quote === "'" || quote === '"') {
+    // To the closing quote: a backslash escapes the next character in double quotes, and a
+    // doubled quote is one quote in single quotes.
+    for (at++; ; at++) {
+      if (at >= text.length) return undefined;
+      if (quote === '"' && text[at] === "\\") at++;
+      else if (text[at] === quote && quote === "'" && text[at + 1] === "'") at++;
+      else if (text[at] === quote) break;
+    }
+    for (at++; text[at] === " "; at++);
+    if (text[at] !== ":") return undefined;
+  } else {
+    if (quote === undefined || "?:,[]{}#&*!|>%@`\t".includes(quote)) return undefined;
+    for (at = text.indexOf(":", at); at !== -1; at = text.indexOf(":", at + 1)) {
+      const after = text[at + 1];
+      if (after === undefined || after === " " || after === "\r") break;
+    }
+    if (at === -1 || /\s#/u.test(text.slice(from, at))) return undefined;
+  }
+  const after = text[at + 1];
+  return after === undefined || after === " " || after === "\r" ? at + 1 : undefined;
+};
+
+/** The key a `key:` line names, as the parser reads it, or undefined when it names none. */
+const keyOf = (line: string) => {
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the YAML parser throws on input it cannot read
+  try {
+    const parsed: unknown = loadYaml(line, yamlOptions);
+    const keys = isObject(parsed) ? Object.keys(parsed) : [];
+    return keys.length === 1 ? keys[0] : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/** An entry's place in the text: from its key line to the next entry's. */
+interface Place {
+  readonly start: number;
+  readonly end: number;
+  readonly line: number;
+  readonly indent: number;
+  /** Whether its key line holds no value, so that a deeper block map can. */
+  readonly bare: boolean;
+}
+
+/**
+ * The block map of a range under a key at `parent` columns: each key line at the indent of the
+ * range's first line, which is deeper, and the lines under it up to the next. `none` when the range
+ * holds no block map, such as a list; `unreadable` with the line of a key this reader cannot read,
+ * or of a line between the two indents. A key that repeats keeps its last entry where it first
+ * appeared, as the parser does.
+ */
+const blockMap = (
+  bytes: Uint8Array,
+  from: number,
+  to: number,
+  number: number,
+  parent: number,
+):
+  | { readonly kind: "map"; readonly places: Record<string, Place> }
+  | { readonly kind: "none" }
+  | { readonly kind: "unreadable"; readonly line: number } => {
+  const places: Record<string, Place> = Object.create(null);
+  let indent = -1;
+  let open: (Omit<Place, "end"> & { readonly key: string }) | undefined;
+  for (const line of significantLines(bytes, from, to, number)) {
+    if (indent === -1) {
+      if (line.indent <= parent || listEntry(bytes, line)) return { kind: "none" };
+      indent = line.indent;
+    }
+    if (line.indent > indent || (line.indent === indent && listEntry(bytes, line))) continue;
+    if (line.indent < indent) return { kind: "unreadable", line: line.number };
+    const text = lossyUtf8.decode(bytes.subarray(line.start, line.end));
+    const end = keyEnd(text, indent);
+    const key = end === undefined ? undefined : keyOf(text.slice(0, end));
+    if (end === undefined || key === undefined) return { kind: "unreadable", line: line.number };
+    if (open !== undefined) places[open.key] = { ...open, end: line.start };
+    const rest = text.slice(end).trim();
+    open = {
+      key,
+      start: line.start,
+      line: line.number,
+      indent,
+      bare: rest === "" || rest.startsWith("#"),
+    };
+  }
+  if (open === undefined) return { kind: "none" };
+  places[open.key] = { ...open, end: to };
+  return { kind: "map", places };
+};
+
+/**
+ * Read a stored document of block YAML one entry at a time, as v1 read its Microsoft Graph
+ * documents: an index of where each top-level entry, path item and component starts, built from
+ * the bytes without decoding them whole, and each entry parsed when it is read. `unread` names the
+ * first entry that could not be parsed, which reads as missing, so a cut that read it is not used.
+ * Refused when the text is not block YAML this reader can index.
+ */
+export const blockYamlDocument = (
+  bytes: Uint8Array,
+):
+  | { readonly ok: true; readonly document: Entries; readonly unread: () => string | undefined }
+  | { readonly ok: false; readonly reason: string } => {
+  let unread: string | undefined;
+  const parse = (place: Place, key: string): unknown => {
+    if (unread !== undefined) return undefined;
+    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: the YAML parser throws on input it cannot read
+    try {
+      const parsed: unknown = loadYaml(
+        lossyUtf8.decode(bytes.subarray(place.start, place.end)),
+        yamlOptions,
+      );
+      if (isObject(parsed) && Object.keys(parsed).length === 1 && Object.hasOwn(parsed, key))
+        return parsed[key];
+      unread = `v1's stored specification could not be read: its entry at line ${place.line + 1} does not read as that entry alone (${bytes.length} bytes).`;
+    } catch (error) {
+      const at =
+        error instanceof YAMLException && error.mark !== undefined
+          ? ` at line ${place.line + error.mark.line + 1}, column ${error.mark.column + 1}`
+          : "";
+      unread =
+        error instanceof YAMLException
+          ? `v1's stored specification could not be read: as YAML, ${parserReason(error.reason)}${at} (${bytes.length} bytes).`
+          : `v1's stored specification could not be read: reading it as YAML failed with ${error instanceof Error ? error.name : "an unknown error"} (${bytes.length} bytes).`;
+    }
+    return undefined;
+  };
+  const refused = (line: number) => ({
+    ok: false as const,
+    reason: `v1's stored Microsoft Graph specification is not block YAML the import can read one entry at a time, as v1 read it: line ${line + 1} holds no key it can read.`,
+  });
+  const entries = (places: Record<string, Place>, read: (place: Place, key: string) => unknown) =>
+    new Entries(
+      Object.keys(places),
+      (key) => Object.hasOwn(places, key),
+      (key) => {
+        const place = places[key];
+        return place === undefined ? undefined : read(place, key);
+      },
+    );
+  /** The block map under an entry's bare key line. */
+  const under = (place: Place) => {
+    const keyLine = bytes.indexOf(newline, place.start);
+    return !place.bare || keyLine === -1 || keyLine >= place.end
+      ? ({ kind: "none" } as const)
+      : blockMap(bytes, keyLine + 1, place.end, place.line + 1, place.indent);
+  };
+  const top = blockMap(bytes, 0, bytes.length, 0, -1);
+  if (top.kind === "none") return refused(0);
+  if (top.kind === "unreadable") return refused(top.line);
+  const maps: Record<string, Entries> = Object.create(null);
+  const paths = top.places.paths === undefined ? undefined : under(top.places.paths);
+  if (paths?.kind === "unreadable") return refused(paths.line);
+  if (paths?.kind === "map") maps.paths = entries(paths.places, parse);
+  const components = top.places.components === undefined ? undefined : under(top.places.components);
+  if (components?.kind === "unreadable") return refused(components.line);
+  if (components?.kind === "map") {
+    const sections: Record<string, Entries> = Object.create(null);
+    for (const [name, place] of Object.entries(components.places)) {
+      const section = under(place);
+      if (section.kind === "unreadable") return refused(section.line);
+      if (section.kind === "map") sections[name] = entries(section.places, parse);
+    }
+    maps.components = entries(
+      components.places,
+      (place, key) => sections[key] ?? parse(place, key),
+    );
+  }
+  return {
+    ok: true,
+    document: entries(top.places, (place, key) => maps[key] ?? parse(place, key)),
+    unread: () => unread,
+  };
+};
diff --git a/apps/hosted/cloud/src/implementation/v1-import/v1-tool-paths.ts b/apps/hosted/cloud/src/implementation/v1-import/v1-tool-paths.ts
index 9361fab9e3..f975dd3cce 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/v1-tool-paths.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/v1-tool-paths.ts
@@ -6,6 +6,8 @@
  * from `extract` (`sdk/extract.ts`): v2's planner names differently, and v1's names must be kept.
  */
 
+import { type Entries, mapEntries, noEntries } from "./stored-document.ts";
+
 type Json = Record<string, unknown>;
 const isObject = (value: unknown): value is Json =>
   typeof value === "object" && value !== null && !Array.isArray(value);
@@ -122,12 +124,14 @@ interface Planned {
 
 /**
  * v1's tool name for every operation of the document, by `<method> <document path>`. Collisions are
- * refined over the whole document, as v1 did, so the input must be the full stored document.
+ * refined over the whole document, as v1 did, so the input must be the full stored document; it is
+ * read one path item at a time.
  */
-export const v1ToolPaths = (document: Json): ReadonlyMap<string, string> => {
+export const v1ToolPaths = (document: Entries): ReadonlyMap<string, string> => {
   const planned: Planned[] = [];
-  const paths = isObject(document.paths) ? document.paths : {};
-  for (const [documentPath, item] of Object.entries(paths)) {
+  const paths = mapEntries(document.get("paths")) ?? noEntries;
+  for (const documentPath of paths.keys) {
+    const item = paths.get(documentPath);
     if (!isObject(item)) continue;
     for (const method of methods) {
       const operation = item[method];
diff --git a/apps/hosted/cloud/src/implementation/v1-import/writes.ts b/apps/hosted/cloud/src/implementation/v1-import/writes.ts
index b2c916b646..f0a4dfabe6 100644
--- a/apps/hosted/cloud/src/implementation/v1-import/writes.ts
+++ b/apps/hosted/cloud/src/implementation/v1-import/writes.ts
@@ -3,54 +3,154 @@
  * runs"). Dry runs are never limited by it: they write nothing but their report.
  *
  * - `Refused`: no import writes here, and `reason` says which setting stops it.
- * - `Any`: emulated Cloud's v1, whose organizations are all synthetic.
- * - `Listed`: v1's real data on production. Only the organizations on the allow-list
- *   (`CLOUD_V1_IMPORT_ALLOWED_ORGS`) move, each named explicitly, never by paging through v1.
+ * - `Listed`: an import names each organization, never pages through v1, and only those with a
+ *   row in `private_v1_import_allowed` move. Production and emulated Cloud both check the table;
+ *   with no rows, nothing is imported.
+ *
+ * The table is a guard apart from the operator token: holding the token is not enough to allow an
+ * organization. No route, operator command or app path writes it. Rows are added only by direct
+ * SQL from someone with access to the database; this code only reads it.
  *
  * Every import freezes its organization in v1 first and cuts it over at the end, so a deployment
  * that writes always holds the moved flag's writer (`flag`).
  */
-import { Data } from "effect";
-import type { V1OrganizationId } from "../../contracts/v1-import.ts";
+import { Data, Effect, Option, Schema } from "effect";
+import { V1ImportDatabase, V1ImportUnavailable } from "../../contracts/v1-import.ts";
+import { V1IntoMode } from "../../contracts/v1-import-run.ts";
 import type { V1MovedFlag } from "./moved-flag.ts";
 
 export type V1ImportWrites = Data.TaggedEnum<{
   Refused: { readonly reason: string };
-  Any: { readonly flag: V1MovedFlag };
-  Listed: { readonly organizations: ReadonlySet<V1OrganizationId>; readonly flag: V1MovedFlag };
+  Listed: { readonly flag: V1MovedFlag };
 }>;
 export const V1ImportWrites = Data.taggedEnum<V1ImportWrites>();
 
-/** Why a real v1 import that does not name its organizations is refused. */
+/** The table of v1 organizations an import may write; see this module's comment. */
+export const v1ImportAllowedTable = "private_v1_import_allowed";
+
+/** Why an import that does not name its organizations is refused. */
 export const v1ImportMustName =
-  "An import over v1's real data names its organizations with `organizations`; it never pages through v1 with `after` or `limit`.";
+  "An import names its organizations with `organizations`; it never pages through v1 with `after` or `limit`.";
 
-/** Why an organization missing from the allow-list is refused. */
+/** Why an organization without a row in the allow table is refused. */
 export const v1ImportNotAllowed = (organizations: readonly string[]) =>
-  `CLOUD_V1_IMPORT_ALLOWED_ORGS does not list ${organizations.join(", ")}, so it is not imported.`;
+  `${v1ImportAllowedTable} has no row for ${organizations.join(", ")}, so it is not imported.`;
 
 /**
- * Why a request to import is refused here, or undefined when it may run. `organizations` is what
- * the request names, undefined when it pages through v1 instead.
+ * Why a request to import is refused, given which of its organizations have a row in the allow
+ * table, or undefined when it may run. `organizations` is what the request names, undefined when
+ * it pages through v1 instead.
  */
-export const importRefusal = (
+export const refusalGiven = (
   writes: V1ImportWrites,
-  organizations: readonly V1OrganizationId[] | undefined,
+  organizations: readonly string[] | undefined,
+  allowed: ReadonlySet<string>,
 ): string | undefined =>
   V1ImportWrites.$match(writes, {
     Refused: ({ reason }) => reason,
-    Any: () => undefined,
-    Listed: ({ organizations: allowed }) => {
+    Listed: () => {
       if (organizations === undefined || organizations.length === 0) return v1ImportMustName;
       const missing = organizations.filter((organization) => !allowed.has(organization));
       return missing.length === 0 ? undefined : v1ImportNotAllowed(missing);
     },
   });
 
+const AllowedRows = Schema.Array(Schema.Struct({ v1_org_id: Schema.String }));
+
+/** Which of these organizations have a row in the allow table. Only reads it. */
+const allowedOf = (organizations: readonly string[]) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const rows = yield* sql`
+      select v1_org_id from private_v1_import_allowed
+      where ${sql.in("v1_org_id", organizations)}
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(AllowedRows)),
+      Effect.mapError(() => new V1ImportUnavailable()),
+    );
+    return new Set(rows.map((row) => row.v1_org_id));
+  });
+
+/**
+ * Why a request to import is refused here, or undefined when it may run, reading the allow table
+ * for the organizations it names (`refusalGiven`).
+ */
+export const importRefusal = (
+  writes: V1ImportWrites,
+  organizations: readonly string[] | undefined,
+): Effect.Effect<string | undefined, V1ImportUnavailable, V1ImportDatabase> =>
+  writes._tag === "Listed" && organizations !== undefined && organizations.length > 0
+    ? allowedOf(organizations).pipe(
+        Effect.map((allowed) => refusalGiven(writes, organizations, allowed)),
+      )
+    : Effect.succeed(refusalGiven(writes, organizations, new Set()));
+
+const Displacements = Schema.Array(
+  Schema.Struct({ displace_v2_org_id: Schema.NullOr(Schema.String) }),
+);
+
+/**
+ * The v2 organization the operator listed in the allow table to give up the slug this v1
+ * organization moves to (`displace_v2_org_id`), if any. A displacement happens only for an
+ * organization listed this way, never on its own (`notes/v1-import.md`, "Slug displacement").
+ * Dry runs read it too, to report the rename. Only reads the table.
+ */
+export const listedDisplacement = (organization: string) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const rows = yield* sql`
+      select displace_v2_org_id from private_v1_import_allowed where v1_org_id = ${organization}
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Displacements)),
+      Effect.mapError(() => new V1ImportUnavailable()),
+    );
+    return rows[0]?.displace_v2_org_id ?? undefined;
+  });
+
+const Into = Schema.Array(
+  Schema.Struct({
+    into_v2_org_id: Schema.NullOr(Schema.String),
+    into_mode: Schema.NullOr(Schema.String),
+  }),
+);
+
+/**
+ * The existing v2 organization the operator listed in the allow table for this v1 organization to
+ * move into instead of a new one (`into_v2_org_id`), and how (`into_mode`, `nothing_to_copy` when
+ * unset), if any (`notes/v1-import.md`, decision 32). Only a listed organization moves into an
+ * existing one, and only when the import's checks for its mode allow it; a mode it does not know is
+ * `undefined`, which refuses the move. Dry runs read it too, to report the move. Only reads the
+ * table.
+ */
+export const listedInto = (organization: string) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.flatten(V1ImportDatabase);
+    const rows = yield* sql`
+      select into_v2_org_id, into_mode from private_v1_import_allowed where v1_org_id = ${organization}
+    `.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Into)),
+      Effect.mapError(() => new V1ImportUnavailable()),
+    );
+    const row = rows[0];
+    if (row === undefined || row.into_v2_org_id === null) return undefined;
+    return {
+      organization: row.into_v2_org_id,
+      mode: Option.getOrUndefined(
+        Schema.decodeUnknownOption(V1IntoMode)(row.into_mode ?? "nothing_to_copy"),
+      ),
+    };
+  });
+
+/** Why imports never write here, or undefined where they may. */
+export const writesRefused = (writes: V1ImportWrites): string | undefined =>
+  V1ImportWrites.$match(writes, {
+    Refused: ({ reason }) => reason,
+    Listed: () => undefined,
+  });
+
 /** The moved flag's writer, where imports write. */
 export const movedFlag = (writes: V1ImportWrites): V1MovedFlag | undefined =>
   V1ImportWrites.$match(writes, {
     Refused: () => undefined,
-    Any: ({ flag }) => flag,
     Listed: ({ flag }) => flag,
   });
diff --git a/apps/hosted/cloud/src/implementation/v1-mcp-forward.ts b/apps/hosted/cloud/src/implementation/v1-mcp-forward.ts
index 98461646f5..5fd7a8d710 100644
--- a/apps/hosted/cloud/src/implementation/v1-mcp-forward.ts
+++ b/apps/hosted/cloud/src/implementation/v1-mcp-forward.ts
@@ -33,7 +33,7 @@ import {
 import { Clock, Effect, Option, Redacted, Result, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 import { SqlClient } from "effect/sql";
-import { toolkitCopyId } from "./v1-import/store.ts";
+import { toolkitCopyConnectionId, toolkitCopyId } from "./v1-import/store.ts";
 
 const prefix = "v1fwd.";
 
@@ -55,7 +55,7 @@ const Claims = Schema.Struct({
   toolkit: Schema.optionalKey(Schema.NonEmptyString),
   /**
    * The v2 connection v1 computed for the caller's copy of the toolkit, which v1 also names in the
-   * URL; it must be the copy the import made for this caller.
+   * URL; it must name the copy the import made for this caller.
    */
   connection: Schema.optionalKey(ConnectionId),
 });
@@ -163,7 +163,7 @@ const load = (sql: SqlClient.SqlClient, claims: Claims) =>
       mc.policy as "connectionPolicy",
       mc.revoked as "connectionRevoked"
     from (select 1) one
-    left join "mcpConnection" mc on mc.id = ${claims.connection ?? null}`.pipe(
+    left join "mcpConnection" mc on mc.id = (select v2_id from t)`.pipe(
     Effect.flatMap((rows) => Schema.decodeUnknownEffect(Row)(rows[0])),
   );
 
@@ -178,7 +178,8 @@ interface StoredConnection {
 
 /**
  * The access a forwarded grant gives, or `refuse` when its user is no longer a member of the
- * organization or its toolkit's connection no longer belongs to them there.
+ * organization or its toolkit's connection no longer belongs to them there. The grant serves the
+ * URL's connection, `address` when it is not the stored connection's own id.
  */
 const grantedAccess = <E>(
   input: {
@@ -187,6 +188,7 @@ const grantedAccess = <E>(
     readonly role: string | null;
     readonly mode: ApprovalMode;
     readonly connection: StoredConnection | undefined;
+    readonly address?: ConnectionId | undefined;
   },
   refuse: E,
 ) =>
@@ -211,6 +213,7 @@ const grantedAccess = <E>(
       );
     }
     const connection = stored?.id;
+    const address = input.address ?? connection;
     return McpAccess.make({
       userId: input.user,
       clientId: v1ForwardClient,
@@ -218,9 +221,9 @@ const grantedAccess = <E>(
         id: grantId({ user: input.user, organization, mode: input.mode, connection }),
         policy,
         target:
-          connection === undefined
+          address === undefined
             ? { kind: "mcp", mode: input.mode }
-            : { kind: "mcp", mode: input.mode, connection },
+            : { kind: "mcp", mode: input.mode, connection: address },
       },
       access: { organization, owner: organizationOwner(organization), role },
     });
@@ -264,9 +267,18 @@ export const v1ForwardAccess = (
       request.organization !== row.slug
     )
       return yield* new McpForbidden({ reason: "organization_mismatch" });
-    // A toolkit runs under the caller's copy, the scoped connection its import made for them.
-    if (claims.connection !== undefined && row.toolkitConnection !== claims.connection)
-      return yield* forbidden;
+    // A toolkit runs under the caller's copy, the scoped connection its import made for them. v1
+    // names it by the id the import gives a copy; one the opt-in import made keeps its earlier id.
+    const copy = row.toolkitConnection;
+    if (claims.toolkit !== undefined) {
+      if (copy === null) return yield* forbidden;
+      const derived = yield* toolkitCopyConnectionId(
+        row.organization,
+        claims.toolkit,
+        claims.account,
+      );
+      if (claims.connection !== copy && claims.connection !== derived) return yield* forbidden;
+    }
     return yield* grantedAccess(
       {
         user: row.userId,
@@ -274,15 +286,16 @@ export const v1ForwardAccess = (
         role: row.role,
         mode: request.mode ?? "model",
         connection:
-          claims.connection === undefined
+          claims.toolkit === undefined || copy === null
             ? undefined
             : {
-                id: claims.connection,
+                id: ConnectionId.make(copy),
                 user: row.connectionUser,
                 resource: row.connectionResource,
                 policy: row.connectionPolicy,
                 revoked: row.connectionRevoked,
               },
+        address: claims.connection,
       },
       forbidden,
     );
diff --git a/apps/hosted/cloud/src/implementation/v1-session-handoff.ts b/apps/hosted/cloud/src/implementation/v1-session-handoff.ts
new file mode 100644
index 0000000000..30dd59ae0c
--- /dev/null
+++ b/apps/hosted/cloud/src/implementation/v1-session-handoff.ts
@@ -0,0 +1,313 @@
+/**
+ * Sign-in handoff from v1 for members of moved workspaces (`notes/v1-import.md`, Session handoff).
+ *
+ * v2 offers no WorkOS sign-in and never starts one. v1's dashboard sends a signed-in member of an
+ * organization that has moved to `/api/v1-handoff?token=…` after it has verified its own WorkOS
+ * session and the member's membership. The token is v1 vouching for that session, signed with a
+ * secret only v1 (`V2_SESSION_HANDOFF_SECRET`) and v2 (`V1_SESSION_HANDOFF_SECRET`) hold:
+ *
+ *     v1hnd.<base64url JSON claims>.<base64url HMAC-SHA256 of "v1hnd.<claims>">
+ *
+ * The claims name the WorkOS user, the v1 organization and the v2 organization's slug, with `iat`,
+ * an `exp` at most a minute later and a random `jti`. v2 accepts each `jti` once, maps the WorkOS
+ * user to a v2 user only through the import map, requires that user's membership of the
+ * organization the v1 organization was imported as, and starts an ordinary Better Auth session.
+ * Every refusal opens the v2 sign-in page, returning to the organization. Nothing here reads v1.
+ */
+import { AuthenticationUnavailable } from "@executor-js/hosted-server";
+import { OrganizationSlug } from "@executor-js/hosted-server/organization";
+import type { BetterAuthPlugin } from "better-auth";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { Clock, Effect, Option, Redacted, Result, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { SqlClient } from "effect/sql";
+
+/** The route v1's dashboard redirects to. */
+export const v1HandoffPath = "/api/v1-handoff";
+
+const prefix = "v1hnd.";
+const audience = "v2-session-handoff";
+/** v1 gives a token a minute; one that claims longer is refused. */
+const maxLifetimeSeconds = 60;
+/** How far ahead of this Worker's clock v1's may run. */
+const clockSkewSeconds = 30;
+
+const Claims = Schema.Struct({
+  v: Schema.Literal(1),
+  aud: Schema.Literal(audience),
+  /** The WorkOS user whose v1 session v1 verified. */
+  user: Schema.NonEmptyString,
+  /** The v1 organization that moved, a WorkOS organization ID. */
+  organization: Schema.NonEmptyString,
+  /** The v2 organization to open, as v1's moved flag names it. */
+  slug: OrganizationSlug,
+  iat: Schema.Int,
+  exp: Schema.Int,
+  jti: Schema.String.check(Schema.isMinLength(16), Schema.isMaxLength(128)),
+});
+type Claims = typeof Claims.Type;
+
+/** Only what a refusal needs to read from a token it did not accept: where to return to. */
+const Destination = Schema.Struct({ slug: Schema.optionalKey(Schema.Unknown) });
+
+/** Why a handoff opened the sign-in page; logged, never shown, and never with the token. */
+const V1HandoffRefusal = Schema.Literals([
+  "disabled",
+  "malformed",
+  "signature",
+  "version",
+  "audience",
+  "expired",
+  "lifetime",
+  "replayed",
+  "unmapped_user",
+  "unknown_organization",
+  "organization_mismatch",
+  "not_member",
+  "other_session",
+]);
+type V1HandoffRefusal = typeof V1HandoffRefusal.Type;
+
+export class V1HandoffRefused extends Schema.TaggedError<V1HandoffRefused>()("V1HandoffRefused", {
+  reason: V1HandoffRefusal,
+}) {}
+
+const refuse = (reason: V1HandoffRefusal) => new V1HandoffRefused({ reason });
+
+/** Better Auth could not start the session. */
+export class V1HandoffSessionFailed extends Schema.TaggedError<V1HandoffSessionFailed>()(
+  "V1HandoffSessionFailed",
+  {},
+) {}
+
+const encoder = new TextEncoder();
+
+/** The token's parts, when it has the shape v1 signs. */
+const split = (token: string) => {
+  if (!token.startsWith(prefix)) return undefined;
+  const [payload, signature, ...rest] = token.slice(prefix.length).split(".");
+  if (payload === undefined || signature === undefined || rest.length > 0) return undefined;
+  return { payload, signature };
+};
+
+/** The decoded JSON of a payload, or undefined. */
+const payloadJson = (payload: string) =>
+  Result.match(Base64Url.decodeString(payload), {
+    onFailure: () => undefined,
+    onSuccess: (json) => Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown))(json),
+  });
+
+/**
+ * The claims of a token v1 signed with `secret` that is current. The MAC is checked with
+ * `crypto.subtle.verify`, which compares in constant time, before anything in the payload is read.
+ */
+const verify = (secret: Redacted.Redacted<string>, token: string) =>
+  Effect.gen(function* () {
+    const parts = split(token);
+    if (parts === undefined) return yield* refuse("malformed");
+    const mac = Base64Url.decode(parts.signature);
+    if (Result.isFailure(mac)) return yield* refuse("malformed");
+    const valid = yield* Effect.promise(async () => {
+      const key = await crypto.subtle.importKey(
+        "raw",
+        encoder.encode(Redacted.value(secret)),
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["verify"],
+      );
+      return crypto.subtle.verify(
+        "HMAC",
+        key,
+        new Uint8Array(mac.success),
+        encoder.encode(`${prefix}${parts.payload}`),
+      );
+    });
+    if (!valid) return yield* refuse("signature");
+    const json = payloadJson(parts.payload);
+    if (json === undefined || Option.isNone(json)) return yield* refuse("malformed");
+    const loose = Schema.decodeUnknownOption(
+      Schema.Struct({ v: Schema.Unknown, aud: Schema.Unknown }),
+    )(json.value);
+    if (Option.isNone(loose)) return yield* refuse("malformed");
+    if (loose.value.v !== 1) return yield* refuse("version");
+    if (loose.value.aud !== audience) return yield* refuse("audience");
+    const claims = yield* Schema.decodeUnknownEffect(Claims)(json.value).pipe(
+      Effect.mapError(() => refuse("malformed")),
+    );
+    const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+    if (claims.exp <= now) return yield* refuse("expired");
+    if (
+      claims.exp <= claims.iat ||
+      claims.exp - claims.iat > maxLifetimeSeconds ||
+      claims.iat > now + clockSkewSeconds
+    )
+      return yield* refuse("lifetime");
+    return claims;
+  });
+
+/**
+ * Accept the token's `jti` once. Rows of expired tokens are deleted first: an expired token is
+ * refused before it gets here, so its row no longer guards anything. The margin covers the clock
+ * difference between this Worker and the database.
+ */
+const consume = (sql: SqlClient.SqlClient, claims: Claims) =>
+  Effect.gen(function* () {
+    yield* sql`
+      delete from private_v1_session_handoff where expires_at < now() - interval '5 minutes'`;
+    const accepted = yield* sql`
+      insert into private_v1_session_handoff (jti, expires_at)
+      values (${claims.jti}, to_timestamp(${claims.exp}))
+      on conflict (jti) do nothing
+      returning jti`;
+    if (accepted.length === 0) return yield* refuse("replayed");
+  });
+
+const Target = Schema.Struct({
+  userId: Schema.NullOr(Schema.String),
+  imported: Schema.NullOr(Schema.String),
+  organization: Schema.NullOr(Schema.String),
+  role: Schema.NullOr(Schema.String),
+});
+
+/**
+ * The v2 user and organization the claims stand for, in one statement. The user is the import
+ * map's record of the WorkOS user, created or merged by the import; nothing is matched by email.
+ * The organization is the slug's, which must be the one the v1 organization was imported as.
+ */
+const target = (sql: SqlClient.SqlClient, claims: Claims) =>
+  Effect.gen(function* () {
+    const rows = yield* sql`
+      with u as (
+        select v2_id from private_v1_import_map
+        where v1_kind = 'user' and v1_id = ${claims.user} and status = 'imported'
+          and v2_kind in ('user', 'merged_user')
+      ), o as (
+        select id from organization where slug = ${claims.slug}
+      )
+      select
+        (select v2_id from u) as "userId",
+        (select v2_id from private_v1_import_map
+          where v1_kind = 'organization' and v1_id = ${claims.organization}
+            and status = 'imported') as imported,
+        (select id from o) as organization,
+        (select role from member
+          where "userId" = (select v2_id from u) and "organizationId" = (select id from o)) as role`;
+    const row = yield* Schema.decodeUnknownEffect(Target)(rows[0]);
+    if (row.userId === null) return yield* refuse("unmapped_user");
+    if (row.organization === null) return yield* refuse("unknown_organization");
+    if (row.imported !== row.organization) return yield* refuse("organization_mismatch");
+    if (row.role === null) return yield* refuse("not_member");
+    return { user: row.userId, organization: row.organization };
+  });
+
+/** Where every response sends the browser: never back to a URL that carries the token. */
+const redirect = (location: string, cookies: ReadonlyArray<string> = []) => {
+  const headers = new Headers({
+    location,
+    "referrer-policy": "no-referrer",
+    "cache-control": "no-store",
+  });
+  for (const cookie of cookies) headers.append("set-cookie", cookie);
+  return HttpServerResponse.fromWeb(new Response(null, { status: 302, headers }));
+};
+
+/** The sign-in page, returning to the organization the token named when it names one. */
+const signIn = (token: string) => {
+  const parts = split(token);
+  const json = parts === undefined ? undefined : payloadJson(parts.payload);
+  const slug =
+    json === undefined || Option.isNone(json)
+      ? undefined
+      : Option.getOrUndefined(Schema.decodeUnknownOption(Destination)(json.value))?.slug;
+  const returnTo = Schema.is(OrganizationSlug)(slug) ? `/org/${slug}` : "/";
+  return redirect(`/login?redirect=${encodeURIComponent(returnTo)}`);
+};
+
+export interface V1HandoffServices<R> {
+  readonly secret: Option.Option<Redacted.Redacted<string>>;
+  readonly withSql: <A, E>(effect: Effect.Effect<A, E, SqlClient.SqlClient>) => Effect.Effect<A, E>;
+  /** The user of the session the request already carries, if any. */
+  readonly currentUser: (
+    headers: Headers,
+  ) => Effect.Effect<string | undefined, AuthenticationUnavailable>;
+  /** Start a Better Auth session for the user; its `Set-Cookie` values. */
+  readonly startSession: (
+    headers: Headers,
+    user: string,
+    organization: string,
+  ) => Effect.Effect<ReadonlyArray<string>, V1HandoffSessionFailed, R>;
+}
+
+/** `GET /api/v1-handoff?token=…`: a session for the member v1 vouches for, or the sign-in page. */
+export const v1SessionHandoff = <R>(services: V1HandoffServices<R>) =>
+  Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const token = new URL(request.url, "http://localhost").searchParams.get("token") ?? "";
+    const headers = new Headers(request.headers);
+    return yield* Effect.gen(function* () {
+      if (Option.isNone(services.secret)) return yield* refuse("disabled");
+      const claims = yield* verify(services.secret.value, token);
+      const { user, organization } = yield* services.withSql(
+        Effect.gen(function* () {
+          const sql = yield* SqlClient.SqlClient;
+          yield* consume(sql, claims);
+          return yield* target(sql, claims);
+        }),
+      );
+      const current = yield* services.currentUser(headers);
+      // A browser already signed in to v2 keeps its session: as this user it needs no other, and
+      // another user's session is never replaced by a handoff.
+      if (current !== undefined && current !== user) return yield* refuse("other_session");
+      const cookies =
+        current === user ? [] : yield* services.startSession(headers, user, organization);
+      return redirect(`/org/${claims.slug}`, cookies);
+    }).pipe(
+      Effect.catchTag("V1HandoffRefused", (error) =>
+        Effect.logInfo("v1 session handoff refused", { reason: error.reason }).pipe(
+          Effect.as(signIn(token)),
+        ),
+      ),
+      // Storage, decoding or Better Auth failed: the member can still sign in.
+      Effect.catch(() =>
+        Effect.logWarning("v1 session handoff unavailable", { reason: "unavailable" }).pipe(
+          Effect.as(signIn(token)),
+        ),
+      ),
+      Effect.withSpan("auth.v1SessionHandoff"),
+    );
+  });
+
+/**
+ * Better Auth's half: a session for a user the handoff has already authorized, created and set as
+ * every sign-in's is, so the session hooks (verified email, sign-in analytics) run too. Server only:
+ * it has no URL, and only `v1SessionHandoff` calls it.
+ */
+export const v1HandoffSessions = () =>
+  ({
+    id: "executor-v1-session-handoff",
+    endpoints: {
+      startV1HandoffSession: createAuthEndpoint(
+        "/v1-handoff/session",
+        {
+          method: "POST",
+          requireHeaders: true,
+          body: Schema.toStandardSchemaV1(
+            Schema.Struct({ userId: Schema.NonEmptyString, organizationId: Schema.NonEmptyString }),
+          ),
+          metadata: { SERVER_ONLY: true },
+        },
+        async (ctx) => {
+          const user = await ctx.context.internalAdapter.findUserById(ctx.body.userId);
+          if (!user) throw new APIError("NOT_FOUND");
+          const session = await ctx.context.internalAdapter.createSession(user.id, false, {
+            activeOrganizationId: ctx.body.organizationId,
+          });
+          if (!session) throw new APIError("INTERNAL_SERVER_ERROR");
+          await setSessionCookie(ctx, { session, user });
+          return ctx.json({ userId: user.id });
+        },
+      ),
+    },
+  }) satisfies BetterAuthPlugin;
diff --git a/apps/hosted/cloud/src/implementation/welcome-emails.ts b/apps/hosted/cloud/src/implementation/welcome-emails.ts
index e26f3035d6..29581b12f2 100644
--- a/apps/hosted/cloud/src/implementation/welcome-emails.ts
+++ b/apps/hosted/cloud/src/implementation/welcome-emails.ts
@@ -1,4 +1,4 @@
-import { Effect, Redacted, Schema } from "effect";
+import { Effect, Redacted, Result, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import {
   WelcomeEmailUnavailable,
@@ -6,6 +6,7 @@ import {
   type UnsubscribeLinks,
 } from "../contracts/email.ts";
 import { welcomeEmailMessage, type WelcomeEmailOrigins } from "./email-messages.ts";
+import { jobUnits, type JobError } from "../contracts/job-outcome.ts";
 
 const Recipients = Schema.Array(
   Schema.Struct({
@@ -20,6 +21,7 @@ const Recipients = Schema.Array(
  * verified users are eligible. Concurrent runs cannot claim the same recipient.
  * Cloudflare has no send idempotency key: an ambiguous attempt is held for review,
  * never retried automatically. A crash after claiming can therefore miss a welcome.
+ * The outcome counts each attempt held for review as a failure.
  */
 export const deliverWelcomeEmails = (
   send: SendWelcomeEmail,
@@ -39,6 +41,7 @@ export const deliverWelcomeEmails = (
       });
 
     let sent = 0;
+    const failures: Array<JobError> = [];
     for (let index = 0; index < 20; index++) {
       const recipients = yield* sql`
         with candidate as (
@@ -69,24 +72,22 @@ export const deliverWelcomeEmails = (
           yield* links(recipient.id, Redacted.value(recipient.email)),
           origins,
         ),
-      ).pipe(
-        Effect.timeout("15 seconds"),
-        Effect.as(true),
-        Effect.catch(() => Effect.succeed(false)),
-      );
-      if (accepted) {
+      ).pipe(Effect.timeout("15 seconds"), Effect.result);
+      if (Result.isSuccess(accepted)) {
         yield* sql`update cloud_welcome_email set status = 'sent', sent_at = now()
           where user_id = ${recipient.id} and status = 'attempting'`;
         sent += 1;
       } else {
         yield* sql`update cloud_welcome_email set status = 'uncertain'
           where user_id = ${recipient.id} and status = 'attempting'`;
+        failures.push(accepted.failure);
         yield* Effect.logError("Welcome email attempt needs delivery review", {
           userId: recipient.id,
         });
       }
     }
     if (sent > 0) yield* Effect.logInfo("Welcome emails accepted by provider", { count: sent });
+    return jobUnits(sent + failures.length, failures);
   }).pipe(
     Effect.mapError(() => new WelcomeEmailUnavailable()),
     Effect.withSpan("email.welcome.deliver"),
diff --git a/apps/hosted/cloud/src/infrastructure/app-domains.ts b/apps/hosted/cloud/src/infrastructure/app-domains.ts
index 31ff3d6a67..0dcec7b898 100644
--- a/apps/hosted/cloud/src/infrastructure/app-domains.ts
+++ b/apps/hosted/cloud/src/infrastructure/app-domains.ts
@@ -10,6 +10,7 @@ import { timingSafeEqual } from "node:crypto";
 import { AppDomainController } from "./app-domain-controller-worker.ts";
 import { appDomainControlSecret } from "./app-domain-control.ts";
 import { cloudAppUiBase } from "../contracts/app-ui.ts";
+import { jobCompleted, jobFailedWith } from "../contracts/job-outcome.ts";
 import { readAppDomainRecord } from "../implementation/app-domain-records.ts";
 
 export const Team = Schema.Struct({ id: OrganizationId, slug: OrganizationSlug });
@@ -99,7 +100,10 @@ export const cloudAppDomains = Effect.gen(function* () {
     status,
     control,
     heartbeat: heartbeat.pipe(
-      Effect.catchCause(() => Effect.logError("App domain heartbeat failed")),
+      Effect.as(jobCompleted),
+      Effect.catchCause((cause) =>
+        Effect.logError("App domain heartbeat failed").pipe(Effect.as(jobFailedWith(cause))),
+      ),
     ),
   };
 });
diff --git a/apps/hosted/cloud/src/infrastructure/app-outbound.ts b/apps/hosted/cloud/src/infrastructure/app-outbound.ts
index 9469bf4425..a6a809b3fa 100644
--- a/apps/hosted/cloud/src/infrastructure/app-outbound.ts
+++ b/apps/hosted/cloud/src/infrastructure/app-outbound.ts
@@ -9,21 +9,27 @@ import type { Fetcher } from "@cloudflare/workers-types";
 import {
   credentialFetch,
   credentialKey,
+  HostApiCheck,
   NetworkUnreachable,
   networkUnreachableResponse,
 } from "@executor-js/sdk/workerd";
 import { type AppEgressFailed, egressFailure } from "../implementation/app-egress.ts";
 import { cloudSentry, reportCloudFailure } from "../implementation/error-reporting.ts";
+import { platformObservability } from "./telemetry.ts";
 
 export const AppOutbound = Effect.gen(function* () {
   if (globalThis.__ALCHEMY_RUNTIME__) return yield* Cloudflare.Worker.ref("AppOutbound");
   return yield* Cloudflare.Worker("AppOutbound", {
     workersDev: false,
-    compatibility: { date: "2026-09-08", flags: ["global_fetch_strictly_public"] },
+    compatibility: {
+      date: "2026-09-08",
+      flags: ["global_fetch_strictly_public", "no_brotli_content_encoding"],
+    },
     // This private service has no application bindings or credentials.
     script: `export default {
       fetch(request) { return fetch(request); }
     };`,
+    ...(yield* platformObservability),
   });
 });
 
@@ -38,7 +44,10 @@ export const appOutboundBindings = Effect.gen(function* () {
 });
 
 /** What the runner binds to one app's outbound network. App code cannot set it. */
-const OutboundProps = Schema.Struct({ appOutbound: Schema.NonEmptyString });
+const OutboundProps = Schema.Struct({
+  appOutbound: Schema.NonEmptyString,
+  hostApi: Schema.optionalKey(HostApiCheck),
+});
 /** The private network service, as the outbound sends to it. */
 interface Network {
   fetch(request: Request): Promise<Response>;
@@ -89,7 +98,10 @@ export const appCredentialOutbound = Effect.gen(function* () {
     /** The network one app's isolates use for global `fetch`. */
     outbound: Effect.gen(function* () {
       const exports = yield* loopback;
-      return (app: string) => exports.default({ props: { appOutbound: app } });
+      return (app: string, hostApi: HostApiCheck | undefined) =>
+        exports.default({
+          props: hostApi === undefined ? { appOutbound: app } : { appOutbound: app, hostApi },
+        });
     }),
     /** Serve a request sent by an app's isolate, or pass any other request to `handler`. */
     serve: <E, R>(
@@ -122,6 +134,7 @@ export const appCredentialOutbound = Effect.gen(function* () {
           try: () =>
             credentialFetch(source, {
               app: props.value.appOutbound,
+              ...(props.value.hostApi === undefined ? {} : { hostApi: props.value.hostApi }),
               key: sealing,
               // Cloud's own origin is public, so it needs no exemption.
               egress: { refusePrivateAddresses: !privateFetch, selfOrigin: undefined },
diff --git a/apps/hosted/cloud/src/infrastructure/app-sessions.ts b/apps/hosted/cloud/src/infrastructure/app-sessions.ts
index df3231ec07..7c6928147e 100644
--- a/apps/hosted/cloud/src/infrastructure/app-sessions.ts
+++ b/apps/hosted/cloud/src/infrastructure/app-sessions.ts
@@ -37,6 +37,8 @@ export const cloudAppSessions = Effect.gen(function* () {
   const options = {
     database: database.options,
     plugins: [organizationTables],
+    // The dashboard cleans expired records during sign-in. App reads check expiry themselves.
+    verification: { disableCleanup: true },
     // As in the dashboard: the deployment migration validates the schema, not requests.
     advanced: { database: { validateSchema: false } },
   } satisfies BetterAuthOptions;
diff --git a/apps/hosted/cloud/src/infrastructure/auth.ts b/apps/hosted/cloud/src/infrastructure/auth.ts
index 24ff2fa73d..3aa33636f3 100644
--- a/apps/hosted/cloud/src/infrastructure/auth.ts
+++ b/apps/hosted/cloud/src/infrastructure/auth.ts
@@ -29,6 +29,7 @@ import {
   resolveOrganizationReference,
   ApiAuthentication,
   apiBearerAccess,
+  callerSpanAttributes,
   grantExpiry,
   authEndpointTemplates,
 } from "@executor-js/hosted-server";
@@ -41,7 +42,8 @@ import * as Cloudflare from "alchemy/Cloudflare";
 import { Context, Effect, Layer, Option, Redacted, Schema, type Scope } from "effect";
 import { HttpBody, HttpServerRequest, HttpServerResponse } from "effect/http";
 import type { SendAuthEmail } from "../contracts/email.ts";
-import { cloudSecrets, v1McpForwardSecret } from "./secrets.ts";
+import { cloudSecrets, v1McpForwardSecret, v1SessionHandoffSecret } from "./secrets.ts";
+import { V1HandoffSessionFailed, v1SessionHandoff } from "../implementation/v1-session-handoff.ts";
 import { cloudAuthRateLimit } from "./stage.ts";
 import { AuthDatabase, appSessionsPerCall, boundAuthAdapter } from "./auth-database.ts";
 import { invocationSql } from "./invocation-database.ts";
@@ -60,6 +62,7 @@ export const cloudAuth = (send: SendAuthEmail, onboarding: typeof Onboarding.Ser
     };
     const secrets = yield* cloudSecrets.pipe(Effect.orDie);
     const v1Forward = yield* v1McpForwardSecret;
+    const v1Handoff = yield* v1SessionHandoffSecret;
     const meter = yield* BillingMeter.pipe(Effect.provide(yield* billingLive));
     // Better Auth invokes Promise callbacks. Carry the calling request's scope,
     // bindings and cancellation through that boundary, isolated per invocation.
@@ -264,8 +267,8 @@ export const cloudAuth = (send: SendAuthEmail, onboarding: typeof Onboarding.Ser
           ...origins,
           authenticate: (headers, organization) =>
             withSql(apiBearerAccess(origins, { headers, organization })).pipe(
-              Effect.tap(({ access }) =>
-                Effect.annotateCurrentSpan("executor.organization.id", access.organization),
+              Effect.tap(({ access, userId }) =>
+                Effect.annotateCurrentSpan(callerSpanAttributes(access.organization, userId)),
               ),
               Effect.withSpan("auth.authenticate"),
             ),
@@ -313,17 +316,48 @@ export const cloudAuth = (send: SendAuthEmail, onboarding: typeof Onboarding.Ser
         ),
         Effect.map(HttpServerResponse.setHeader("cache-control", "no-store")),
       );
+    const browserSession = (headers: Headers) =>
+      nativeCall((instance) =>
+        instance.api.getSession({
+          headers,
+          query: { disableRefresh: true, disableCookieCache: true },
+        }),
+      ).pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(BrowserSession)),
+        Effect.mapError(() => new AuthenticationUnavailable()),
+      );
+    const v1HandoffHandler = v1SessionHandoff({
+      secret: v1Handoff,
+      withSql,
+      currentUser: (headers) =>
+        browserSession(headers).pipe(Effect.map((session) => session?.user.id)),
+      // Inside the auth callbacks' context, like a request to the handler: the session hooks
+      // record the sign-in.
+      startSession: (headers, userId, organizationId) =>
+        Effect.gen(function* () {
+          const [instance, bind] = yield* bound;
+          const context = yield* Effect.context<
+            RuntimeContext | HttpServerRequest.HttpServerRequest | Scope.Scope
+          >();
+          const result = yield* Effect.tryPromise({
+            try: (signal) =>
+              callbacks.run({ context, signal }, () =>
+                bind(() =>
+                  instance.api.startV1HandoffSession({
+                    headers,
+                    body: { userId, organizationId },
+                    returnHeaders: true,
+                  }),
+                ),
+              ),
+            catch: () => new V1HandoffSessionFailed(),
+          });
+          return result.headers.getSetCookie();
+        }),
+    });
     return {
-      browserSession: (headers: Headers) =>
-        nativeCall((instance) =>
-          instance.api.getSession({
-            headers,
-            query: { disableRefresh: true, disableCookieCache: true },
-          }),
-        ).pipe(
-          Effect.flatMap(Schema.decodeUnknownEffect(BrowserSession)),
-          Effect.mapError(() => new AuthenticationUnavailable()),
-        ),
+      browserSession,
+      v1Handoff: v1HandoffHandler,
       identity,
       mcpIdentity,
       apiIdentity,
diff --git a/apps/hosted/cloud/src/infrastructure/background-jobs.ts b/apps/hosted/cloud/src/infrastructure/background-jobs.ts
index 3509086ec3..4df0135234 100644
--- a/apps/hosted/cloud/src/infrastructure/background-jobs.ts
+++ b/apps/hosted/cloud/src/infrastructure/background-jobs.ts
@@ -8,9 +8,10 @@ import { recordRoute, traceHeaders } from "@executor-js/telemetry";
 import { Random, RuntimeContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
 import type { Fetcher } from "@cloudflare/workers-types";
-import { Effect, Exit, Redacted, Schema } from "effect";
+import { Cause, Effect, Exit, Option, Redacted, Schema } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { timingSafeEqual } from "node:crypto";
+import { JobOutcome, jobFailedWith, type JobError } from "../contracts/job-outcome.ts";
 import { previewLifetime } from "./test-stage-expiry.ts";
 
 /** Every job a Cron Trigger starts. */
@@ -37,6 +38,68 @@ export class BackgroundJobFailed extends Schema.TaggedError<BackgroundJobFailed>
 /** The API Worker's service binding to itself, declared in its `env`. */
 export const selfBinding = "ApiSelf";
 
+/** The job route's answer reports how the run ended; only {@link cloudBackgroundJobs} reads it. */
+const outcomeHeader = "executor-job-outcome";
+const failureHeader = "executor-job-failure";
+
+const outcomeHeaders = (outcome: JobOutcome): Record<string, string> =>
+  outcome.outcome === "completed"
+    ? { [outcomeHeader]: outcome.outcome }
+    : { [outcomeHeader]: outcome.outcome, [failureHeader]: outcome.failure };
+
+/**
+ * The route's report, if it sent one. A report this version cannot read, such as a failure kind a
+ * newer route added, still counts: as a failed run with an unrecognized failure.
+ */
+const reportedOutcome = (headers: {
+  readonly get: (name: string) => string | null;
+}): Option.Option<JobOutcome> => {
+  const outcome = headers.get(outcomeHeader);
+  if (outcome === null) return Option.none();
+  return Option.some(
+    Option.getOrElse(
+      Schema.decodeUnknownOption(JobOutcome)({
+        outcome,
+        failure: headers.get(failureHeader) ?? undefined,
+      }),
+      (): JobOutcome => ({ outcome: "failed", failure: "UnrecognizedFailure" }),
+    ),
+  );
+};
+
+/** A request that failed without the route's report: the job did not run, or did not finish. */
+const unreported: JobOutcome = { outcome: "failed", failure: "Unreported" };
+
+/** `executor.outcome` and, unless the run completed, `executor.job.failure`. */
+const outcomeAttributes = (outcome: JobOutcome): Record<string, string> =>
+  outcome.outcome === "completed"
+    ? { "executor.outcome": outcome.outcome }
+    : { "executor.outcome": outcome.outcome, "executor.job.failure": outcome.failure };
+
+/**
+ * A dispatch that ends without reading the route's report records why: its request failed
+ * (`Unreported`), it hit a defect (`Defect`), or it was interrupted (`Interrupted`), such as when
+ * its invocation is cancelled while the job runs. An outcome the span already records is kept.
+ */
+const recordUnreported = (cause: Cause.Cause<unknown>) =>
+  Effect.currentSpan.pipe(
+    Effect.flatMap((span) =>
+      span.attributes.has("executor.outcome")
+        ? Effect.void
+        : Effect.annotateCurrentSpan(
+            outcomeAttributes({
+              outcome: "failed",
+              failure: Cause.hasFails(cause)
+                ? "Unreported"
+                : Cause.hasDies(cause)
+                  ? "Defect"
+                  : "Interrupted",
+            }),
+          ),
+    ),
+    Effect.ignore,
+  );
+
 const NativeFetcher = Schema.declare(
   (value): value is Pick<Fetcher, "fetch"> =>
     typeof value === "object" &&
@@ -65,10 +128,23 @@ export const cloudBackgroundJobs = Effect.gen(function* () {
         await response.body?.cancel();
         return response;
       });
-      yield* Effect.annotateCurrentSpan("http.response.status_code", response.status);
+      // The route reports how the run ended, including a failure the job handled itself and
+      // answered 204 for. `executor.outcome: failed` marks this span as failed without failing
+      // the request, so a caller that retries until the job finishes retries exactly as before.
+      const outcome = reportedOutcome(response.headers);
+      yield* Effect.annotateCurrentSpan({
+        "http.response.status_code": response.status,
+        ...(Option.isSome(outcome)
+          ? outcomeAttributes(outcome.value)
+          : response.status === 204
+            ? {}
+            : outcomeAttributes(unreported)),
+      });
       if (response.status !== 204) return yield* new BackgroundJobFailed({ job });
     }).pipe(
       Effect.mapError(() => new BackgroundJobFailed({ job })),
+      // Inside the span, so it records before the span ends. The exit itself is unchanged.
+      Effect.onExit((exit) => (Exit.isFailure(exit) ? recordUnreported(exit.cause) : Effect.void)),
       Effect.withSpan("job.dispatch", { attributes: { "executor.job": job } }),
       Effect.provide(RuntimeContext.phantom),
       lifetime.background,
@@ -89,8 +165,11 @@ export const cloudBackgroundJobs = Effect.gen(function* () {
      * Durable Object, and wait for it. Fails unless the job finished.
      */
     request,
-    /** The placed route that runs one job and answers when it has finished: 204, or 500 if it failed. */
-    route: <E, R>(run: (job: BackgroundJob) => Effect.Effect<void, E, R>) =>
+    /**
+     * The placed route that runs one job and answers when it has finished: 204, or 500 if it
+     * failed. A job that handles its own failure answers 204; the answer reports its outcome.
+     */
+    route: <E extends JobError, R>(run: (job: BackgroundJob) => Effect.Effect<JobOutcome, E, R>) =>
       HttpRouter.add(
         "POST",
         "/api/internal/jobs/:job",
@@ -103,8 +182,13 @@ export const cloudBackgroundJobs = Effect.gen(function* () {
           const { job } = yield* HttpRouter.schemaPathParams(Schema.Struct({ job: BackgroundJob }));
           // Job names are Executor's own, so the path keeps the job the route ran.
           yield* recordRoute(`/api/internal/jobs/${job}`);
-          const ran = yield* run(job).pipe(lifetime.background, Effect.exit);
-          return HttpServerResponse.empty({ status: Exit.isSuccess(ran) ? 204 : 500 });
+          // A stopped preview runs no job.
+          if (yield* lifetime.isBackgroundStopped) return HttpServerResponse.empty({ status: 204 });
+          const ran = yield* Effect.exit(run(job));
+          return HttpServerResponse.empty({
+            status: Exit.isSuccess(ran) ? 204 : 500,
+            headers: outcomeHeaders(Exit.isSuccess(ran) ? ran.value : jobFailedWith(ran.cause)),
+          });
         }).pipe(
           Effect.catchTag("SchemaError", () =>
             Effect.succeed(HttpServerResponse.empty({ status: 404 })),
diff --git a/apps/hosted/cloud/src/infrastructure/data-steps.ts b/apps/hosted/cloud/src/infrastructure/data-steps.ts
index 2b372b9282..5928c75b5c 100644
--- a/apps/hosted/cloud/src/infrastructure/data-steps.ts
+++ b/apps/hosted/cloud/src/infrastructure/data-steps.ts
@@ -5,12 +5,17 @@
  * migration created, never from a request. An older Worker version does not know a new step, so
  * the first tick of the version that ships it starts it. A pass that leaves items to retry records
  * a backoff in the journal, so a step that keeps failing is not retried every minute.
+ *
+ * Each tick's outcome counts the items it handled: `partial` or `failed` when some or all of them
+ * ended with an outcome their step retries. A tick that only waited for a lease or a backoff, or
+ * ran out of time, records `completed`.
  */
 import { AppManagementHost } from "@executor-js/app-management";
 import {
   hostDataSteps,
   runDataSteps,
   type AgentGrantExpiry,
+  type DataStepRun,
 } from "@executor-js/app-management/data-steps";
 import { GroupDatabase } from "@executor-js/hosted-server/groups";
 import {
@@ -21,6 +26,7 @@ import {
 import { Clock, Config, Effect } from "effect";
 import { SqlClient } from "effect/sql";
 import { cloudBlobs } from "./blobs.ts";
+import { jobUnitCounts } from "../contracts/job-outcome.ts";
 
 /** A tick stops starting items after this long, then resumes from its cursor on the next tick. */
 const tickBudgetMs = 20_000;
@@ -32,6 +38,14 @@ const tickBudgetMs = 20_000;
  */
 const reviewedThrough = "2_app_framework_pin_catch_up";
 
+/** A tick's outcome over the items its runs handled. */
+const tickOutcome = (...runs: ReadonlyArray<DataStepRun>) =>
+  jobUnitCounts(
+    runs.reduce((total, run) => total + run.attempted, 0),
+    runs.reduce((total, run) => total + run.failed, 0),
+    "DataStepItemFailed",
+  );
+
 /**
  * Read during Worker initialization, so Alchemy binds the deploy's values into the Worker.
  * `CLOUD_DATA_STEPS` is `report` unless a deploy sets `apply`. `apply` applies steps up to and
@@ -77,15 +91,17 @@ export const cloudDataSteps = (agentGrants: AgentGrantExpiry) =>
           exclusive: false,
           deadline,
         }).pipe(Effect.provideService(SqlClient.SqlClient, sql));
-      if (mode === "report") return yield* run(steps, "report");
+      if (mode === "report") return tickOutcome(yield* run(steps, "report"));
       const through = steps.findIndex((step) => step.name === applyThrough);
       if (through < 0) {
         // Hold everything rather than guess which steps were approved.
         yield* Effect.logError("CLOUD_DATA_STEPS_APPLY_THROUGH names no data step", applyThrough);
-        return yield* run(steps, "report");
+        return tickOutcome(yield* run(steps, "report"));
       }
-      if ((yield* run(steps.slice(0, through + 1), "apply")) === "complete")
-        yield* run(steps.slice(through + 1), "report");
+      const applied = yield* run(steps.slice(0, through + 1), "apply");
+      return applied.status === "complete"
+        ? tickOutcome(applied, yield* run(steps.slice(through + 1), "report"))
+        : tickOutcome(applied);
     }).pipe(
       Effect.withSpan("job.data-steps", {
         attributes: { "data_step.mode": mode, "data_step.apply_through": applyThrough },
diff --git a/apps/hosted/cloud/src/infrastructure/database.ts b/apps/hosted/cloud/src/infrastructure/database.ts
index 7800c6ef5d..6e14a1cd68 100644
--- a/apps/hosted/cloud/src/infrastructure/database.ts
+++ b/apps/hosted/cloud/src/infrastructure/database.ts
@@ -270,10 +270,18 @@ export const databaseInfrastructure = Effect.gen(function* () {
 }).pipe(Effect.orDie);
 
 /**
- * The connection for Worker events: Hyperdrive wherever it fronts the database, because every
- * event opens its own connections and Hyperdrive hands one out in about 2 ms instead of a TLS
- * login to PgBouncer (about 70 ms). Alchemy dev declares a local Hyperdrive passthrough. Neon
- * previews bind their pooler URL.
+ * How a pool reaches the database, recorded on each of its `sql.connect` spans as
+ * `db.connect.route`. Only `direct` connections are PgBouncer clients of their own; Hyperdrive's
+ * pool holds a bounded number of PgBouncer clients for all of its callers.
+ */
+export type DatabaseRoute = "hyperdrive" | "direct";
+
+/**
+ * The connection for Worker events and per-caller Durable Objects: Hyperdrive wherever it fronts
+ * the database, because every event opens its own connections and Hyperdrive hands one out in
+ * about 2 ms instead of a TLS login to PgBouncer (about 70 ms), and because however many callers
+ * connect, Hyperdrive holds only its own bounded pool of PgBouncer clients. Alchemy dev declares a
+ * local Hyperdrive passthrough. Neon previews bind their pooler URL.
  */
 export const cloudDatabaseConnection = Effect.gen(function* () {
   const database = yield* databaseInfrastructure;
@@ -283,17 +291,24 @@ export const cloudDatabaseConnection = Effect.gen(function* () {
     ? yield* Cloudflare.Hyperdrive.Connection.ref("DatabaseConnection")
     : yield* Cloudflare.Hyperdrive.Connection("DatabaseConnection", database.hyperdrive.value);
   const client = yield* Cloudflare.Hyperdrive.Connect(configuration);
-  return { connectionString: client.connectionString.pipe(Effect.provide(RuntimeContext.phantom)) };
+  return {
+    connectionString: client.connectionString.pipe(Effect.provide(RuntimeContext.phantom)),
+    route: "hyperdrive" as DatabaseRoute,
+  };
 }).pipe(Effect.provide(Cloudflare.Hyperdrive.ConnectBinding));
 
 /**
- * The runtime role's PgBouncer URL, bound as the `DatabaseUrl` secret. Durable Objects use it:
- * they keep their connections across calls, so they pay the login once per window, and statements
- * on a held PgBouncer connection are faster than through Hyperdrive.
+ * The runtime role's PgBouncer URL, bound as the `DatabaseUrl` secret. Each pool on it holds
+ * PgBouncer clients of its own, so only consumers whose number is fixed may use it, such as the
+ * schedule coordinator: it keeps its connections across calls and runs its statements on them
+ * without Hyperdrive's per-statement cost.
  */
 export const cloudDirectDatabaseConnection = Effect.gen(function* () {
   const database = yield* databaseInfrastructure;
-  return { connectionString: yield* Output.named(database.url, "DatabaseUrl") };
+  return {
+    connectionString: yield* Output.named(database.url, "DatabaseUrl"),
+    route: "direct" as DatabaseRoute,
+  };
 });
 
 /**
@@ -336,12 +351,15 @@ const connectAttemptTimeout = Duration.millis(2500);
  * session `SET`, advisory locks or `LISTEN`). Building it opens no connection; the pool connects
  * on first use. Opening a connection gets a second attempt when the first fails or times out.
  * Each `sql.connect` span records its `db.connect.attempt`, and the second also records why the
- * first failed as `db.connect.retry_reason`. When both fail, the statement fails with the
- * driver's `SqlError`; statements themselves are never repeated. Beside the client it provides
- * {@link OpenedConnections}, its count of those spans.
+ * first failed as `db.connect.retry_reason`. A failed attempt, a timed-out one included, is an
+ * error span with `db.connect.failure`. When both fail, the statement fails with the
+ * driver's `SqlError`; statements themselves are never repeated. Each also records the pool's
+ * `db.connect.route`. Beside the client it provides {@link OpenedConnections}, its count of those
+ * spans.
  */
 export const cloudDatabasePool = (options: {
   readonly url: Redacted.Redacted;
+  readonly route: DatabaseRoute;
   readonly maxConnections: number;
   readonly idleTimeout?: Duration.Input;
   readonly applicationName?: string;
@@ -363,9 +381,13 @@ export const cloudDatabasePool = (options: {
       const tracer = yield* Effect.tracer;
       let opened = 0;
       const counting = Tracer.make({
-        span: (span) => {
-          if (span.name === "sql.connect") opened += 1;
-          return tracer.span(span);
+        span: (spanOptions) => {
+          const span = tracer.span(spanOptions);
+          if (spanOptions.name === "sql.connect") {
+            opened += 1;
+            span.attribute("db.connect.route", options.route);
+          }
+          return span;
         },
         context: tracer.context,
       });
diff --git a/apps/hosted/cloud/src/infrastructure/deploy-events.ts b/apps/hosted/cloud/src/infrastructure/deploy-events.ts
new file mode 100644
index 0000000000..cf9788b1a0
--- /dev/null
+++ b/apps/hosted/cloud/src/infrastructure/deploy-events.ts
@@ -0,0 +1,175 @@
+/**
+ * Production deploy events: one Axiom event per attempt of the Deploy workflow, so charts can
+ * overlay each deploy's window and the commits it shipped (`notes/ci.md`, "Deploy events").
+ *
+ * The deploy events stack (`alchemy.deploy-events.ts`) creates the dataset and an ingest-only token
+ * for it, and stores both where the recorder reads them. `deploy-history.ts` builds an attempt's
+ * event from GitHub. `scripts/deploy-event.ts` records one attempt after its Deploy run completes
+ * (`.github/workflows/deploy-events.yml`); `scripts/deploy-events-backfill.ts` builds the same
+ * events for past runs.
+ */
+import { Config, Duration, Effect, Option, Schedule, Schema } from "effect";
+import { HttpClient, HttpClientRequest, type HttpClientError } from "effect/http";
+import { productionStage } from "./stage.ts";
+
+/** The dataset the deploy events go to. Its name follows the stage's telemetry datasets. */
+export const deployEventsDataset = `executor-next-${productionStage}-deploys`;
+/** The repository secret holding the dataset's ingest-only token. */
+export const deployEventsTokenSecret = "AXIOM_DEPLOY_EVENTS_TOKEN";
+/** The repository variable holding the dataset's ingest URL on its Axiom edge deployment. */
+export const deployEventsUrlVariable = "AXIOM_DEPLOY_EVENTS_URL";
+
+export const DeployOutcome = Schema.Literals(["success", "failure", "cancelled"]);
+export type DeployOutcome = typeof DeployOutcome.Type;
+export const DeployTrigger = Schema.Literals(["push", "workflow_dispatch"]);
+export type DeployTrigger = typeof DeployTrigger.Type;
+
+export const DeployCommit = Schema.Struct({
+  sha: Schema.String,
+  /** The first line of the message, at most 200 characters. */
+  title: Schema.String,
+  /** The pull request a trailing `(#1234)` in the title names. */
+  pr: Schema.NullOr(Schema.Number),
+  /** The GitHub login of the commit's author, when GitHub matched one. */
+  author: Schema.NullOr(Schema.String),
+});
+export type DeployCommit = typeof DeployCommit.Type;
+
+export const DeployEvent = Schema.Struct({
+  /** When the deploy step finished. */
+  _time: Schema.String,
+  kind: Schema.Literal("deploy"),
+  stage: Schema.Literal(productionStage),
+  sha: Schema.String,
+  startedAt: Schema.String,
+  finishedAt: Schema.String,
+  outcome: DeployOutcome,
+  runId: Schema.Number,
+  runAttempt: Schema.Number,
+  runUrl: Schema.String,
+  trigger: DeployTrigger,
+  /** Oldest first; the deployed commit is last. */
+  commits: Schema.Array(DeployCommit),
+});
+export type DeployEvent = typeof DeployEvent.Type;
+
+const titleLength = 200;
+const pullRequestSuffix = /\(#(\d+)\)\s*$/u;
+
+/** A commit as the event records it: its title, the pull request it names and its author. */
+export const deployCommit = (sha: string, message: string, author: string | null): DeployCommit => {
+  const line = message.split(/\r?\n/u, 1)[0] ?? "";
+  const pr = pullRequestSuffix.exec(line)?.[1];
+  return {
+    sha,
+    title: Array.from(line).slice(0, titleLength).join(""),
+    pr: pr === undefined ? null : Number(pr),
+    author,
+  };
+};
+
+export const deployEvent = (
+  fields: Omit<DeployEvent, "_time" | "kind" | "stage">,
+): DeployEvent => ({
+  _time: fields.finishedAt,
+  kind: "deploy",
+  stage: productionStage,
+  sha: fields.sha,
+  startedAt: fields.startedAt,
+  finishedAt: fields.finishedAt,
+  outcome: fields.outcome,
+  runId: fields.runId,
+  runAttempt: fields.runAttempt,
+  runUrl: fields.runUrl,
+  trigger: fields.trigger,
+  commits: fields.commits,
+});
+
+/** The page of one run attempt, which GitHub keeps after a rerun. */
+export const runAttemptUrl = (repository: string, runId: number, attempt: number) =>
+  `https://github.com/${repository}/actions/runs/${runId}/attempts/${attempt}`;
+
+export class DeployEventsFailed extends Schema.TaggedError<DeployEventsFailed>()(
+  "DeployEventsFailed",
+  { message: Schema.String, retryable: Schema.Boolean },
+) {}
+
+const exchangeTimeout = Duration.seconds(15);
+
+/**
+ * One request to GitHub or Axiom, given as sending it, checking its status and reading and decoding
+ * its body. All of that runs inside one 15-second timeout, so a response that sends its headers and
+ * then stalls times out as well. A timeout, a failure in transit or a `retryable` failure is retried
+ * twice. The recorder runs apart from the deploy, but this still bounds how long it waits.
+ */
+export const exchange = <A, R>(
+  service: string,
+  attempt: Effect.Effect<
+    A,
+    DeployEventsFailed | HttpClientError.HttpClientError | Schema.SchemaError,
+    R
+  >,
+) =>
+  attempt.pipe(
+    Effect.timeout(exchangeTimeout),
+    Effect.catchTag("TimeoutError", () =>
+      Effect.fail(
+        new DeployEventsFailed({ message: `${service} did not answer in time`, retryable: true }),
+      ),
+    ),
+    Effect.catchTag("HttpClientError", () =>
+      Effect.fail(
+        new DeployEventsFailed({ message: `${service} request failed`, retryable: true }),
+      ),
+    ),
+    Effect.retry({
+      times: 2,
+      schedule: Schedule.exponential("1 second"),
+      while: (error) => error instanceof DeployEventsFailed && error.retryable,
+    }),
+  );
+
+const IngestStatus = Schema.Struct({ ingested: Schema.Number, failed: Schema.Number });
+
+/**
+ * Sends events to `AXIOM_DEPLOY_EVENTS_URL` with `AXIOM_TOKEN`: the dataset's ingest-only token in
+ * the recorder, or a short-lived API token for a backfill (`notes/ci.md`). Retries a request that
+ * failed in transit, timed out or that Axiom answered with 429 or 5xx. A retried request may have
+ * been stored, so readers deduplicate on `runId` and `runAttempt`.
+ */
+export const ingestDeployEvents = (events: ReadonlyArray<DeployEvent>) =>
+  Effect.gen(function* () {
+    // Actions passes an unset secret or variable as an empty value, which Config reads as absent.
+    const url = yield* Config.NonEmptyString(deployEventsUrlVariable).pipe(Config.option);
+    const token = yield* Config.Redacted("AXIOM_TOKEN").pipe(Config.option);
+    if (Option.isNone(url) || Option.isNone(token))
+      return yield* new DeployEventsFailed({
+        message: `${deployEventsUrlVariable} and AXIOM_TOKEN are required. The recorder reads them from the ${deployEventsUrlVariable} variable and the ${deployEventsTokenSecret} secret, which the deploy events stack stores (bun run deploy-events:deploy).`,
+        retryable: false,
+      });
+    const organization = yield* Config.String("AXIOM_ORG_ID").pipe(Config.withDefault(""));
+    const client = yield* HttpClient.HttpClient;
+    const request = yield* HttpClientRequest.post(url.value).pipe(
+      HttpClientRequest.bearerToken(token.value),
+      HttpClientRequest.setHeaders(organization === "" ? {} : { "x-axiom-org-id": organization }),
+      HttpClientRequest.bodyJson(events),
+    );
+    const status = yield* exchange(
+      "Axiom",
+      Effect.gen(function* () {
+        const response = yield* client.execute(request);
+        if (response.status !== 200)
+          return yield* new DeployEventsFailed({
+            message: `Axiom answered ${response.status}`,
+            retryable: response.status === 429 || response.status >= 500,
+          });
+        return yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(IngestStatus)));
+      }),
+    );
+    if (status.failed > 0 || status.ingested !== events.length)
+      return yield* new DeployEventsFailed({
+        message: `Axiom stored ${status.ingested} of ${events.length} events`,
+        retryable: false,
+      });
+    return status.ingested;
+  });
diff --git a/apps/hosted/cloud/src/infrastructure/deploy-history.ts b/apps/hosted/cloud/src/infrastructure/deploy-history.ts
new file mode 100644
index 0000000000..93ff4802d5
--- /dev/null
+++ b/apps/hosted/cloud/src/infrastructure/deploy-history.ts
@@ -0,0 +1,335 @@
+/**
+ * How one attempt of a Deploy run becomes a deploy event (`deploy-events.ts`), read from GitHub's
+ * Actions API. The recorder (`scripts/deploy-event.ts`) and the backfill
+ * (`scripts/deploy-events-backfill.ts`) both build every event with `deployEventOf`, so they give
+ * the same event for the same run attempt.
+ *
+ * The event's window and outcome are its deploy step's own. Its commits are those after the commit
+ * of the deploy before it (`lastDeployBefore`): the attempt, of any run, whose deploy step last
+ * succeeded before this attempt's deploy step finished.
+ */
+import { Cache, Config, DateTime, Duration, Effect, Option, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import {
+  DeployEventsFailed,
+  DeployOutcome,
+  DeployTrigger,
+  deployCommit,
+  deployEvent,
+  exchange,
+  runAttemptUrl,
+  type DeployEvent,
+} from "./deploy-events.ts";
+
+const deployWorkflow = "deploy.yml";
+const deployJob = "deploy";
+/** The deploy step's names over the workflow's history, newest first. */
+const deploySteps = ["Deploy analytics and the v2 stage", "Deploy the v2 stage"];
+/**
+ * GitHub reruns a run only within 30 days of its creation. A rerun can wait in the queue for up to a
+ * day and the deploy job stops after 30 minutes, so every deploy step of a run finishes within 32
+ * days of the run's creation.
+ */
+const rerunWindow = Duration.days(32);
+/** GitHub lists at most 1,000 runs for a filtered query, so runs are read a week at a time. */
+const listSpan = Duration.days(7);
+const listLimit = 1000;
+
+/** Reads one GitHub REST resource with `GITHUB_TOKEN`. */
+export const githubGet = <S extends Schema.Top>(schema: S, path: string) =>
+  Effect.gen(function* () {
+    const token = yield* Config.Redacted("GITHUB_TOKEN");
+    const client = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.get(`https://api.github.com/${path}`).pipe(
+      HttpClientRequest.bearerToken(token),
+      HttpClientRequest.setHeaders({
+        accept: "application/vnd.github+json",
+        "x-github-api-version": "2022-11-28",
+      }),
+    );
+    return yield* exchange(
+      `GitHub (${path})`,
+      Effect.gen(function* () {
+        const response = yield* client.execute(request);
+        if (response.status !== 200)
+          return yield* new DeployEventsFailed({
+            message: `GitHub answered ${response.status} for ${path}`,
+            retryable: response.status === 429 || response.status >= 500,
+          });
+        return yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(schema)));
+      }),
+    );
+  });
+
+const DeployRun = Schema.Struct({
+  id: Schema.Number,
+  /** The latest attempt. */
+  run_attempt: Schema.Number,
+  event: Schema.String,
+  head_sha: Schema.String,
+  created_at: Schema.DateTimeUtcFromString,
+  /** Changes whenever an attempt starts or finishes. */
+  updated_at: Schema.DateTimeUtcFromString,
+});
+/** A run of the Deploy workflow on `main`. */
+export type DeployRun = typeof DeployRun.Type;
+
+const DeployRuns = Schema.Struct({
+  total_count: Schema.Number,
+  workflow_runs: Schema.Array(DeployRun),
+});
+const Workflow = Schema.Struct({ created_at: Schema.DateTimeUtcFromString });
+const Step = Schema.Struct({
+  name: Schema.String,
+  status: Schema.String,
+  conclusion: Schema.NullOr(Schema.String),
+  started_at: Schema.NullOr(Schema.DateTimeUtcFromString),
+  completed_at: Schema.NullOr(Schema.DateTimeUtcFromString),
+});
+const Jobs = Schema.Struct({
+  jobs: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      conclusion: Schema.NullOr(Schema.String),
+      created_at: Schema.DateTimeUtcFromString,
+      started_at: Schema.NullOr(Schema.DateTimeUtcFromString),
+      steps: Schema.optional(Schema.Array(Step)),
+    }),
+  ),
+});
+
+const runsPath = (repository: string) =>
+  `repos/${repository}/actions/workflows/${deployWorkflow}/runs?branch=main&exclude_pull_requests=true`;
+
+/** The span `listSpan` long that holds `time`. Spans are fixed, so every reader lists the same ones. */
+export const listSpanOf = (time: DateTime.Utc) => {
+  const span = Duration.toMillis(listSpan);
+  return DateTime.makeUnsafe(Math.floor(DateTime.toEpochMillis(time) / span) * span);
+};
+/** The spans from the one that holds `from` to the one that holds `to`. */
+export const listSpansBetween = (from: DateTime.Utc, to: DateTime.Utc) => {
+  const spans: Array<DateTime.Utc> = [];
+  for (
+    let start = listSpanOf(from);
+    DateTime.isLessThanOrEqualTo(start, to);
+    start = DateTime.addDuration(start, listSpan)
+  )
+    spans.push(start);
+  return spans;
+};
+
+/** GitHub's search syntax takes whole seconds. */
+const searchTime = (time: DateTime.Utc) => DateTime.formatIso(time).replace(/\.\d{3}Z$/u, "Z");
+
+/** Every Deploy run on `main` created in the span that starts at `start`. */
+const runsCreatedIn = (repository: string, start: DateTime.Utc) =>
+  Effect.gen(function* () {
+    const last = DateTime.subtract(DateTime.addDuration(start, listSpan), { seconds: 1 });
+    const created = encodeURIComponent(`${searchTime(start)}..${searchTime(last)}`);
+    const runs = new Map<number, DeployRun>();
+    for (let page = 1; ; page++) {
+      const { total_count, workflow_runs } = yield* githubGet(
+        DeployRuns,
+        `${runsPath(repository)}&created=${created}&per_page=100&page=${page}`,
+      );
+      if (total_count > listLimit)
+        return yield* Effect.die(
+          `GitHub holds ${total_count} Deploy runs created from ${searchTime(start)}, more than one query lists`,
+        );
+      // A run created while this reads moves the pages down; the map drops the repeat.
+      for (const run of workflow_runs) runs.set(run.id, run);
+      if (workflow_runs.length < 100) return [...runs.values()];
+    }
+  });
+
+/** What one attempt's deploy step did. */
+interface DeployStep {
+  readonly startedAt: DateTime.Utc;
+  readonly finishedAt: DateTime.Utc;
+  readonly outcome: DeployOutcome;
+}
+
+/** One attempt of a Deploy run that reached its deploy step. */
+export interface DeployAttempt extends DeployStep {
+  readonly run: DeployRun;
+  readonly number: number;
+}
+
+/**
+ * The deploy step of one run attempt, or nothing when the attempt has none of its own: the run was
+ * cancelled before its job started, or the step has not finished.
+ */
+const readDeployStep = (repository: string, runId: number, number: number) =>
+  Effect.gen(function* () {
+    const { jobs } = yield* githubGet(
+      Jobs,
+      `repos/${repository}/actions/runs/${runId}/attempts/${number}/jobs?per_page=100`,
+    );
+    const job = jobs.find((candidate) => candidate.name === deployJob);
+    if (job === undefined) return Option.none<DeployStep>();
+    // Rerunning failed jobs copies the others into the new attempt with their old steps. Such a job
+    // started before it was created, and deployed nothing in this attempt.
+    if (job.started_at !== null && DateTime.isLessThan(job.started_at, job.created_at))
+      return Option.none<DeployStep>();
+    // A job skipped or cancelled before it ran any step (a failed dependency, a newer push) has no
+    // steps and deployed nothing.
+    if ((job.steps ?? []).length === 0) return Option.none<DeployStep>();
+    const step = job.steps?.find((candidate) => deploySteps.includes(candidate.name));
+    // A job that ran without a step of a known name means the step was renamed: fail loudly, so the
+    // recorder does not pass while recording nothing for every deploy.
+    if (step === undefined && job.conclusion !== null)
+      return yield* Effect.die(
+        `Run ${runId} attempt ${number}: the ${deployJob} job has no step named ${deploySteps.join(" or ")}; add its new name to deploySteps`,
+      );
+    if (step === undefined || step.status !== "completed") return Option.none<DeployStep>();
+    if (step.started_at === null || step.completed_at === null)
+      return yield* Effect.die(`Run ${runId} attempt ${number}: the deploy step has no times`);
+    // A skipped deploy step, as when the build failed first, leaves an empty window and takes the
+    // job's outcome, which exists once the job finishes.
+    const ran = step.conclusion !== "skipped";
+    const conclusion = ran ? step.conclusion : job.conclusion;
+    if (conclusion === null) return Option.none<DeployStep>();
+    const outcome = yield* Schema.decodeUnknownEffect(DeployOutcome)(conclusion);
+    return Option.some<DeployStep>({
+      startedAt: ran ? step.started_at : step.completed_at,
+      finishedAt: step.completed_at,
+      outcome,
+    });
+  });
+
+/** The Deploy workflow's runs and attempts, each read from GitHub once. */
+export const makeDeployHistory = (repository: string) =>
+  Effect.gen(function* () {
+    const workflow = yield* githubGet(
+      Workflow,
+      `repos/${repository}/actions/workflows/${deployWorkflow}`,
+    );
+    const spans = yield* Cache.make({
+      capacity: 1000,
+      lookup: (start: number) => runsCreatedIn(repository, DateTime.makeUnsafe(start)),
+    });
+    const steps = yield* Cache.make({
+      capacity: 100_000,
+      lookup: ([runId, number]: readonly [number, number]) =>
+        readDeployStep(repository, runId, number),
+    });
+    return {
+      repository,
+      /** When the Deploy workflow was created; no run is older. */
+      since: workflow.created_at,
+      /** The runs created in the span that starts at `start` (`listSpanOf`). */
+      runsCreatedIn: (start: DateTime.Utc) => Cache.get(spans, DateTime.toEpochMillis(start)),
+      attempt: (run: DeployRun, number: number) =>
+        Cache.get(steps, [run.id, number] as const).pipe(
+          Effect.map(Option.map((step): DeployAttempt => ({ ...step, run, number }))),
+        ),
+      run: (runId: number) => githubGet(DeployRun, `repos/${repository}/actions/runs/${runId}`),
+    };
+  });
+export type DeployHistory = Effect.Success<ReturnType<typeof makeDeployHistory>>;
+
+/**
+ * The deploy production ran before `before`: of every attempt of every run, the one whose deploy
+ * step succeeded last before then, by when the step finished. That counts earlier attempts of the
+ * same run, and a rerun of an older run that finished after a newer run's deploy.
+ */
+export const lastDeployBefore = (history: DeployHistory, before: DateTime.Utc) =>
+  Effect.gen(function* () {
+    let last: DeployAttempt | undefined;
+    for (let start = listSpanOf(before); ; start = DateTime.subtractDuration(start, listSpan)) {
+      const end = DateTime.addDuration(start, listSpan);
+      // Runs created before `end` finished every step before `end` plus the rerun window.
+      if (
+        last !== undefined &&
+        DateTime.isLessThanOrEqualTo(DateTime.addDuration(end, rerunWindow), last.finishedAt)
+      )
+        return last;
+      if (DateTime.isLessThanOrEqualTo(end, history.since)) return last;
+      // A step that finished before `before` belongs to a run created before it. A run's
+      // `updated_at` is no earlier than any of its steps, so runs updated before `last` cannot beat it.
+      const runs = (yield* history.runsCreatedIn(start))
+        .filter((run) => DateTime.isLessThan(run.created_at, before))
+        .toSorted((a, b) => DateTime.Order(b.updated_at, a.updated_at));
+      for (const run of runs) {
+        if (last !== undefined && DateTime.isLessThanOrEqualTo(run.updated_at, last.finishedAt))
+          break;
+        // A run's attempts run one after another, so the latest that qualifies is its best.
+        for (let number = run.run_attempt; number >= 1; number--) {
+          const attempt = yield* history.attempt(run, number);
+          if (Option.isNone(attempt) || !DateTime.isLessThan(attempt.value.finishedAt, before))
+            continue;
+          if (
+            last !== undefined &&
+            DateTime.isLessThanOrEqualTo(attempt.value.finishedAt, last.finishedAt)
+          )
+            break;
+          if (attempt.value.outcome === "success") {
+            last = attempt.value;
+            break;
+          }
+        }
+      }
+    }
+  });
+
+/** A commit as GitHub's REST API returns it, on its own or in a comparison. */
+const GitHubCommit = Schema.Struct({
+  sha: Schema.String,
+  commit: Schema.Struct({ message: Schema.String }),
+  author: Schema.NullOr(Schema.Struct({ login: Schema.String })),
+});
+const fromGitHubCommit = (commit: typeof GitHubCommit.Type) =>
+  deployCommit(commit.sha, commit.commit.message, commit.author?.login ?? null);
+const Comparison = Schema.Struct({
+  status: Schema.String,
+  total_commits: Schema.Number,
+  commits: Schema.Array(GitHubCommit),
+});
+
+/**
+ * What a deploy of `sha` ships after production ran `base`: the commits after `base` up to `sha`,
+ * oldest first. It is the deployed commit alone when there is no `base`, when `base` is `sha`, or
+ * when `sha` does not follow `base`, as when an older run is rerun.
+ */
+const deployedCommits = (repository: string, base: string | undefined, sha: string) =>
+  Effect.gen(function* () {
+    if (base !== undefined && base !== sha) {
+      const path = `repos/${repository}/compare/${base}...${sha}?per_page=100`;
+      const first = yield* githubGet(Comparison, `${path}&page=1`);
+      if (first.status === "ahead") {
+        const commits = [...first.commits];
+        for (let page = 2; commits.length < first.total_commits; page++) {
+          const next = yield* githubGet(Comparison, `${path}&page=${page}`);
+          if (next.commits.length === 0) break;
+          commits.push(...next.commits);
+        }
+        return commits.map(fromGitHubCommit);
+      }
+    }
+    const commit = yield* githubGet(GitHubCommit, `repos/${repository}/commits/${sha}`);
+    return [fromGitHubCommit(commit)];
+  });
+
+/** The event of one attempt of a Deploy run, or nothing when the attempt has no deploy step. */
+export const deployEventOf = (history: DeployHistory, run: DeployRun, number: number) =>
+  Effect.gen(function* () {
+    const attempt = yield* history.attempt(run, number);
+    if (Option.isNone(attempt)) return Option.none<DeployEvent>();
+    const { startedAt, finishedAt, outcome } = attempt.value;
+    const trigger = yield* Schema.decodeUnknownEffect(DeployTrigger)(run.event);
+    const last = yield* lastDeployBefore(history, finishedAt);
+    const commits = yield* deployedCommits(history.repository, last?.run.head_sha, run.head_sha);
+    return Option.some(
+      deployEvent({
+        sha: run.head_sha,
+        startedAt: DateTime.formatIso(startedAt),
+        finishedAt: DateTime.formatIso(finishedAt),
+        outcome,
+        runId: run.id,
+        runAttempt: number,
+        runUrl: runAttemptUrl(history.repository, run.id, number),
+        trigger,
+        commits,
+      }),
+    );
+  });
diff --git a/apps/hosted/cloud/src/infrastructure/executor.ts b/apps/hosted/cloud/src/infrastructure/executor.ts
index abec6b3c03..f9610bbe62 100644
--- a/apps/hosted/cloud/src/infrastructure/executor.ts
+++ b/apps/hosted/cloud/src/infrastructure/executor.ts
@@ -2,10 +2,18 @@
 import { urlPolicyConfig, type HostEgress } from "@executor-js/utils/url-policy";
 import * as BrowserCrypto from "@effect/platform-browser/BrowserCrypto";
 import { makeRegistryStorage } from "@executor-js/app-registry";
-import { firstPartyOAuthClients, hostedOAuthClientName } from "@executor-js/hosted-server";
+import {
+  firstPartyOAuthClients,
+  hostedApi,
+  hostedApiRevision,
+  hostedOAuthClientName,
+} from "@executor-js/hosted-server";
+import { servesBuiltApiDocument } from "../contracts/browser.ts";
+import api from "../../.generated/executor-api-revision.json" with { type: "json" };
 import { hostedResourceLifecycle } from "@executor-js/hosted-server/resource-lifecycle";
 import {
   createExecutor,
+  declarationConfig,
   httpEventSender,
   StorageError,
   makeExecutorStorage,
@@ -75,12 +83,28 @@ export const cloudExecutor = Effect.fn(function* (
   const origin = yield* cloudOrigin.pipe(Effect.orDie);
   // New app webhooks register on the canonical API origin (`api.` once it is canonical); every
   // origin keeps delivering, so existing subscriptions keep the URL they stored.
-  const webhookOrigin = (yield* cloudResourceOrigins.pipe(Effect.orDie)).api[0];
+  const resourceOrigins = yield* cloudResourceOrigins.pipe(Effect.orDie);
+  const webhookOrigin = resourceOrigins.api[0];
+  // Deployed stages serve the document the build hashed. A development or loopback origin names
+  // its own session cookie in the document, so that document is generated and hashed here.
+  const apiOrigin = resourceOrigins.api[0];
+  const apiRevision =
+    apiOrigin === undefined || servesBuiltApiDocument(apiOrigin)
+      ? api.revision
+      : yield* Effect.promise(() => import("../implementation/default-app.ts")).pipe(
+          Effect.flatMap(({ executorCloudApiDocument }) =>
+            hostedApiRevision(JSON.stringify(executorCloudApiDocument(apiOrigin))),
+          ),
+          Effect.provide(BrowserCrypto.layer),
+        );
   const accountSignIns = yield* cloudAccountSignIns.pipe(Effect.orDie);
   const egress = yield* cloudEgress;
   // Deployed stages bind this to their own document; see `clientMetadataBinding`.
   const clientMetadata = yield* cloudClientMetadata.pipe(Effect.orDie);
   const firstPartyClients = yield* cloudFirstPartyOAuthClients.pipe(Effect.orDie);
+  // The same tool listing settings as the other hosts; a stage deployed without them keeps the
+  // defaults. Memory limits are not read: every executor shares the isolate's store.
+  const { toolListings } = yield* declarationConfig.pipe(Effect.orDie);
   const makeRuntime = yield* cloudRuntime(origin, databases);
   const workflows = yield* cloudWorkflows;
   const blobs = yield* cloudBlobs;
@@ -128,6 +152,9 @@ export const cloudExecutor = Effect.fn(function* (
           ),
         },
         hooks: lifecycle.hooks,
+        // Executor apps read this deployment's API at any of its resource origins; their caches and
+        // listings follow the API's revision.
+        hostApi: hostedApi(resourceOrigins.api, apiRevision),
         oauth: {
           httpClient: egress.client,
           clientName: hostedOAuthClientName,
@@ -156,6 +183,7 @@ export const cloudExecutor = Effect.fn(function* (
           memory: isolateDeclarations,
           // Every isolate reads the results each app's supervisor keeps when its own store misses.
           durable: durableDeclarations(databases),
+          toolListings,
         },
         // A tool listing nobody waits for runs until the event's background work ends, and is
         // remembered as timed out if it has not finished by then.
diff --git a/apps/hosted/cloud/src/infrastructure/invocation-database.ts b/apps/hosted/cloud/src/infrastructure/invocation-database.ts
index 69d398fded..7a5ac2e20f 100644
--- a/apps/hosted/cloud/src/infrastructure/invocation-database.ts
+++ b/apps/hosted/cloud/src/infrastructure/invocation-database.ts
@@ -44,7 +44,11 @@ export const cloudInvocationDatabase = Layer.effect(
         // Forked before the pool, so it closes after the pool has shut down with the event.
         const reservations = yield* Scope.fork(yield* Effect.scope, "sequential");
         const sql = yield* Layer.build(
-          cloudDatabasePool({ url, maxConnections: invocationConnectionLimit }),
+          cloudDatabasePool({
+            url,
+            route: connection.route,
+            maxConnections: invocationConnectionLimit,
+          }),
         );
         return Context.add(sql, ConnectionReservations, {
           scope: reservations,
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-auth.ts b/apps/hosted/cloud/src/infrastructure/mcp-auth.ts
index a6c3fbd9f5..08cdb3d6a5 100644
--- a/apps/hosted/cloud/src/infrastructure/mcp-auth.ts
+++ b/apps/hosted/cloud/src/infrastructure/mcp-auth.ts
@@ -4,6 +4,7 @@ import {
   McpAuthentication,
   McpUnauthorized,
   authOptions,
+  callerSpanAttributes,
   type HostedOAuthOrigins,
   mcpBrowserGrantError,
   mcpBearerAccess,
@@ -104,8 +105,8 @@ export const mcpAuthentication = (
               ? v1ForwardAccess(v1Forward, { headers, mode, organization })
               : mcpBearerAccess(origins, { headers, mode, organization, connection }),
           ).pipe(
-            Effect.tap(({ access }) =>
-              Effect.annotateCurrentSpan("executor.organization.id", access.organization),
+            Effect.tap(({ access, userId }) =>
+              Effect.annotateCurrentSpan(callerSpanAttributes(access.organization, userId)),
             ),
             Effect.withSpan("auth.authenticate"),
           ),
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults-local.ts b/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults-local.ts
new file mode 100644
index 0000000000..75a3d398d5
--- /dev/null
+++ b/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults-local.ts
@@ -0,0 +1,53 @@
+/**
+ * Local test hooks for a session object's requests. Only an `alchemy dev` build bundles this
+ * module, in place of `mcp-interaction-faults.ts` (`localTestModules` in `worker-build.ts`);
+ * `scripts/worker-sizes.ts` fails if a deployed build contains it.
+ *
+ * A request that carries `x-executor-test-fault: interaction-writes` has every write to the
+ * object's record of issued requests (`mcp-interaction-store.ts`) throw while it runs, as a
+ * storage call can, so a scenario can prove what a later resume says when a request's end was
+ * never recorded; reads and other requests' writes are untouched. One that carries
+ * `x-executor-test-fault: request-lost` fails in the object before its handler runs, so its
+ * answer is an empty 500 that names no organization, and a scenario can prove what the gateway
+ * records of a request whose object never answered it.
+ */
+import { Effect } from "effect";
+import type { InteractionFaults, Kv } from "./mcp-interaction-faults.ts";
+
+const header = "x-executor-test-fault";
+const refusal = "Interaction record write refused by a test fault";
+const lost = "Session object request lost by a test fault";
+
+/** Text only this hook contains, which the deployed builds' check looks for. */
+export const interactionFaultMarkers = [header, refusal, lost];
+
+/** The object's storage, refusing writes while a request that asks for it runs. */
+export const interactionFaults = (kv: Kv): InteractionFaults => {
+  let refusing = 0;
+  return {
+    kv: {
+      get: (key) => kv.get(key),
+      list: (options) => kv.list(options),
+      put: (key, value) => {
+        if (refusing > 0) throw new Error(refusal);
+        kv.put(key, value);
+      },
+      delete: (key) => kv.delete(key),
+    },
+    during: (request, work) =>
+      request.headers[header] === "request-lost"
+        ? Effect.die(new Error(lost))
+        : request.headers[header] === "interaction-writes"
+          ? Effect.suspend(() => {
+              refusing += 1;
+              return work;
+            }).pipe(
+              Effect.ensuring(
+                Effect.sync(() => {
+                  refusing -= 1;
+                }),
+              ),
+            )
+          : work,
+  };
+};
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults.ts b/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults.ts
new file mode 100644
index 0000000000..0f151a6c7e
--- /dev/null
+++ b/apps/hosted/cloud/src/infrastructure/mcp-interaction-faults.ts
@@ -0,0 +1,27 @@
+/**
+ * The storage of a session object's record of issued requests (`mcp-interaction-store.ts`), with
+ * nothing in front of it. Every deployed build bundles this module. Only a local `alchemy dev`
+ * build replaces it with `mcp-interaction-faults-local.ts` (`localTestModules` in
+ * `worker-build.ts`), so no deployed Worker contains that test fault for a binding or a request
+ * to turn on.
+ */
+import type * as Cloudflare from "alchemy/Cloudflare";
+import type { Effect } from "effect";
+import type { HttpServerRequest } from "effect/http";
+
+export type Kv = Cloudflare.DurableObjectStorage["kv"];
+
+/** The record's storage, and a request run with whatever faults the build installs. */
+export interface InteractionFaults {
+  readonly kv: Kv;
+  readonly during: <A, E, R>(
+    request: HttpServerRequest.HttpServerRequest,
+    work: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E, R>;
+}
+
+/** The object's storage as it is; every request runs unchanged. */
+export const interactionFaults = (kv: Kv): InteractionFaults => ({
+  kv,
+  during: (_request, work) => work,
+});
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-interaction-store.ts b/apps/hosted/cloud/src/infrastructure/mcp-interaction-store.ts
new file mode 100644
index 0000000000..c64ebcfa2f
--- /dev/null
+++ b/apps/hosted/cloud/src/infrastructure/mcp-interaction-store.ts
@@ -0,0 +1,89 @@
+/**
+ * Keeps a session object's record of the requests it issued in the object's own storage, so a
+ * resume after the object restarted learns what became of its request: answered, expired, ended
+ * with its program, or lost with the program when the object restarted while it waited.
+ * Programs stay in memory and cannot continue after a restart; only the reason survives.
+ *
+ * A record holds the caller the request was issued to (the object's own key and the elicitation
+ * mode, or the browser session), its deadline and how it ended. It grants nothing: a resume is
+ * authenticated and its bearer names this object before the record is read, and a record for
+ * another caller reads as unknown. It never holds the request's call, arguments or answer.
+ *
+ * Each call reads and writes in one synchronous step on the object's synchronous key-value
+ * storage, as `mcp-session-store.ts` does. A storage call that throws never fails the program or
+ * the resume. A failed issue leaves the request unknown, as it was before this store; a failed end
+ * leaves the issue recorded without its end. So a record with no end does not show that the
+ * request went unanswered: Executor reads it as `lost`, which claims only what the record holds.
+ *
+ * A record past its retention reads as unknown. Deletion is lazy, so an idle object is not woken to
+ * clean up: issuing a request prunes every record past retention and beyond `kept`, and reading one
+ * past retention deletes it. An object holds at most `kept` records between issues.
+ */
+import type { InteractionEnd, InteractionRecords } from "@executor-js/mcp";
+import type * as Cloudflare from "alchemy/Cloudflare";
+import { Duration, Schema } from "effect";
+
+const prefix = "mcp-request:";
+/** How long after its deadline a request is remembered; a later resume reads as unknown. */
+const retention = Duration.toMillis(Duration.days(1));
+/** Requests kept per object; the earliest deadlines go first. */
+const kept = 256;
+
+const IssuedRecord = Schema.Struct({
+  caller: Schema.String,
+  expiresAt: Schema.Number,
+  end: Schema.optionalKey(Schema.Literals(["answered", "expired", "ended"])),
+});
+const decodeRecord = Schema.decodeUnknownOption(IssuedRecord);
+
+export const mcpInteractionStore = (
+  kv: Cloudflare.DurableObjectStorage["kv"],
+  now: () => number,
+): InteractionRecords => {
+  const key = (id: string) => `${prefix}${id}`;
+  const read = (id: string) => {
+    const record = decodeRecord(kv.get(key(id)));
+    if (record._tag === "None") return undefined;
+    if (now() - record.value.expiresAt <= retention) return record.value;
+    kv.delete(key(id));
+    return undefined;
+  };
+  // Records past their retention, then beyond `kept` by deadline.
+  const prune = () => {
+    const at = now();
+    const deadlines = Array.from(kv.list({ prefix }), ([name, value]) => {
+      const record = decodeRecord(value);
+      return { name, expiresAt: record._tag === "Some" ? record.value.expiresAt : 0 };
+    }).sort((a, b) => b.expiresAt - a.expiresAt);
+    for (const [index, { name, expiresAt }] of deadlines.entries()) {
+      if (index >= kept || at - expiresAt > retention) kv.delete(name);
+    }
+  };
+  const step = (work: () => void) => {
+    try {
+      work();
+    } catch {
+      // Unknown, or an issue without its end. A later commit failure restarts the object instead.
+    }
+  };
+  return {
+    issued: (id, caller, expiresAt) =>
+      step(() => {
+        kv.put(key(id), { caller, expiresAt });
+        prune();
+      }),
+    ended: (id, end: InteractionEnd) =>
+      step(() => {
+        const record = read(id);
+        // Only the first end is kept, as in memory.
+        if (record !== undefined && record.end === undefined) kv.put(key(id), { ...record, end });
+      }),
+    read: (id) => {
+      try {
+        return read(id);
+      } catch {
+        return undefined;
+      }
+    },
+  };
+};
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-session-release.ts b/apps/hosted/cloud/src/infrastructure/mcp-session-release.ts
index f81972762b..f8f461655b 100644
--- a/apps/hosted/cloud/src/infrastructure/mcp-session-release.ts
+++ b/apps/hosted/cloud/src/infrastructure/mcp-session-release.ts
@@ -22,7 +22,7 @@ import {
   ReleaseRefusal,
   releaseRefusalReport,
 } from "../contracts/release-guard.ts";
-import { telemetryDatasets } from "./telemetry.ts";
+import { telemetryDatasets, telemetryExport } from "./telemetry.ts";
 
 const Bindings = Schema.Array(
   Schema.Struct({
@@ -219,6 +219,11 @@ export const mcpSessionRetirementGate = Effect.gen(function* () {
     new McpSessionReleaseBlocked({
       message: `Not deleting McpSessions from ${api}: ${reason} Nothing was changed. Deploy again once the release that forwards to McpSession is live and serving MCP traffic.`,
     });
+  // The evidence below is the stage's own traces in Axiom.
+  if (!(yield* telemetryExport))
+    return yield* new McpSessionReleaseBlocked({
+      message: `Not deleting McpSessions from ${api}: this test stage does not export telemetry, so there is no MCP traffic evidence to check. Nothing was changed. Deploy it with --telemetry export, and again once it has served MCP traffic.`,
+    });
   const server = workers.get("McpServer");
   const serving = server === undefined ? undefined : yield* liveDeployment(accountId, server);
   if (
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-session-store.ts b/apps/hosted/cloud/src/infrastructure/mcp-session-store.ts
index 801cf76cea..d2b6e17a47 100644
--- a/apps/hosted/cloud/src/infrastructure/mcp-session-store.ts
+++ b/apps/hosted/cloud/src/infrastructure/mcp-session-store.ts
@@ -6,7 +6,9 @@
  * A record holds only what `initialize` negotiated (version, client capabilities and info) and
  * the log level the client set. It grants nothing: every request is authenticated, and its
  * bearer must name this object, before the protocol server reads a record (`mcp-session.ts`).
- * Programs, approvals and held connections stay in memory and are lost as before.
+ * Programs, approvals and held connections stay in memory: an object holding a program keeps
+ * itself in memory until it ends (`mcp-session.ts`), and a restart still loses it, which the
+ * object's record of issued requests reports (`mcp-interaction-store.ts`).
  *
  * Writes happen on `initialize`, on `logging/setLevel` and once per restore, never on other
  * requests. Reads happen only for a session id the object's memory does not hold.
diff --git a/apps/hosted/cloud/src/infrastructure/mcp-session.ts b/apps/hosted/cloud/src/infrastructure/mcp-session.ts
index 7b06b30d4a..57265252d7 100644
--- a/apps/hosted/cloud/src/infrastructure/mcp-session.ts
+++ b/apps/hosted/cloud/src/infrastructure/mcp-session.ts
@@ -16,9 +16,10 @@ import {
 } from "@executor-js/hosted-server";
 import { PgPool } from "@effect/sql-pg";
 import { runningPrograms } from "@executor-js/mcp";
+import type { RuntimeContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
 import * as PgConnection from "@effect/sql-pg/PgConnection";
-import { Effect, Option, type Layer, type Scope } from "effect";
+import { Clock, Effect, Option, type Layer, type Scope } from "effect";
 import { HttpEffect, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { cloudSentry } from "../implementation/error-reporting.ts";
 import {
@@ -33,9 +34,20 @@ import { observeMcpStream } from "../implementation/mcp-stream-observability.ts"
 import { cloudAnalytics } from "../implementation/product-analytics.ts";
 import type { cloudServingProduct } from "./serving-product.ts";
 import { isolateDeclarations } from "./isolate-memory.ts";
+import { cloudDatabaseConnection } from "./database.ts";
 import { cloudObjectDatabase, ObjectDatabase } from "./object-database.ts";
+import { interactionFaults } from "./mcp-interaction-faults.ts";
+import { mcpInteractionStore } from "./mcp-interaction-store.ts";
 import { mcpSessionStore } from "./mcp-session-store.ts";
 
+/**
+ * How often an object holding a program wakes itself. workerd evicts an object 70–140 s after its
+ * last request or event, whatever timers it has pending, and a program waiting for a person
+ * holds no request; an alarm is an event, so it keeps the object, and the program, in memory
+ * until the program ends. Nothing survives a deploy or a crash: their requests read as `lost`.
+ */
+const holdMillis = 30_000;
+
 /**
  * The isolate's executor and MCP identity, built once and shared by every session object in
  * it. Both use the calling object's held database connections.
@@ -57,7 +69,8 @@ export const makeMcpSession = Effect.fn(function* ({
 }: McpSessionServices) {
   const reportErrors = yield* cloudSentry;
   const analytics = yield* cloudAnalytics;
-  const objectDatabase = yield* cloudObjectDatabase;
+  // One object per grant: through Hyperdrive, so active sessions share its PgBouncer clients.
+  const objectDatabase = yield* cloudObjectDatabase(cloudDatabaseConnection);
   return Effect.gen(function* () {
     const state = yield* Cloudflare.DurableObjectState;
     // Every request and MCP operation of this session shares the object's connections.
@@ -75,10 +88,25 @@ export const makeMcpSession = Effect.fn(function* ({
     });
     // What each caller's last tool call read, by app and named accounts (CallStateCache).
     const callState = new Map<string, CallState>();
-    // Protocol sessions are kept in the object's storage, so they outlive its eviction.
-    const handler = yield* makeHostedMcp(undefined, undefined, mcpSessionStore(state.storage)).pipe(
-      Effect.provide(HttpServer.layerServices),
-    );
+    // Protocol sessions are kept in the object's storage, so they outlive its eviction, and so is
+    // the record of the requests it issued, so a resume after a restart learns what became of one.
+    const clock = yield* Clock.Clock;
+    const faults = interactionFaults(state.storage.kv);
+    const handler = yield* makeHostedMcp(
+      undefined,
+      undefined,
+      mcpSessionStore(state.storage),
+      mcpInteractionStore(faults.kv, () => clock.currentTimeMillisUnsafe()),
+    ).pipe(Effect.provide(HttpServer.layerServices));
+    /** While the object holds a program, an alarm is due within `holdMillis`. */
+    const hold = Effect.gen(function* () {
+      if (handler.programs() === 0) return;
+      const now = yield* Clock.currentTimeMillis;
+      const due = now + holdMillis;
+      const set = yield* state.storage.getAlarm();
+      // An alarm whose retries ran out can stay in the past without ever firing again.
+      if (set === null || set > due || set < now - holdMillis) yield* state.storage.setAlarm(due);
+    });
     const objectId = state.id.toString();
     /**
      * A request may reach this object by a session id alone, so before any work it must carry a
@@ -93,7 +121,9 @@ export const makeMcpSession = Effect.fn(function* ({
         named(mcpSessionKey(access)).equals(state.id)
           ? work.pipe(
               Effect.map(
-                HttpServerResponse.setHeader(sessionOrganizationHeader, access.access.organization),
+                HttpServerResponse.setHeaders({
+                  [sessionOrganizationHeader]: access.access.organization,
+                }),
               ),
             )
           : Effect.annotateCurrentSpan("executor.mcp.session_binding", "refused").pipe(
@@ -177,13 +207,18 @@ export const makeMcpSession = Effect.fn(function* ({
       });
     return {
       fetch: Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) =>
-        addressed(
-          new URL(request.url, "https://mcp.internal").pathname.startsWith("/api/mcp/approvals/")
-            ? browser
-            : http,
+        faults.during(
+          request,
+          addressed(
+            new URL(request.url, "https://mcp.internal").pathname.startsWith("/api/mcp/approvals/")
+              ? browser
+              : http,
+          ),
         ),
       ).pipe(
         Effect.flatMap(observeMcpStream("session")),
+        // A request may leave a program waiting for an answer: keep the object until it ends.
+        Effect.tap(() => hold.pipe(Effect.ignore)),
         Effect.tap((response) =>
           Effect.annotateCurrentSpan("http.response.status_code", response.status),
         ),
@@ -198,6 +233,8 @@ export const makeMcpSession = Effect.fn(function* ({
         reportErrors,
         Effect.provideService(ObjectDatabase, database),
       ),
+      // An alarm only renews the hold. One that wakes a restarted object finds no program and stops.
+      alarm: () => hold.pipe(Effect.ignore),
     } satisfies McpSessionHandler;
   });
 });
@@ -210,8 +247,9 @@ interface McpSessionHandler {
   readonly fetch: Effect.Effect<
     HttpServerResponse.HttpServerResponse,
     unknown,
-    HttpServerRequest.HttpServerRequest | Scope.Scope
+    HttpServerRequest.HttpServerRequest | Scope.Scope | RuntimeContext
   >;
+  readonly alarm: () => Effect.Effect<void, never, RuntimeContext>;
 }
 
 /** What the gateway binds on a session object. */
diff --git a/apps/hosted/cloud/src/infrastructure/mcp.ts b/apps/hosted/cloud/src/infrastructure/mcp.ts
index 7ec8a0cfd4..dc1ea28d93 100644
--- a/apps/hosted/cloud/src/infrastructure/mcp.ts
+++ b/apps/hosted/cloud/src/infrastructure/mcp.ts
@@ -5,6 +5,7 @@ import {
   McpAuthentication,
   authenticatedMcp,
   browserMcpRequest,
+  callerSpanAttributes,
   mcpChallenge,
   mcpSessionKey,
 } from "@executor-js/hosted-server";
@@ -12,7 +13,12 @@ import * as Cloudflare from "alchemy/Cloudflare";
 import { Effect, Option, Schema } from "effect";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
 import type { HttpServerError } from "effect/http/HttpServerError";
-import { forwardMcpRequest } from "../implementation/mcp-forward.ts";
+import {
+  answerMemoryLimit,
+  forwardMcpRequest,
+  refuseTooDeep,
+} from "../implementation/mcp-forward.ts";
+import { mcpRequestAttributes, parseMcpBody } from "../implementation/mcp-request-method.ts";
 import {
   mcpSessionNotFound,
   sessionOrganizationHeader,
@@ -59,31 +65,77 @@ export const cloudMcp = Effect.gen(function* () {
   const sessions = yield* McpSession.from(McpServer);
   const environment = yield* Cloudflare.WorkerEnvironment;
   const keys = yield* mcpSessionKeys;
+  /**
+   * Forward one request to its session object. An authenticated request's forward names its
+   * organization and user from the start, so a forward the object never answers still names them;
+   * one routed by its session id learns only the organization, from the object's answer.
+   */
   const send = (
-    route: "authenticated" | "session",
+    route:
+      | {
+          readonly kind: "authenticated";
+          readonly caller: ReturnType<typeof callerSpanAttributes>;
+        }
+      | { readonly kind: "session" },
+    /** An approval page's request carries no JSON-RPC message. */
+    carries: "json-rpc" | "approval",
     fetch: (
       attempt: HttpServerRequest.HttpServerRequest,
     ) => Effect.Effect<HttpServerResponse.HttpServerResponse, HttpServerError>,
   ) =>
-    Effect.gen(function* () {
-      yield* Effect.annotateCurrentSpan("executor.mcp.route", route);
-      const request = yield* HttpServerRequest.HttpServerRequest;
-      const headers = yield* traceHeaders;
-      const traced = request.modify({ headers: { ...request.headers, ...headers } });
-      const response = yield* forwardMcpRequest(traced, (attempt) => timedForward(fetch(attempt)));
-      const organization = response.headers[sessionOrganizationHeader];
-      if (organization !== undefined)
-        yield* Effect.annotateCurrentSpan("executor.organization.id", organization);
-      return HttpServerResponse.removeHeader(response, sessionOrganizationHeader);
-    }).pipe(Effect.flatMap(observeMcpStream("gateway")), Effect.withSpan("mcp.session.forward"));
-  const forward = (access: Parameters<typeof mcpSessionKey>[0]) =>
-    Effect.annotateCurrentSpan("executor.organization.id", access.access.organization).pipe(
-      Effect.andThen(
-        send("authenticated", (attempt) =>
-          sessions.getByName(mcpSessionKey(access)).fetch(attempt),
-        ),
-      ),
+    Effect.flatMap(Effect.option(Effect.currentSpan), (server) =>
+      Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan(
+          route.kind === "authenticated"
+            ? { "executor.mcp.route": route.kind, ...route.caller }
+            : { "executor.mcp.route": route.kind },
+        );
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        // Read from a copy, so the forwarded body is untouched; only a lost response and the
+        // method attributes need it.
+        const body = parseMcpBody(
+          request.method === "POST"
+            ? yield* HttpServerRequest.toWeb(request).pipe(
+                Effect.flatMap((web) => Effect.tryPromise(() => web.clone().text())),
+                Effect.option,
+                Effect.map(Option.getOrUndefined),
+              )
+            : undefined,
+        );
+        if (carries === "json-rpc" && request.method === "POST") {
+          // Both the forward and the gateway's request span, which records the response status.
+          const attributes = mcpRequestAttributes(body);
+          yield* Effect.annotateCurrentSpan(attributes);
+          if (Option.isSome(server))
+            for (const [key, value] of Object.entries(attributes))
+              server.value.attribute(key, value);
+        }
+        return yield* Effect.gen(function* () {
+          const headers = yield* traceHeaders;
+          const traced = request.modify({ headers: { ...request.headers, ...headers } });
+          const response = yield* refuseTooDeep(
+            forwardMcpRequest(traced, (attempt) => timedForward(fetch(attempt))),
+          );
+          // A request routed by its session id learns its organization here, from the object,
+          // which sets it once the bearer's own key names it. Its user is on the object's spans.
+          const organization = response.headers[sessionOrganizationHeader];
+          if (organization !== undefined)
+            yield* Effect.annotateCurrentSpan("executor.organization.id", organization);
+          return HttpServerResponse.removeHeader(response, sessionOrganizationHeader);
+        }).pipe(Effect.flatMap(observeMcpStream("gateway")), answerMemoryLimit(body));
+      }).pipe(Effect.withSpan("mcp.session.forward")),
     );
+  const forward =
+    (carries: "json-rpc" | "approval") => (access: Parameters<typeof mcpSessionKey>[0]) => {
+      const caller = callerSpanAttributes(access.access.organization, access.userId);
+      return Effect.annotateCurrentSpan(caller).pipe(
+        Effect.andThen(
+          send({ kind: "authenticated", caller }, carries, (attempt) =>
+            sessions.getByName(mcpSessionKey(access)).fetch(attempt),
+          ),
+        ),
+      );
+    };
   const inSession = (value: string) =>
     Effect.gen(function* () {
       const auth = yield* McpAuthentication;
@@ -114,13 +166,13 @@ export const cloudMcp = Effect.gen(function* () {
         return mcpSessionNotFound();
       }
       const object = Cloudflare.fromCloudflareFetcher(namespace.get(id.value));
-      return yield* send("session", (attempt) => object.fetch(attempt));
+      return yield* send({ kind: "session" }, "json-rpc", (attempt) => object.fetch(attempt));
     }).pipe(Effect.map(HttpServerResponse.setHeader("cache-control", "no-store")));
   return {
     http: Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => {
       const session = request.headers["mcp-session-id"];
-      return session === undefined ? authenticatedMcp(forward) : inSession(session);
+      return session === undefined ? authenticatedMcp(forward("json-rpc")) : inSession(session);
     }),
-    approvals: browserMcpRequest((access) => forward(access)),
+    approvals: browserMcpRequest(forward("approval")),
   };
 });
diff --git a/apps/hosted/cloud/src/infrastructure/object-database.ts b/apps/hosted/cloud/src/infrastructure/object-database.ts
index 5aecf443a4..c9ab6637a8 100644
--- a/apps/hosted/cloud/src/infrastructure/object-database.ts
+++ b/apps/hosted/cloud/src/infrastructure/object-database.ts
@@ -2,7 +2,7 @@
  * Durable Objects keep their database connections across calls. A Worker event owns its own
  * connections and closes them with the event (`invocation-database.ts`); a Durable
  * Object serves many calls in one I/O context, so reconnecting in every call, or in every MCP
- * operation, only repeats the TLS login to PgBouncer.
+ * operation, only repeats the connection setup.
  */
 import type { PgClient } from "@effect/sql-pg";
 import {
@@ -21,18 +21,19 @@ import type { SqlClient } from "effect/sql";
 import {
   ConnectionReservations,
   type OpenedConnections,
+  type cloudDatabaseConnection,
   cloudDatabasePool,
-  cloudDirectDatabaseConnection,
+  type cloudDirectDatabaseConnection,
 } from "./database.ts";
 
 /**
- * An object closes its connections this long after its last call ends. PgBouncer pools in
- * transaction mode, so an idle client connection holds no Postgres backend meanwhile; it counts
- * only toward PgBouncer's client limit (notes/database-pool.md).
+ * An object closes its connections this long after its last call ends. Both routes pool in
+ * transaction mode, so an idle connection holds no Postgres backend meanwhile. A direct one
+ * still takes one of PgBouncer's client slots (notes/database-pool.md).
  *
- * A new connection costs a TLS login of about 70 ms on the next call's critical path. MCP clients
- * often pause longer than 30 seconds between tool calls, so a shorter window reconnects on most
- * of their calls after a pause. Cloudflare keeps an idle Durable Object in memory for 70–140 s
+ * A new connection costs its setup on the next call's critical path, a TLS login of about 70 ms
+ * direct to PgBouncer. MCP clients often pause longer than 30 seconds between tool calls, so a
+ * shorter window reconnects on most of their calls after a pause. Cloudflare keeps an idle Durable Object in memory for 70–140 s
  * after its last request, and the window's open socket and timer keep it there until the window
  * closes, so a window much longer than that would mostly hold objects in memory (billed duration)
  * for calls that rarely come.
@@ -103,16 +104,26 @@ const applicationName = (owner: string) => `executor ${owner}`.slice(0, 63);
  * window's connections; other calls use the rest and never join the transaction. A connection
  * the server drops is replaced on its next use, by the pool itself. Opening a connection gets a
  * second attempt when the first fails or times out ({@link cloudDatabasePool}). When the last
- * call ends, the window closes after {@link idleWindow}; the next call opens a new one. A caller
+ * call ends, the window closes after the owner's linger, {@link idleWindow} unless the owner
+ * gives another; the next call opens a new one. A caller
  * that gives up a connection retires the window instead: later calls open a new one, and the
  * retired window closes as soon as its last call ends, closing that connection with it. A call
  * that never ends therefore keeps its retired window open, and the object's windows together can
  * then hold more than {@link objectConnectionLimit} connections; nothing exercises that yet. Workerd
  * has no teardown hook for evicted objects; eviction drops their sockets.
+ *
+ * `route` is where the connections go. A class with one object per caller, such as the MCP session
+ * objects (one per grant), passes {@link cloudDatabaseConnection}: through Hyperdrive, its objects
+ * share Hyperdrive's bounded pool of PgBouncer clients however many are active. Direct, each active
+ * object would hold PgBouncer clients of its own, and the number of active objects grows with
+ * usage until PgBouncer's client limit refuses new ones (notes/database-pool.md). Only a class
+ * with a fixed number of objects, such as the schedule coordinator, may connect directly.
  */
-export const cloudObjectDatabase = Effect.gen(function* () {
-  const connection = yield* cloudDirectDatabaseConnection;
-  return Effect.fn(function* (owner: string) {
+export const cloudObjectDatabase = Effect.fn(function* (
+  route: typeof cloudDatabaseConnection | typeof cloudDirectDatabaseConnection,
+) {
+  const connection = yield* route;
+  return Effect.fn(function* (owner: string, linger: Duration.Duration = idleWindow) {
     // Owned by the object for its whole life; only windows are ever closed.
     const root = Scope.makeUnsafe();
     const lock = yield* Semaphore.make(1);
@@ -152,6 +163,7 @@ export const cloudObjectDatabase = Effect.gen(function* () {
         const sql = yield* Layer.buildWithScope(
           cloudDatabasePool({
             url,
+            route: connection.route,
             maxConnections: objectConnectionLimit,
             idleTimeout: idleWindow,
             applicationName: applicationName(owner),
@@ -193,7 +205,8 @@ export const cloudObjectDatabase = Effect.gen(function* () {
           if (leased.leases > 0) return;
           // A retired window closes once its last caller is done.
           if (window !== leased) return yield* Scope.close(leased.scope, Exit.void);
-          leased.idle = yield* Effect.sleep(idleWindow).pipe(
+          if (Duration.isZero(linger)) return yield* close(leased);
+          leased.idle = yield* Effect.sleep(linger).pipe(
             Effect.andThen(lock.withPermits(1)(close(leased))),
             Effect.forkIn(root),
           );
diff --git a/apps/hosted/cloud/src/infrastructure/onboarding.ts b/apps/hosted/cloud/src/infrastructure/onboarding.ts
index 3a3a7a4183..ca8c5713c6 100644
--- a/apps/hosted/cloud/src/infrastructure/onboarding.ts
+++ b/apps/hosted/cloud/src/infrastructure/onboarding.ts
@@ -31,12 +31,13 @@ import {
   v1ImportAccess,
   missingV1ImportWriter,
   missingV1McpForwardSecret,
-  v1ImportAllowedOrgsSetting,
   v1ImportOperatorTokenMinLength,
   v1ImportWriterName,
   v1LiveSettings,
 } from "./v1-import-settings.ts";
 import { autumnServer, billingSettings } from "./billing.ts";
+import type { AutumnOptions } from "../contracts/autumn.ts";
+import type { BillingCatalog } from "../contracts/billing-catalog.ts";
 import { cloudDatabaseConnection, v1DatabaseConnection } from "./database.ts";
 import {
   CheckSince,
@@ -198,6 +199,12 @@ export const cloudOnboarding = Effect.gen(function* () {
           Effect.provide(RuntimeContext.phantom),
           Effect.mapError(() => new OnboardingUnavailable()),
         ),
+      gate: (userId, organization, progress) =>
+        service.pipe(
+          Effect.flatMap((onboarding) => onboarding.gate(userId, organization, progress)),
+          Effect.provide(RuntimeContext.phantom),
+          Effect.mapError(() => new OnboardingUnavailable()),
+        ),
     }),
   );
 });
@@ -327,7 +334,7 @@ export interface V1ImportSettings {
   readonly source: Effect.Effect<V1SourceSettings>;
   /**
    * Which organizations an operator may import, writing v2: none without
-   * `CLOUD_V1_IMPORT_WRITES`, and on v1's real data only those `CLOUD_V1_IMPORT_ALLOWED_ORGS` lists.
+   * `CLOUD_V1_IMPORT_WRITES`, and otherwise only those with a row in `private_v1_import_allowed`.
    */
   readonly writes: V1ImportWrites;
   /** Whether the source is v1's real data: production's, or the live source of a local dry run. */
@@ -352,6 +359,13 @@ export interface V1ImportSettings {
    * emulated v1 runs no such requests.
    */
   readonly freezeSettleSeconds: number;
+  /**
+   * v2's Autumn and catalog, where a paid organization's v1 subscription carries over: the account
+   * v1 billed in. None for the live source, whose v1 bills in another account than this Cloud.
+   */
+  readonly billing: Option.Option<
+    Effect.Effect<{ readonly options: AutumnOptions; readonly catalog: BillingCatalog }>
+  >;
 }
 
 /**
@@ -359,13 +373,13 @@ export interface V1ImportSettings {
  *
  * - Emulated Cloud with a v1 database (managed local Cloud) reads the emulated v1 WorkOS and its
  *   Vault, the v1 database (blobs from its `blob` table, as v1 keeps them without R2) and Autumn,
- *   and allows imports that write.
+ *   and allows imports that write, of the organizations with a row in `private_v1_import_allowed`.
  * - Production runs it only when `CLOUD_V1_IMPORT=on` (`v1-import-settings.ts`, off by default).
  *   It then reads v1's WorkOS (`V1_WORKOS_API_KEY`, also the sign-in check's), v1's database
  *   through the read-only role (`V1_DATABASE_URL`), the Autumn account v2 bills from (v1 billed
  *   there too), and v1's blob bucket through the `V1_BLOBS` binding. It starts only dry runs
- *   unless `CLOUD_V1_IMPORT_WRITES=on` too, and then imports only the organizations
- *   `CLOUD_V1_IMPORT_ALLOWED_ORGS` lists.
+ *   unless `CLOUD_V1_IMPORT_WRITES=on` too, and then imports only the organizations with a row
+ *   in `private_v1_import_allowed`, which only direct SQL writes (`writes.ts`).
  * - Local Cloud dev with `CLOUD_V1_IMPORT_SOURCE=live` reads v1's production data read-only
  *   (`cloudV1LiveSource`) and runs only dry runs. Any other stage or origin refuses the setting.
  * - Everywhere else, and on production while the switch is off, there is no importer. Another
@@ -417,15 +431,11 @@ export const cloudV1ImportSettings = Effect.gen(function* () {
       })
     : Option.isNone(writer)
       ? V1ImportWrites.Refused({ reason: missingV1ImportWriter })
-      : access.source === "production"
-        ? V1ImportWrites.Listed({
-            organizations: yield* v1ImportAllowedOrgsSetting,
-            flag: v1MovedFlagPostgres(writer.value),
-          })
-        : access.source === "emulated"
-          ? V1ImportWrites.Any({ flag: v1MovedFlagPostgres(writer.value) })
-          : V1ImportWrites.Refused({ reason: "This deployment has no v1 source that writes." });
+      : access.source === "production" || access.source === "emulated"
+        ? V1ImportWrites.Listed({ flag: v1MovedFlagPostgres(writer.value) })
+        : V1ImportWrites.Refused({ reason: "This deployment has no v1 source that writes." });
   const secrets = yield* cloudSecrets.pipe(Effect.orDie);
+  const billing = yield* billingSettings;
   return Option.some<V1ImportSettings>({
     source: source.value,
     writes,
@@ -435,5 +445,14 @@ export const cloudV1ImportSettings = Effect.gen(function* () {
     slugKey: secrets.authSecret,
     stepRetries: realV1 ? { limit: 5, delaySeconds: 10 } : { limit: 2, delaySeconds: 1 },
     freezeSettleSeconds: realV1 ? 60 : 1,
+    billing:
+      access.source === "live"
+        ? Option.none()
+        : Option.some(
+            Effect.all({
+              options: Effect.all({ serverUrl: billing.serverUrl, secretKey: billing.secretKey }),
+              catalog: billing.catalog,
+            }),
+          ),
   });
 });
diff --git a/apps/hosted/cloud/src/infrastructure/posthog-experiment.ts b/apps/hosted/cloud/src/infrastructure/posthog-experiment.ts
index 70340ae12d..f33b81d283 100644
--- a/apps/hosted/cloud/src/infrastructure/posthog-experiment.ts
+++ b/apps/hosted/cloud/src/infrastructure/posthog-experiment.ts
@@ -6,7 +6,7 @@ import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
 import { Effect, Redacted, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
-import { onboardingExperiment } from "../contracts/onboarding.ts";
+import { onboardingExperiment, onboardingSkipExperiment } from "../contracts/onboarding.ts";
 import { PostHogProvisioningFailed } from "./posthog-provider.ts";
 
 const ownership = (key: string) => `[executor-next:${key}]`;
@@ -214,6 +214,91 @@ export const onboardingExperimentDefinition: PostHogExperimentDefinition = {
   only_count_matured_users: true,
 };
 
+const skipWindow = { ...window, conversion_window: onboardingSkipExperiment.attributionDays };
+
+/**
+ * Skippable or required setup steps, for members creating their first Cloud team, assigned
+ * independently of the order. Its metrics mirror the order experiment's; skipping cannot happen in
+ * `required`, so instead of the skip actions it counts signing out of setup, the only way out of a
+ * required setup and the one leaving that both variants record.
+ */
+export const onboardingSkipExperimentDefinition: PostHogExperimentDefinition = {
+  name: "Onboarding skip: skippable or required setup steps",
+  description: `Members creating their first Cloud team can skip connecting accounts and their assistant (control), or must do both before the dashboard opens; signing out is the only way out. Both end at the first prompt.\n${ownership(onboardingSkipExperiment.flag)}`,
+  feature_flag_key: onboardingSkipExperiment.flag,
+  feature_flag: {
+    ensure_experience_continuity: false,
+    filters: {
+      groups: [{ properties: [], rollout_percentage: 100 }],
+      multivariate: {
+        variants: [
+          { key: "skippable", rollout_percentage: 50 },
+          { key: "required", rollout_percentage: 50 },
+        ],
+      },
+    },
+  },
+  parameters: {
+    variant_notes: {
+      skippable: "Each setup step offers Skip for now",
+      required: "Each setup step waits until done; the dashboard opens after both",
+    },
+  },
+  metrics: [
+    {
+      ...skipWindow,
+      uuid: "9fb8011e-7791-4524-9eb1-8af955f98437",
+      name: "First successful tool call within 7 days",
+      goal: "increase",
+      series: [
+        {
+          kind: "EventsNode",
+          event: "tool_execution_completed",
+          properties: [{ key: "ok", value: ["true"], operator: "exact", type: "event" }],
+        },
+      ],
+    },
+  ],
+  metrics_secondary: [
+    {
+      ...skipWindow,
+      uuid: "d46c48f7-9e30-4d12-89b0-c70b8af82977",
+      name: "MCP agent connected",
+      goal: "increase",
+      series: [
+        {
+          kind: "EventsNode",
+          event: "agent_connected",
+          properties: [{ key: "grant_kind", value: ["mcp"], operator: "exact", type: "event" }],
+        },
+      ],
+    },
+    {
+      ...skipWindow,
+      uuid: "6e2b2d44-f240-47af-ab6d-1412bcd3620e",
+      name: "Account connected",
+      goal: "increase",
+      series: [{ kind: "EventsNode", event: "account_connected" }],
+    },
+    {
+      ...skipWindow,
+      uuid: "8b041cd6-f631-4070-af9c-524be09337c3",
+      name: "Reached the first prompt",
+      goal: "increase",
+      series: [onboardingAction("setup_prompt")],
+    },
+    {
+      ...skipWindow,
+      uuid: "66d40fe8-ccf6-47c0-b637-f5356c0d0438",
+      name: "Signed out of setup",
+      goal: "decrease",
+      series: [onboardingAction("leave_setup")],
+    },
+  ],
+  exposure_criteria: { filterTestAccounts: true, multiple_variant_handling: "exclude" },
+  only_count_matured_users: true,
+};
+
 const Experiment = Schema.Struct({
   id: Schema.Number,
   name: Schema.String,
diff --git a/apps/hosted/cloud/src/infrastructure/product.ts b/apps/hosted/cloud/src/infrastructure/product.ts
index 959c04be7e..f751072b30 100644
--- a/apps/hosted/cloud/src/infrastructure/product.ts
+++ b/apps/hosted/cloud/src/infrastructure/product.ts
@@ -21,6 +21,7 @@ import { RuntimeContext } from "alchemy";
 import type * as Cloudflare from "alchemy/Cloudflare";
 import { Effect, Layer } from "effect";
 import { AppDomainDatabase } from "../implementation/app-domain-records.ts";
+import { RemovedOrganizations } from "../implementation/organization-removal.ts";
 import { V1ImportDatabase, V1ImportUnavailable } from "../contracts/v1-import.ts";
 import { UiFailed } from "apps/ui/contracts";
 import type { ArtifactsTokens } from "@executor-js/app-source/cloudflare";
@@ -104,6 +105,7 @@ export const cloudProduct = Effect.fn(function* (
     ),
     Layer.succeed(OrganizationRemovals, removals.removals),
     Layer.succeed(OrganizationTombstones, removals.tombstones),
+    Layer.succeed(RemovedOrganizations, removals.removed),
     Layer.succeed(
       AppDomainDatabase,
       sql.pipe(Effect.mapError(() => new UiFailed({ reason: "unavailable" }))),
diff --git a/apps/hosted/cloud/src/infrastructure/provisioning.ts b/apps/hosted/cloud/src/infrastructure/provisioning.ts
index 764e50e6ac..c2c95ae258 100644
--- a/apps/hosted/cloud/src/infrastructure/provisioning.ts
+++ b/apps/hosted/cloud/src/infrastructure/provisioning.ts
@@ -3,7 +3,7 @@ import { cloudArtifactsTokensLive } from "./artifacts-tokens.ts";
 import { RuntimeContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
 import type { Workflow } from "@cloudflare/workers-types";
-import { Cause, Effect, Schema } from "effect";
+import { Cause, Effect, Result, Schema } from "effect";
 import { GroupDatabase } from "@executor-js/hosted-server/groups";
 import { ScheduleWakeup } from "@executor-js/hosted-server";
 import {
@@ -22,6 +22,7 @@ import { AppDomainController } from "./app-domain-controller-worker.ts";
 import { billingLive } from "../implementation/billing.ts";
 import { BillingMeter } from "../contracts/billing-meter.ts";
 import { cloudAnalytics } from "../implementation/product-analytics.ts";
+import { jobUnits } from "../contracts/job-outcome.ts";
 import { cloudBackgroundJobs } from "./background-jobs.ts";
 
 /** Each committed lifecycle action has its own workflow, so unrelated failures do not block setup. */
@@ -140,6 +141,7 @@ const ClaimedJobs = Schema.Array(
  * Start by stable outbox ID. A crash after create is recovered by observing the same instance.
  * Once a team installation's workflow exists and has not finished, `installTeam` may also run
  * that job at once (see {@link provisionTeamNow}); its other jobs keep dispatching meanwhile.
+ * A job that fails to dispatch is tried again once its lease ends; the outcome counts it.
  */
 export const dispatchProvisioning = <R>(
   installTeam: (job: string) => Effect.Effect<void, never, R>,
@@ -161,7 +163,7 @@ export const dispatchProvisioning = <R>(
       from candidates where job.id = candidates.id returning job.id, job.kind`.pipe(
         Effect.flatMap(Schema.decodeUnknownEffect(ClaimedJobs)),
       );
-    yield* Effect.forEach(
+    const dispatched = yield* Effect.forEach(
       jobs,
       (job) =>
         Effect.gen(function* () {
@@ -191,9 +193,14 @@ export const dispatchProvisioning = <R>(
             yield* Effect.logError("Provisioning workflow needs attention", { job: job.id });
           if (job.kind === "team" && persisted === "running") yield* installTeam(job.id);
         }).pipe(
-          Effect.catch(() => Effect.logWarning("Provisioning dispatch failed", { job: job.id })),
+          Effect.tapError(() => Effect.logWarning("Provisioning dispatch failed", { job: job.id })),
+          Effect.result,
         ),
-      { concurrency: 4, discard: true },
+      { concurrency: 4 },
+    );
+    return jobUnits(
+      jobs.length,
+      dispatched.filter(Result.isFailure).map((result) => result.failure),
     );
   }).pipe(Effect.mapError(() => new ProvisioningFailed()));
 
diff --git a/apps/hosted/cloud/src/infrastructure/runtime.ts b/apps/hosted/cloud/src/infrastructure/runtime.ts
index 238fe6685b..620acaca1c 100644
--- a/apps/hosted/cloud/src/infrastructure/runtime.ts
+++ b/apps/hosted/cloud/src/infrastructure/runtime.ts
@@ -20,9 +20,9 @@ import {
 import { HostRequirementsError, DeclaredRequirements, HostResponse } from "apps/contracts";
 import { RuntimeContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
-import { Context, Effect, FiberSet, Option, Schema } from "effect";
-import { CurrentOrganization, CurrentUserId } from "@executor-js/hosted-server";
+import { Effect, FiberSet, Schema } from "effect";
 import { dataChanges } from "../implementation/data-changes.ts";
+import { runtimeActor } from "../implementation/runtime-actor.ts";
 import { cacheRuntimeBuild, cachedRuntimeBuilds } from "../implementation/runtime-build-cache.ts";
 import type { DurableObjectNamespace } from "@cloudflare/workers-types";
 import { CloudCompileResult } from "../contracts/builds.ts";
@@ -67,19 +67,7 @@ const compilerDidNotAnswer = Effect.annotateCurrentSpan(
  * and its own usage data cannot be split by user or organization.
  */
 const withActor = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-  Effect.gen(function* () {
-    const context = yield* Effect.context<never>();
-    const user = Context.get(context, CurrentUserId);
-    const organization = Context.getOption(context, CurrentOrganization);
-    return yield* effect.pipe(
-      Effect.annotateSpans({
-        ...(user === undefined ? {} : { "executor.user.id": user }),
-        ...(Option.isSome(organization)
-          ? { "executor.organization.id": organization.value.organization }
-          : {}),
-      }),
-    );
-  });
+  Effect.flatMap(runtimeActor, (actor) => Effect.annotateSpans(effect, actor));
 const NativeNamespace = Schema.declare(
   (value): value is Pick<DurableObjectNamespace, "getByName"> =>
     typeof value === "object" &&
@@ -157,6 +145,7 @@ export const cloudRuntime = Effect.fn(function* (
     );
     const runtime = yield* appRuntime({
       name: "runtime.cloud",
+      actor: runtimeActor,
       loadBuild: load,
       invoke: (invocation, capabilities) =>
         withActor(
diff --git a/apps/hosted/cloud/src/infrastructure/schedules.ts b/apps/hosted/cloud/src/infrastructure/schedules.ts
index 10391a3353..cdbfea39f1 100644
--- a/apps/hosted/cloud/src/infrastructure/schedules.ts
+++ b/apps/hosted/cloud/src/infrastructure/schedules.ts
@@ -7,12 +7,16 @@ import { ScheduleObservation } from "@executor-js/sdk/scheduling";
 import { previewLifetime } from "./test-stage-expiry.ts";
 import { EventCleanup } from "./event-cleanup.ts";
 import { WebhookSourceHost } from "@executor-js/sdk/core";
-import { scheduleRecoveryMilliseconds } from "../contracts/schedules.ts";
+import {
+  cloudScheduleConcurrency,
+  heldAlarmMilliseconds,
+  scheduleRecoveryMilliseconds,
+} from "../contracts/schedules.ts";
 /** Native alarms wake one coordinator; authoritative schedule/run state remains in Postgres. */
 import * as Cloudflare from "alchemy/Cloudflare";
 import { RuntimeContext } from "alchemy";
 import { makeExecutionMemo } from "alchemy/Runtime/ExecutionMemo";
-import { Config, Clock, Effect, Exit, Layer, Schema, Semaphore } from "effect";
+import { Clock, Duration, Effect, Exit, Layer, Semaphore } from "effect";
 import { HostedExecutor, ScheduledAuthority, ScheduleWakeup } from "@executor-js/hosted-server";
 import { defaultScheduleWorkerOptions } from "@executor-js/sdk/scheduling";
 import { cloudProduct } from "./product.ts";
@@ -20,6 +24,7 @@ import { lookupColo } from "./colo.ts";
 import { appDataSupervisors } from "./app-data.ts";
 import { cloudAuthDatabase } from "./auth-database.ts";
 import { cloudBackgroundJobs } from "./background-jobs.ts";
+import { cloudDirectDatabaseConnection } from "./database.ts";
 import { cloudObjectDatabase, ObjectDatabase } from "./object-database.ts";
 
 /**
@@ -52,19 +57,17 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
   const analytics = yield* cloudAnalytics;
   const report = yield* cloudSentry;
   const resources = yield* cloudProduct(yield* appDataSupervisors, yield* cloudArtifactsTokensLive);
-  const concurrency = yield* Config.Number("EXECUTOR_SCHEDULE_CONCURRENCY").pipe(
-    Config.withDefault(defaultScheduleWorkerOptions.concurrency),
-    Effect.flatMap(Schema.decodeUnknownEffect(Schema.Int.check(Schema.isGreaterThan(0)))),
-    Effect.orDie,
-  );
-  const objectDatabase = yield* cloudObjectDatabase;
+  // The one coordinator connects directly: its few connections stay beside the database.
+  const objectDatabase = yield* cloudObjectDatabase(cloudDirectDatabaseConnection);
   const retired = yield* ScheduleCoordinator;
   return Effect.gen(function* () {
     const state = yield* Cloudflare.DurableObjectState;
     const lifetime = yield* previewLifetime;
-    // Alarms, wakes and the dispatched runs share the coordinator's held connections.
-    const database = yield* objectDatabase("schedules");
-    const pool = yield* Semaphore.make(concurrency);
+    // Alarms, wakes and the dispatched runs share the coordinator's connections while they
+    // overlap. The connections close when the last one ends: an open socket or idle timer would
+    // keep the object from hibernating between its minute wakes.
+    const database = yield* objectDatabase("schedules", Duration.zero);
+    const pool = yield* Semaphore.make(cloudScheduleConcurrency);
     const lifecycle = yield* Semaphore.make(1);
     const alarms = yield* Semaphore.make(1);
     const restoring = yield* Semaphore.make(1);
@@ -74,6 +77,9 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
     // Whether this instance has armed the retired coordinator's heartbeat since background work
     // last stopped, which deletes it.
     let heartbeat = false;
+    // Alarm events in progress, their dispatch included. The runtime delivers one alarm at a time,
+    // so an alarm that falls due meanwhile waits for them without being held.
+    let alarmEvents = 0;
     const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
       effect.pipe(Effect.provide(resources), Effect.provideService(ObjectDatabase, database));
     const retire = Effect.suspend(() => retired.getByName(retiredName).retire()).pipe(
@@ -126,6 +132,20 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
         if (due === undefined || (yield* Clock.currentTimeMillis) >= due) yield* attempt;
       }),
     );
+    /**
+     * Writes a new time over a stored alarm well past its time while no alarm event runs. Such an
+     * alarm is held: the runtime can schedule a later time than the one it stores and reports
+     * (cloudflare/workerd#7330), and only writing a different time schedules it again. Before this,
+     * a held alarm left every wake waiting for the later time, up to the minute recovery alarm.
+     */
+    const rearm = (now: number, pending: number) =>
+      state.storage
+        .setAlarm(now)
+        .pipe(
+          Effect.andThen(
+            Effect.logWarning("Schedule alarm held past its time", { lateMs: now - pending }),
+          ),
+        );
     /** A stopped background deletes both objects' alarms, as before the handover. */
     const stop = alarms.withPermits(1)(
       Effect.gen(function* () {
@@ -139,10 +159,10 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
         Effect.gen(function* () {
           const executor = yield* Effect.flatten(HostedExecutor);
           // Event deliveries due for a retry wake this coordinator too.
-          const [schedule, delivery] = yield* Effect.all([
-            executor.scheduler.nextWake,
-            executor.events.nextWake,
-          ]);
+          const [schedule, delivery] = yield* Effect.all(
+            [executor.scheduler.nextWake, executor.events.nextWake],
+            { concurrency: "unbounded" },
+          );
           const next =
             schedule === null || delivery === null
               ? (schedule ?? delivery)
@@ -176,27 +196,35 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
           Effect.gen(function* () {
             const executor = yield* Effect.flatten(HostedExecutor);
             const authorize = yield* ScheduledAuthority;
-            yield* Effect.annotateCurrentSpan({
-              "executor.schedule.runner": "cloud",
-              "cloudflare.colo": yield* colo,
-            });
-            yield* lifecycle.withPermits(1)(
-              Effect.gen(function* () {
-                if (initialized) return;
-                // One bounded attempt at most, unless a wake's attempt failed and its retry is not
-                // due. Dispatch then proceeds: Postgres claims keep each occurrence to one run
-                // even if old code still answers, and the stored retry hands over later.
-                yield* restore;
-                yield* executor.scheduler.recover("cloud");
-                initialized = true;
-              }),
+            yield* Effect.annotateCurrentSpan("executor.schedule.runner", "cloud");
+            // A fresh object's colo lookup and its first-pass recovery both wait on the network;
+            // neither needs the other.
+            yield* Effect.all(
+              [
+                colo.pipe(
+                  Effect.flatMap((code) => Effect.annotateCurrentSpan("cloudflare.colo", code)),
+                ),
+                lifecycle.withPermits(1)(
+                  Effect.gen(function* () {
+                    if (initialized) return;
+                    // One bounded attempt at most, unless a wake's attempt failed and its retry is
+                    // not due. Dispatch then proceeds: Postgres claims keep each occurrence to one
+                    // run even if old code still answers, and the stored retry hands over later.
+                    yield* restore;
+                    yield* executor.scheduler.recover("cloud");
+                    initialized = true;
+                  }),
+                ),
+              ],
+              { concurrency: "unbounded", discard: true },
             );
             // Alarm callbacks own this work through waitUntil; new wakes can discover other due apps meanwhile.
             yield* dispatch.run(
-              executor[WebhookSourceHost].tick(concurrency),
+              // Webhook source maintenance keeps the Node hosts' width; only scheduled runs widen.
+              executor[WebhookSourceHost].tick(defaultScheduleWorkerOptions.concurrency),
               executor.scheduler.tick({
                 runner: "cloud",
-                maxCandidates: concurrency,
+                maxCandidates: cloudScheduleConcurrency,
                 authorize,
                 execute: (operation) =>
                   pool.withPermitsIfAvailable(1)(operation).pipe(Effect.asVoid),
@@ -252,16 +280,28 @@ const makePlacedScheduleCoordinator = Effect.gen(function* () {
               // A wake only brings the alarm in. Wakes arrive from every write in every
               // organization; when each one moved the alarm a second out, wakes under a second
               // apart kept it from ever firing, and due runs waited up to a minute for a lull.
-              const due =
-                (yield* Clock.currentTimeMillis) + defaultScheduleWorkerOptions.pollMilliseconds;
+              const now = yield* Clock.currentTimeMillis;
+              const due = now + defaultScheduleWorkerOptions.pollMilliseconds;
               const pending = yield* state.storage.getAlarm();
               if (pending === null || pending > due) yield* state.storage.setAlarm(due);
+              else if (alarmEvents === 0 && pending < now - heldAlarmMilliseconds)
+                yield* rearm(now, pending);
             }),
           );
         }),
       alarm: () =>
         Effect.gen(function* () {
           if (yield* lifetime.isBackgroundStopped) return yield* stop;
+          // Released when the event's scope closes, after its background dispatch.
+          yield* Effect.acquireRelease(
+            Effect.sync(() => {
+              alarmEvents += 1;
+            }),
+            () =>
+              Effect.sync(() => {
+                alarmEvents -= 1;
+              }),
+          );
           // A durable recovery wake remains if storage is temporarily unavailable or this event crashes.
           yield* alarms.withPermits(1)(
             Effect.gen(function* () {
@@ -315,12 +355,18 @@ const makeRetiredScheduleCoordinator = Effect.gen(function* () {
     });
     // Keeps the next alarm at most a minute away. It never moves an earlier one later, so frequent
     // wakes cannot postpone it, and brings a later one in, such as old code's alarm for an hourly
-    // schedule, so a revert never waits for it.
+    // schedule, so a revert never waits for it. One well past its time is held by the runtime
+    // (cloudflare/workerd#7330); writing it again for now schedules it.
     const keep = Effect.gen(function* () {
       const now = yield* Clock.currentTimeMillis;
       const due = now + scheduleRecoveryMilliseconds;
       const pending = yield* state.storage.getAlarm();
-      const armed = pending === null || pending > due ? due : pending;
+      const armed =
+        pending === null || pending > due
+          ? due
+          : pending < now - heldAlarmMilliseconds
+            ? now
+            : pending;
       if (armed !== pending) yield* state.storage.setAlarm(armed);
       yield* Effect.annotateCurrentSpan({
         "executor.schedule.heartbeat.at": now,
diff --git a/apps/hosted/cloud/src/infrastructure/secrets.ts b/apps/hosted/cloud/src/infrastructure/secrets.ts
index ff0281478e..3f5aa848c9 100644
--- a/apps/hosted/cloud/src/infrastructure/secrets.ts
+++ b/apps/hosted/cloud/src/infrastructure/secrets.ts
@@ -2,7 +2,7 @@
 import { Random } from "alchemy";
 import { Config, Effect, Option, Redacted, Schema } from "effect";
 import { testStage } from "./stage.ts";
-import { v1McpForwardSecretName } from "./v1-import-settings.ts";
+import { v1McpForwardSecretName, v1SessionHandoffSecretName } from "./v1-import-settings.ts";
 
 const SigningSecret = Schema.Redacted(Schema.String.check(Schema.isMinLength(32)));
 /** AES-GCM credentials need exactly 32 raw bytes, hex encoded. */
@@ -52,19 +52,31 @@ export const cloudSecrets = Effect.gen(function* () {
   return { authSecret: yield* authSecret.text, encryptionKey } satisfies CloudSecrets;
 });
 
+/**
+ * A secret v1 shares with this deployment. GitHub Actions passes an unset secret as an empty
+ * string, so empty means unset; a deployment without it accepts nothing v1 signs with it.
+ */
+const v1SharedSecret = (name: string) =>
+  Effect.gen(function* () {
+    const secret = (yield* Config.Redacted(name).pipe(Config.option)).pipe(
+      Option.filter((value) => Redacted.value(value) !== ""),
+    );
+    if (
+      Option.isSome(secret) &&
+      Option.isNone(Schema.decodeUnknownOption(SigningSecret)(secret.value))
+    )
+      return yield* Effect.die(new Error(`${name} must be at least 32 characters`));
+    return secret;
+  });
+
 /**
  * The secret v1 signs the MCP requests it forwards with (`v1-mcp-forward.ts`), shared with v1's
- * `V2_MCP_FORWARD_SECRET`. A deployment without it accepts no forwarded request. GitHub Actions
- * passes an unset secret as an empty string, so empty means unset.
+ * `V2_MCP_FORWARD_SECRET`.
  */
-export const v1McpForwardSecret = Effect.gen(function* () {
-  const secret = (yield* Config.Redacted(v1McpForwardSecretName).pipe(Config.option)).pipe(
-    Option.filter((value) => Redacted.value(value) !== ""),
-  );
-  if (
-    Option.isSome(secret) &&
-    Option.isNone(Schema.decodeUnknownOption(SigningSecret)(secret.value))
-  )
-    return yield* Effect.die(new Error(`${v1McpForwardSecretName} must be at least 32 characters`));
-  return secret;
-});
+export const v1McpForwardSecret = v1SharedSecret(v1McpForwardSecretName);
+
+/**
+ * The secret v1 signs session handoffs with (`v1-session-handoff.ts`), shared with v1's
+ * `V2_SESSION_HANDOFF_SECRET`. Without it every handoff opens the sign-in page.
+ */
+export const v1SessionHandoffSecret = v1SharedSecret(v1SessionHandoffSecretName);
diff --git a/apps/hosted/cloud/src/infrastructure/telemetry.ts b/apps/hosted/cloud/src/infrastructure/telemetry.ts
index abbee99790..eaa3091410 100644
--- a/apps/hosted/cloud/src/infrastructure/telemetry.ts
+++ b/apps/hosted/cloud/src/infrastructure/telemetry.ts
@@ -35,6 +35,20 @@ export const telemetryDatasets = Effect.gen(function* () {
   };
 });
 
+/**
+ * Whether this stage exports telemetry to Axiom. Production and every other configured stage
+ * always do. A test stage exports only when its deploy asks for it
+ * (`test-stage deploy --telemetry export`), as deployed E2E runs do to read their traces back.
+ * Other previews keep Cloudflare's own logs and traces, which cost no Axiom ingest.
+ */
+export const telemetryExport = Effect.gen(function* () {
+  if (Option.isNone(yield* testStage)) return true;
+  const telemetry = yield* Config.Literals(["export", "off"], "TEST_STAGE_TELEMETRY").pipe(
+    Config.withDefault("off"),
+  );
+  return telemetry === "export";
+}).pipe(Effect.orDie);
+
 export const telemetryResources = Effect.gen(function* () {
   const stage = yield* Stage;
   const { shared, names } = yield* telemetryDatasets;
@@ -109,6 +123,22 @@ export const telemetryResources = Effect.gen(function* () {
   return { names, traces, logs, metrics, ingest };
 });
 
+/**
+ * Native invocation logs with query strings removed: request URLs can carry unsubscribe links,
+ * sign-in codes and the searches apps send through their outbound Worker.
+ */
+const platformLogs = {
+  enabled: true,
+  redactQueryString: true,
+  logs: { enabled: true, invocationLogs: true, persist: true },
+};
+
+/** Props for a Worker that keeps only its native logs, with no tail consumer or trace export. */
+export const platformObservability = Effect.gen(function* () {
+  if ((yield* AlchemyContext).dev) return {};
+  return { observability: platformLogs };
+});
+
 /**
  * Export invocation summaries and supplementary platform spans, joined by Ray ID.
  * Tail delivery supplies timings independently of native trace sampling.
@@ -116,6 +146,11 @@ export const telemetryResources = Effect.gen(function* () {
  */
 export const cloudObservability = Effect.gen(function* () {
   if ((yield* AlchemyContext).dev) return {};
+  const native = {
+    ...platformLogs,
+    traces: { enabled: true, headSamplingRate: 1, persist: true },
+  };
+  if (!(yield* telemetryExport)) return { observability: native };
   const stage = yield* Stage;
   const { names, traces, ingest } = yield* telemetryResources;
   const destination = yield* Cloudflare.Workers.ObservabilityDestination("PlatformTraces", {
@@ -130,15 +165,8 @@ export const cloudObservability = Effect.gen(function* () {
   return {
     tailConsumers: [yield* InvocationTelemetry],
     observability: {
-      enabled: true,
-      redactQueryString: true,
-      logs: { enabled: true, invocationLogs: true, persist: true },
-      traces: {
-        enabled: true,
-        headSamplingRate: 1,
-        persist: true,
-        destinations: [destination.slug],
-      },
+      ...native,
+      traces: { ...native.traces, destinations: [destination.slug] },
     },
   };
 }).pipe(Effect.orDie);
@@ -150,9 +178,20 @@ export const telemetryBindings = Effect.gen(function* () {
     const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(TelemetryConfig))(config);
     return { [binding]: Output.asOutput(Redacted.make(encoded)) };
   }
-  const { names, traces, logs, metrics, ingest } = yield* telemetryResources;
   const version = yield* Config.NonEmptyString("EXECUTOR_BUILD_VERSION");
   const environment = yield* Stage;
+  if (!(yield* telemetryExport)) {
+    // The isolate still runs its tracer and meters; with no targets nothing leaves it.
+    const config = {
+      service: "executor-cloud",
+      clock: "cloudflare-io" as const,
+      version,
+      environment,
+    };
+    const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(TelemetryConfig))(config);
+    return { [binding]: Output.asOutput(Redacted.make(encoded)) };
+  }
+  const { names, traces, logs, metrics, ingest } = yield* telemetryResources;
   return {
     [binding]: Output.all(
       traces.otelTracesEndpoint,
diff --git a/apps/hosted/cloud/src/infrastructure/v1-import-settings.ts b/apps/hosted/cloud/src/infrastructure/v1-import-settings.ts
index f0e6596014..bc1cd4e12f 100644
--- a/apps/hosted/cloud/src/infrastructure/v1-import-settings.ts
+++ b/apps/hosted/cloud/src/infrastructure/v1-import-settings.ts
@@ -8,16 +8,15 @@
  *   binds none of it and answers every operator request 404.
  * - `CLOUD_V1_IMPORT_WRITES`: `on` also lets the operator start imports that write v2. `off`, the
  *   default, refuses them, and requires `CLOUD_V1_IMPORT=on` to mean anything.
- * - `CLOUD_V1_IMPORT_ALLOWED_ORGS`: the v1 organizations production may import, comma separated.
- *   With writes on, an import must name its organizations and each must be listed here. Empty, the
- *   default, imports none.
+ * - Which v1 organizations may be imported is no setting: with writes on, an import names its
+ *   organizations and each needs a row in the database table `private_v1_import_allowed`, which
+ *   only direct SQL writes (`writes.ts`). With no rows, none is imported.
  * - `CLOUD_V1_IMPORT_SOURCE`: `live` points local Cloud dev at v1's production data, read-only,
  *   for an operator's dry run from their own machine. It runs only dry runs; `emulated`, the
  *   default, keeps the emulated v1.
  */
 import { isLoopbackHostname } from "@executor-js/utils/url-policy";
 import { Config, Effect, Option, Schema } from "effect";
-import { V1OrganizationId } from "../contracts/v1-import.ts";
 import { cloudOrigin, productionStage, stageName, testStage } from "./stage.ts";
 
 export const V1ImportSwitch = Schema.Literals(["off", "on"]);
@@ -34,37 +33,6 @@ export const v1ImportWritesSetting = Config.Literals(
   "CLOUD_V1_IMPORT_WRITES",
 ).pipe(Config.withDefault<V1ImportSwitch>("off"));
 
-export const v1ImportAllowedOrgsName = "CLOUD_V1_IMPORT_ALLOWED_ORGS";
-/** What to fix when the allow-list holds something other than v1 organization ids. */
-export const invalidV1ImportAllowedOrgs = `${v1ImportAllowedOrgsName} must be v1 organization ids (org_…), comma separated`;
-
-/**
- * Parse the allow-list: v1 organization ids separated by commas, with optional spaces. Empty is
- * none. Undefined when any entry is not a v1 organization id.
- */
-export const parseV1ImportAllowedOrgs = (
-  value: string,
-): ReadonlySet<V1OrganizationId> | undefined => {
-  const entries = value
-    .split(",")
-    .map((entry) => entry.trim())
-    .filter((entry) => entry !== "");
-  const parsed = entries.map((entry) => Schema.decodeUnknownOption(V1OrganizationId)(entry));
-  if (parsed.some(Option.isNone)) return undefined;
-  return new Set(parsed.flatMap((entry) => (Option.isSome(entry) ? [entry.value] : [])));
-};
-
-/** The allow-list this deployment imports from; unset is empty. Dies on an entry that is no id. */
-export const v1ImportAllowedOrgsSetting = Config.String(v1ImportAllowedOrgsName).pipe(
-  Config.withDefault(""),
-  Effect.flatMap((value) => {
-    const parsed = parseV1ImportAllowedOrgs(value);
-    return parsed === undefined
-      ? Effect.die(new Error(invalidV1ImportAllowedOrgs))
-      : Effect.succeed(parsed);
-  }),
-);
-
 /**
  * The secret holding the URL of v1's `v1_import_writer` role, which may only insert and update
  * `org_moved_to_v2` (and read the columns its upsert compares). Imports that write need it: they
@@ -77,6 +45,13 @@ export const missingV1ImportWriter = `v1 imports that write need ${v1ImportWrite
 export const v1McpForwardSecretName = "V1_MCP_FORWARD_SECRET";
 export const missingV1McpForwardSecret = `v1 imports that write need ${v1McpForwardSecretName}, the secret v1 signs forwarded MCP requests with (v1's V2_MCP_FORWARD_SECRET): without it a moved workspace's MCP URLs stop working`;
 
+/**
+ * The secret v1 signs session handoffs with, shared with v1's `V2_SESSION_HANDOFF_SECRET`: v1's
+ * dashboard sends a signed-in member of a moved organization to `/api/v1-handoff` with a token
+ * signed with it, so they need not sign in again (`v1-session-handoff.ts`).
+ */
+export const v1SessionHandoffSecretName = "V1_SESSION_HANDOFF_SECRET";
+
 /**
  * Where a non-production Cloud reads v1. `live` is v1's production WorkOS, database, blob bucket
  * and Autumn account, read-only, from local Cloud dev on a loopback origin only. It never writes:
@@ -168,7 +143,7 @@ export const missingV1FirstPartyClient = (client: string) =>
  * - `none`: no importer.
  *
  * `realV1` is true for both real sources. The live source never writes; production writes only
- * for the organizations on `CLOUD_V1_IMPORT_ALLOWED_ORGS`, each named by the operator.
+ * for the organizations with a row in `private_v1_import_allowed`, each named by the operator.
  * `scripts/check-v1-import-access.ts` checks these rules over every combination.
  */
 export const v1ImportAccess = (emulated: boolean) =>
diff --git a/apps/hosted/cloud/src/infrastructure/v1-import-workflow.ts b/apps/hosted/cloud/src/infrastructure/v1-import-workflow.ts
index 4f042960ab..c02b754af4 100644
--- a/apps/hosted/cloud/src/infrastructure/v1-import-workflow.ts
+++ b/apps/hosted/cloud/src/infrastructure/v1-import-workflow.ts
@@ -8,10 +8,10 @@
  * answers 404, as for any unknown path. No user session reaches these routes.
  */
 import { randomUUID, timingSafeEqual } from "node:crypto";
-import { HostedExecutor, McpAuthentication } from "@executor-js/hosted-server";
+import { HostedExecutor, McpAuthentication, OrganizationId } from "@executor-js/hosted-server";
 import { RuntimeContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
-import { Cause, Clock, Context, Effect, Option, Predicate, Redacted, Schema } from "effect";
+import { Cause, Clock, Context, Effect, Layer, Option, Predicate, Redacted, Schema } from "effect";
 import { FetchHttpClient, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { V1ImportDatabase, V1ImportUnavailable, V1OrganizationId } from "../contracts/v1-import.ts";
 import {
@@ -40,11 +40,23 @@ import {
   type V1ImportReports,
   type V1ImportStep,
 } from "../implementation/v1-import/run.ts";
+import { repairCopiedAccounts } from "../implementation/v1-import/copied-accounts.ts";
+import { AppRestore, repairOrganization, restoreApp } from "../implementation/v1-import/repair.ts";
 import { makeV1Source } from "../implementation/v1-import/source.ts";
 import { V1MovedState } from "../implementation/v1-import/moved-flag.ts";
+import { existingOrganization } from "../implementation/v1-import/identity.ts";
+import { removeImported } from "../implementation/v1-import/rollback.ts";
 import { makeImportStore } from "../implementation/v1-import/store.ts";
-import { importRefusal, movedFlag } from "../implementation/v1-import/writes.ts";
+import { importRefusal, movedFlag, writesRefused } from "../implementation/v1-import/writes.ts";
 import { AppBuilds } from "./blobs.ts";
+import { AutumnClient } from "../contracts/autumn.ts";
+import { BillingMeter } from "../contracts/billing-meter.ts";
+import { autumnLive, autumnReads } from "../implementation/autumn-client.ts";
+import {
+  returnBilling,
+  v1TeamPlan,
+  type V1ImportBilling,
+} from "../implementation/v1-import/billing.ts";
 import type { V1ImportSettings } from "./onboarding.ts";
 
 /** The importer this deployment runs, with where it keeps reports; none where v1 is unreachable. */
@@ -53,6 +65,10 @@ export class V1ImportConfiguration extends Context.Service<
   Option.Option<{ readonly settings: V1ImportSettings; readonly reports: V1ImportReports }>
 >()("cloud/V1ImportConfiguration") {}
 
+const HoldStates = Schema.Array(
+  Schema.Struct({ state: Schema.Literals(["held", "carried", "returned"]) }),
+);
+
 /** Reports in the private `AppBuilds` bucket. Bind during Worker initialization. */
 export const cloudV1ImportReports = Effect.gen(function* () {
   const bucket = yield* Cloudflare.R2.ReadWriteBucket(AppBuilds);
@@ -162,6 +178,50 @@ const runner =
       ),
     );
 
+/**
+ * v2's billing for a carry-over: its Autumn, with the v1 import's patient reads, its catalog, and
+ * its seat sync. None where the settings have none.
+ */
+const importBilling = (settings: V1ImportSettings, meter: BillingMeter["Service"]) =>
+  Option.map(settings.billing, (billing) =>
+    Effect.gen(function* () {
+      const { options, catalog } = yield* billing;
+      const autumn = yield* AutumnClient.pipe(
+        Effect.provide(
+          autumnLive(options, autumnReads.patient).pipe(Layer.provide(FetchHttpClient.layer)),
+        ),
+      );
+      return {
+        autumn,
+        catalog,
+        v1TeamPlan,
+        syncSeats: meter.syncSeats,
+      } satisfies V1ImportBilling;
+    }),
+  );
+
+/** The importer's environment for a run or a repair, from the deployment's settings. */
+const importEnvironment = (
+  settings: V1ImportSettings,
+  reports: V1ImportReports,
+  connections: McpAuthentication["Service"]["connections"],
+  meter: BillingMeter["Service"],
+) =>
+  V1ImportEnvironment.of({
+    source: settings.source.pipe(
+      Effect.flatMap(makeV1Source),
+      Effect.provide(FetchHttpClient.layer),
+      Effect.mapError(() => new V1ImportUnavailable()),
+    ),
+    connections,
+    reports,
+    writes: settings.writes,
+    freezeSettleSeconds: settings.freezeSettleSeconds,
+    v1FirstPartyClients: settings.v1FirstPartyClients,
+    slugKey: settings.slugKey,
+    billing: importBilling(settings, meter),
+  });
+
 export class V1ImportWorkflow extends Cloudflare.Workflow<V1ImportWorkflow>()(
   "V1Import",
   // An organization's integrations, toolkits and artifacts each take a step.
@@ -170,33 +230,28 @@ export class V1ImportWorkflow extends Cloudflare.Workflow<V1ImportWorkflow>()(
     const reportErrors = yield* cloudSentry;
     // Only these services: the Worker's context also holds its own scope, which a run must not take.
     const services = yield* Effect.context<
-      HostedExecutor | V1ImportDatabase | McpAuthentication | V1ImportConfiguration
+      HostedExecutor | V1ImportDatabase | McpAuthentication | V1ImportConfiguration | BillingMeter
     >().pipe(
       Effect.map(
-        Context.pick(HostedExecutor, V1ImportDatabase, McpAuthentication, V1ImportConfiguration),
+        Context.pick(
+          HostedExecutor,
+          V1ImportDatabase,
+          McpAuthentication,
+          V1ImportConfiguration,
+          BillingMeter,
+        ),
       ),
     );
     const configuration = Context.get(services, V1ImportConfiguration);
     const connections = Context.get(services, McpAuthentication).connections;
+    const meter = Context.get(services, BillingMeter);
     return (input: unknown) =>
       Effect.gen(function* () {
         const params = yield* Schema.decodeUnknownEffect(V1ImportParams)(input);
         if (Option.isNone(configuration))
           return yield* Effect.die(new Error("This deployment has no v1 importer."));
         const { settings, reports } = configuration.value;
-        const environment = V1ImportEnvironment.of({
-          source: settings.source.pipe(
-            Effect.flatMap(makeV1Source),
-            Effect.provide(FetchHttpClient.layer),
-            Effect.mapError(() => new V1ImportUnavailable()),
-          ),
-          connections,
-          reports,
-          writes: settings.writes,
-          freezeSettleSeconds: settings.freezeSettleSeconds,
-          v1FirstPartyClients: settings.v1FirstPartyClients,
-          slugKey: settings.slugKey,
-        });
+        const environment = importEnvironment(settings, reports, connections, meter);
         return yield* runV1Import(params, runner(params, settings.stepRetries), (name, seconds) =>
           Cloudflare.Workflows.sleep(name, seconds * 1000),
         ).pipe(
@@ -216,6 +271,9 @@ export class V1ImportWorkflow extends Cloudflare.Workflow<V1ImportWorkflow>()(
 
 type Workflow = Effect.Success<typeof V1ImportWorkflow>;
 
+/** A repair request: whether to apply it, or only plan it (the default). */
+const RepairRequest = Schema.Struct({ apply: Schema.optional(Schema.Boolean) });
+
 /** How long one Workflows call may take before it counts as refused (see organization removal). */
 const callDeadline = "3 seconds";
 
@@ -254,12 +312,22 @@ const aggregationId = /^[0-9a-f]{32}$/u;
  *   reads of v1's database and WorkOS and the builds: a start takes only as many as there is room
  *   for, defers the rest, and reports how many are running and which of the run's stopped without
  *   a report. An id that is not a v1 organization id, or one the run already has running, is
- *   skipped. An import needs the deployment's write switch; over v1's real data it must list its
- *   organizations, and only those on `CLOUD_V1_IMPORT_ALLOWED_ORGS` (`writes.ts`).
+ *   skipped. An import needs the deployment's write switch, must list its organizations, and
+ *   each needs a row in `private_v1_import_allowed`, which only direct SQL writes (`writes.ts`).
+ *   The token alone allows no organization.
  * - `GET /api/internal/v1-import/runs/:run/orgs/:organization` returns one organization's report
  *   and its instance's status.
+ * - `POST /api/internal/v1-import/orgs/:organization/return-billing` gives a paid organization's
+ *   subscription back to v1 before its v2 organization is deleted (see `giveBillingBack`).
  * - `POST /api/internal/v1-import/orgs/:organization/rollback` gives an organization back to v1
  *   after its v2 organization was deleted (see `rollback`).
+ * - `POST /api/internal/v1-import/orgs/:organization/repair` deploys a moved organization's MCP
+ *   apps with v1's approval stamps as rules, or with `{"apply": false}` plans it (see `repair`).
+ * - `POST /api/internal/v1-import/orgs/:organization/restore` runs an earlier version of one of its
+ *   imported apps again, while the app still runs the version named (see `restore`).
+ * - `POST /api/internal/v1-import/orgs/:organization/accounts` brings the accounts of an
+ *   organization the opt-in import copied before it moved up to date with v1's final tokens and
+ *   their apps' providers (see `accounts`).
  * - `POST /api/internal/v1-import/runs/:run/aggregate[?cursor=…][&limit=…]` combines a page of a
  *   run's reports (at most 200, or `limit`) into the aggregate so far and returns the cursor of the next page; the last page
  *   writes `v1-import/runs/<run>/aggregate.json` and returns it. `complete` is false while any
@@ -383,10 +451,10 @@ export const v1ImportRoutes = (workflow: Workflow) =>
       );
       if (Option.isNone(body)) return yield* json(400, { error: "invalid request" });
       const input = body.value;
-      // A start that pages through v1 names no organizations, which only emulated v1 may import.
+      // A start that pages through v1 names no organizations, which no import may do.
       const refusal =
         input.mode === "import"
-          ? importRefusal(
+          ? yield* importRefusal(
               settings.writes,
               input.after === undefined && input.limit === undefined
                 ? input.organizations
@@ -588,16 +656,33 @@ export const v1ImportRoutes = (workflow: Workflow) =>
      * Give a frozen or moved organization back to v1: its moved flag becomes `rolled_back`, so v1
      * serves it as before, its state row `rolled_back`, and its import map rows go, except users,
      * which stay mapped for their other organizations. Refused while its import instance runs, and
-     * while its v2 organization still exists: its imported grants would renew beside v1's, and a
-     * refresh token must be used by only one of them. Delete the v2 organization first.
+     * while a v2 organization the import created still exists: its imported grants would renew
+     * beside v1's, and a refresh token must be used by only one of them. Delete the v2 organization
+     * first. One moved into an existing v2 organization (decision 32) keeps it: the rollback removes
+     * only what the import added to it (`removeImported`), once a carried-over subscription went
+     * back to v1 (`return-billing`).
      */
+    /** The state of the billing hold a v1 organization's import put on a v2 organization, if any. */
+    const billingHoldOf = (target: string, organization: string) =>
+      Effect.gen(function* () {
+        const sql = yield* Effect.flatten(V1ImportDatabase);
+        const rows = yield* sql`
+          select state from private_v1_import_billing
+          where organization_id = ${target} and v1_org_id = ${organization}
+        `.pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(HoldStates)),
+          Effect.mapError(() => new V1ImportUnavailable()),
+        );
+        return rows[0]?.state;
+      });
+
     const rollback = Effect.gen(function* () {
       const found = yield* authorized;
       if (Option.isNone(found)) return yield* notFound;
       const flag = movedFlag(found.value.settings.writes);
       if (flag === undefined)
         return yield* json(409, {
-          error: importRefusal(found.value.settings.writes, undefined) ?? "unavailable",
+          error: writesRefused(found.value.settings.writes) ?? "unavailable",
         });
       const decoded = Schema.decodeUnknownOption(V1OrganizationId)(
         (yield* HttpRouter.params).organization,
@@ -612,11 +697,31 @@ export const v1ImportRoutes = (workflow: Workflow) =>
       const sql = yield* Effect.flatten(V1ImportDatabase);
       const store = makeImportStore(sql);
       const recorded = yield* store.find("organization", organization);
-      if (recorded?.status === "imported" && recorded.v2_id !== null) {
+      let into: { readonly organization: string; readonly removed: unknown } | undefined;
+      if (recorded?.v2_kind === existingOrganization && recorded.v2_id !== null) {
+        const hold = yield* billingHoldOf(recorded.v2_id, organization);
+        if (hold === "carried")
+          return yield* json(409, {
+            error:
+              "Its v1 subscription carried over to its v2 organization. Give it back first (return-billing).",
+          });
+        if (hold === "held")
+          return yield* json(409, {
+            error:
+              "Its v2 organization's billing is held for a carry-over that did not finish. Give it back first (return-billing), or delete its private_v1_import_billing row once Autumn shows nothing carried over.",
+          });
+        const removal = yield* removeImported(
+          organization,
+          OrganizationId.make(recorded.v2_id),
+          (yield* McpAuthentication).connections,
+        );
+        if ("refused" in removal) return yield* json(409, { error: removal.refused });
+        into = { organization: recorded.v2_id, removed: removal.removed };
+      } else if (recorded?.status === "imported" && recorded.v2_id !== null) {
         const target = yield* store.target(recorded.v2_id);
         if (target !== undefined)
           return yield* json(409, {
-            error: `Its v2 organization ${target.slug} still exists. Delete it in v2 first, so its imported grants never renew beside v1's.`,
+            error: `Its v2 organization ${target.slug} still exists. Delete it in v2 first, so its imported grants never renew beside v1's. A paid organization's billing goes back first (return-billing), or deleting it cancels the subscription.`,
           });
       }
       yield* flag.set(organization, V1MovedState.RolledBack());
@@ -631,10 +736,21 @@ export const v1ImportRoutes = (workflow: Workflow) =>
               update private_v1_import_org set state = 'rolled_back', updated_at = now()
               where v1_org_id = ${organization}
             `;
+            // A subscription given back is v1's again; the existing organization bills as before.
+            if (into !== undefined)
+              yield* sql`
+                delete from private_v1_import_billing
+                where organization_id = ${into.organization} and v1_org_id = ${organization}
+                  and state = 'returned'
+              `;
           }),
         )
         .pipe(Effect.mapError(() => new V1ImportUnavailable()));
-      return yield* json(200, { organization, state: "rolled_back" });
+      return yield* json(200, {
+        organization,
+        state: "rolled_back",
+        ...(into === undefined ? {} : { removed: into.removed }),
+      });
     }).pipe(
       Effect.catchCause((cause) =>
         Cause.hasInterrupts(cause)
@@ -645,5 +761,190 @@ export const v1ImportRoutes = (workflow: Workflow) =>
       ),
     );
 
-    return { start, report, aggregate, rollback };
+    /**
+     * Give a paid organization's subscription back to v1 (`returnBilling`): v1's Team plan in
+     * place of v2's on the same Stripe subscription, and v1's customer id again. Run it before
+     * the v2 organization is deleted: deleting an organization whose billing carried over cancels
+     * its subscription, while one whose billing was returned cancels nothing. Needs the write
+     * switch, and is refused while the organization's import instance runs. Running it again
+     * after it finished changes nothing.
+     */
+    const giveBillingBack = Effect.gen(function* () {
+      const found = yield* authorized;
+      if (Option.isNone(found)) return yield* notFound;
+      const { settings } = found.value;
+      const refused = writesRefused(settings.writes);
+      if (refused !== undefined) return yield* json(409, { error: refused });
+      if (Option.isNone(settings.billing))
+        return yield* json(409, { error: "This deployment cannot change v1's billing." });
+      const decoded = Schema.decodeUnknownOption(V1OrganizationId)(
+        (yield* HttpRouter.params).organization,
+      );
+      if (Option.isNone(decoded)) return yield* json(400, { error: "invalid organization" });
+      const organization = decoded.value;
+      const state = yield* status(organization);
+      if (state === "unknown" || !(stopped.has(state) || state === "complete"))
+        return yield* json(409, {
+          error: `Its import instance is ${state}; return its billing once it has stopped.`,
+        });
+      const sql = yield* Effect.flatten(V1ImportDatabase);
+      const recorded = yield* makeImportStore(sql).find("organization", organization);
+      if (recorded?.status !== "imported" || recorded.v2_id === null)
+        return yield* json(409, { error: "The import recorded no v2 organization for it." });
+      // An existing organization's billing carried over only from a copy of this organization.
+      if (
+        recorded.v2_kind === existingOrganization &&
+        (yield* billingHoldOf(recorded.v2_id, organization)) === undefined
+      )
+        return yield* json(409, {
+          error: "It moved into an existing v2 organization, and no billing carried over.",
+        });
+      const billing = importBilling(settings, yield* BillingMeter);
+      if (Option.isNone(billing))
+        return yield* json(409, { error: "This deployment cannot change v1's billing." });
+      const outcome = yield* returnBilling({
+        billing: yield* billing.value,
+        sql,
+        organization: OrganizationId.make(recorded.v2_id),
+      }).pipe(
+        Effect.as({ returned: true as const }),
+        Effect.catchTag("CarryOverRefused", (error) =>
+          Effect.succeed({ returned: false as const, reason: error.reason }),
+        ),
+      );
+      return yield* outcome.returned
+        ? json(200, { organization, billing: "returned" })
+        : json(409, { error: outcome.reason });
+    }).pipe(
+      Effect.catchCause((cause) =>
+        Cause.hasInterrupts(cause)
+          ? Effect.interrupt
+          : Effect.logError("v1 import billing return failed", cause).pipe(
+              Effect.andThen(json(503, { error: "unavailable" })),
+            ),
+      ),
+    );
+
+    /**
+     * Repair one moved organization as `repairOrganization` says: deploy its MCP apps with v1's
+     * approval stamps as their own rules.
+     * The body's `apply` defaults to false, which plans the repair and writes nothing. Applying
+     * needs the deployment's write switch, and is refused while the organization's import
+     * instance runs. The answer lists every change, made or planned, and what it left alone.
+     */
+    const repair = Effect.gen(function* () {
+      const found = yield* authorized;
+      if (Option.isNone(found)) return yield* notFound;
+      const { settings, reports } = found.value;
+      const decoded = Schema.decodeUnknownOption(V1OrganizationId)(
+        (yield* HttpRouter.params).organization,
+      );
+      if (Option.isNone(decoded)) return yield* json(400, { error: "invalid organization" });
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const body = yield* request.json.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(RepairRequest)),
+        Effect.option,
+      );
+      if (Option.isNone(body)) return yield* json(400, { error: "invalid body" });
+      const apply = body.value.apply === true;
+      if (apply) {
+        const refused = writesRefused(settings.writes);
+        if (refused !== undefined) return yield* json(409, { error: refused });
+        const state = yield* status(decoded.value);
+        if (state === "unknown" || !(stopped.has(state) || state === "complete"))
+          return yield* json(409, {
+            error: `Its import instance is ${state}; repair it once it has stopped.`,
+          });
+      }
+      const connections = (yield* McpAuthentication).connections;
+      const result = yield* repairOrganization(decoded.value, apply).pipe(
+        Effect.scoped,
+        Effect.provideService(
+          V1ImportEnvironment,
+          importEnvironment(settings, reports, connections, yield* BillingMeter),
+        ),
+      );
+      return yield* json(200, result);
+    }).pipe(
+      Effect.catchCause((cause) =>
+        Cause.hasInterrupts(cause)
+          ? Effect.interrupt
+          : Effect.logError("v1 import repair failed", cause).pipe(
+              Effect.andThen(json(503, { error: "unavailable" })),
+            ),
+      ),
+    );
+
+    /**
+     * Run an earlier version of one of the organization's imported apps again as `restoreApp`
+     * says, while the app still runs `expected`. It needs the deployment's write switch. The answer
+     * says whether it did, or why not.
+     */
+    const restore = Effect.gen(function* () {
+      const found = yield* authorized;
+      if (Option.isNone(found)) return yield* notFound;
+      const decoded = Schema.decodeUnknownOption(V1OrganizationId)(
+        (yield* HttpRouter.params).organization,
+      );
+      if (Option.isNone(decoded)) return yield* json(400, { error: "invalid organization" });
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const body = yield* request.json.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(AppRestore)),
+        Effect.option,
+      );
+      if (Option.isNone(body)) return yield* json(400, { error: "invalid body" });
+      const refused = writesRefused(found.value.settings.writes);
+      if (refused !== undefined) return yield* json(409, { error: refused });
+      const result = yield* restoreApp(decoded.value, body.value);
+      return yield* json(result.status === "restored" ? 200 : 409, result);
+    }).pipe(
+      Effect.catchCause((cause) =>
+        Cause.hasInterrupts(cause)
+          ? Effect.interrupt
+          : Effect.logError("v1 import restore failed", cause).pipe(
+              Effect.andThen(json(503, { error: "unavailable" })),
+            ),
+      ),
+    );
+
+    /**
+     * Repair the copied accounts of one organization that cut over as `repairCopiedAccounts` says.
+     * It needs the deployment's write switch, and is refused while the organization's import
+     * instance runs. The answer lists each copied account and what changed.
+     */
+    const accounts = Effect.gen(function* () {
+      const found = yield* authorized;
+      if (Option.isNone(found)) return yield* notFound;
+      const { settings, reports } = found.value;
+      const decoded = Schema.decodeUnknownOption(V1OrganizationId)(
+        (yield* HttpRouter.params).organization,
+      );
+      if (Option.isNone(decoded)) return yield* json(400, { error: "invalid organization" });
+      const refused = writesRefused(settings.writes);
+      if (refused !== undefined) return yield* json(409, { error: refused });
+      const state = yield* status(decoded.value);
+      if (state === "unknown" || !(stopped.has(state) || state === "complete"))
+        return yield* json(409, {
+          error: `Its import instance is ${state}; repair it once it has stopped.`,
+        });
+      const connections = (yield* McpAuthentication).connections;
+      const result = yield* repairCopiedAccounts(decoded.value).pipe(
+        Effect.scoped,
+        Effect.provideService(
+          V1ImportEnvironment,
+          importEnvironment(settings, reports, connections, yield* BillingMeter),
+        ),
+      );
+      return yield* json(200, result);
+    }).pipe(
+      Effect.catchCause((cause) =>
+        Cause.hasInterrupts(cause)
+          ? Effect.interrupt
+          : Effect.logError("v1 import account repair failed", cause).pipe(
+              Effect.andThen(json(503, { error: "unavailable" })),
+            ),
+      ),
+    );
+
+    return { start, report, aggregate, rollback, repair, restore, accounts, giveBillingBack };
   });
diff --git a/apps/hosted/cloud/src/infrastructure/welcome-email.ts b/apps/hosted/cloud/src/infrastructure/welcome-email.ts
index 6808b1a70c..37a2345415 100644
--- a/apps/hosted/cloud/src/infrastructure/welcome-email.ts
+++ b/apps/hosted/cloud/src/infrastructure/welcome-email.ts
@@ -6,6 +6,7 @@ import { deliverWelcomeEmails } from "../implementation/welcome-emails.ts";
 import type { SendWelcomeEmail } from "../contracts/email.ts";
 import { cloudHosts } from "./stage.ts";
 import { cloudSecrets } from "./secrets.ts";
+import { jobFailed } from "../contracts/job-outcome.ts";
 import { unsubscribeHandler, unsubscribeLinks } from "../implementation/email-preferences.ts";
 
 /** The cron invocation owns its database connection and closes it after the batch. */
@@ -36,7 +37,11 @@ export const cloudWelcomeEmails = (send: SendWelcomeEmail) =>
       );
     return {
       deliver: deliverUser().pipe(
-        Effect.catch(() => Effect.logError("Welcome email queue processing failed")),
+        Effect.catch((error) =>
+          Effect.logError("Welcome email queue processing failed").pipe(
+            Effect.as(jobFailed(error)),
+          ),
+        ),
       ),
       deliverUser,
       unsubscribe: unsubscribeHandler(origin, secrets.authSecret).pipe(
diff --git a/apps/hosted/cloud/src/infrastructure/worker-build.ts b/apps/hosted/cloud/src/infrastructure/worker-build.ts
index 3dd7e90bba..334adf5d53 100644
--- a/apps/hosted/cloud/src/infrastructure/worker-build.ts
+++ b/apps/hosted/cloud/src/infrastructure/worker-build.ts
@@ -2,6 +2,7 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import type { WorkerProps } from "alchemy/Cloudflare";
 import { Effect, FileSystem, Path } from "effect";
+import { fileURLToPath } from "node:url";
 import {
   attributeChunk,
   packageBytes,
@@ -153,11 +154,43 @@ const sentryArtifacts = (worker: WorkerName) => ({
     ),
 });
 
-/** Build options for one Worker. The compiler keeps Alchemy's default output. */
-export const workerBuild = (worker: WorkerName): NonNullable<WorkerProps["build"]> =>
+/**
+ * Modules an `alchemy dev` build replaces with a local test hook, by file name in this directory.
+ * Deployed builds bundle each pass-through as written, so their uploads contain no hook for a
+ * binding or a request to turn on. `scripts/worker-sizes.ts` fails if a deployed build uploads one.
+ */
+export const localTestModules: ReadonlyArray<readonly [passThrough: string, hook: string]> = [
+  ["mcp-interaction-faults.ts", "mcp-interaction-faults-local.ts"],
+];
+
+/**
+ * Resolve each pass-through in `localTestModules` to its hook instead. This is an alias, not a
+ * plugin: `alchemy dev` sends Worker props to its local provider over RPC, which drops functions.
+ */
+const localTestHooks = () => {
+  const directory = new URL(".", import.meta.url);
+  return Object.fromEntries(
+    localTestModules.map(([passThrough, hook]) => [
+      fileURLToPath(new URL(passThrough, directory)),
+      fileURLToPath(new URL(hook, directory)),
+    ]),
+  );
+};
+
+/**
+ * Build options for one Worker. The compiler keeps Alchemy's default output. `localTestHooks`
+ * is for `alchemy dev` only.
+ */
+export const workerBuild = (
+  worker: WorkerName,
+  options: { readonly localTestHooks?: boolean } = {},
+): NonNullable<WorkerProps["build"]> =>
   worker === "compiler"
     ? { output: { plugins: [uploadedModules(worker)] } }
     : {
+        ...(options.localTestHooks === true
+          ? { input: { resolve: { alias: localTestHooks() } } }
+          : {}),
         output: {
           entryFileNames: `${worker}-[name].js`,
           chunkFileNames: `${worker}-[name]-[hash].js`,
diff --git a/apps/hosted/cloud/src/invocation-telemetry.ts b/apps/hosted/cloud/src/invocation-telemetry.ts
index 112e2cec0d..1e5808dd34 100644
--- a/apps/hosted/cloud/src/invocation-telemetry.ts
+++ b/apps/hosted/cloud/src/invocation-telemetry.ts
@@ -1,8 +1,13 @@
 /** Native Tail delivery records invocation totals independently of trace sampling. */
 import * as Cloudflare from "alchemy/Cloudflare";
-import { Effect } from "effect";
+import { Effect, Option } from "effect";
 import { InvocationTelemetry } from "./infrastructure/invocation-telemetry.ts";
-import { cloudTelemetry, telemetryBindings } from "./infrastructure/telemetry.ts";
+import {
+  cloudTelemetry,
+  platformObservability,
+  telemetryBindings,
+} from "./infrastructure/telemetry.ts";
+import { cloudHosts } from "./infrastructure/stage.ts";
 import { recordInvocations } from "./implementation/invocation-summary.ts";
 
 export default InvocationTelemetry.make(
@@ -11,16 +16,29 @@ export default InvocationTelemetry.make(
     return {
       main: import.meta.url,
       workersDev: false,
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       env: yield* telemetryBindings,
       // No tail consumer or native trace export here: the receiver must not observe itself.
+      ...(yield* platformObservability),
     };
   }),
   Effect.gen(function* () {
     const worker = yield* Cloudflare.Worker;
+    // Each request's host is named by the deployment's own host layout, as the API Worker reads it.
+    // Without the layout every host reads as `other`: the records themselves must not stop, so a
+    // missing setting and an invalid layout (which the API Worker dies on) are both caught here.
+    const hosts = yield* cloudHosts.pipe(
+      Effect.map(Option.some),
+      Effect.catchCause(() =>
+        Effect.as(
+          Effect.logWarning("Invocation records name no host role: the host layout did not load"),
+          Option.none(),
+        ),
+      ),
+    );
     yield* worker.listen((event: unknown) =>
       Cloudflare.Workers.isWorkerEvent(event) && event.type === "tail"
-        ? recordInvocations(event.input)
+        ? recordInvocations(hosts, event.input)
         : undefined,
     );
     return {};
diff --git a/apps/hosted/cloud/src/main.ts b/apps/hosted/cloud/src/main.ts
index 8bb6bfbd5b..fbbf23cf79 100644
--- a/apps/hosted/cloud/src/main.ts
+++ b/apps/hosted/cloud/src/main.ts
@@ -59,6 +59,7 @@ import { Config, Effect, Layer, Option, Path, Ref } from "effect";
 import { HttpRouter, HttpServer, HttpServerResponse } from "effect/http";
 import { cloudAuth } from "./infrastructure/auth.ts";
 import { cloudAccountCallback } from "./implementation/account-callback.ts";
+import { v1HandoffPath } from "./implementation/v1-session-handoff.ts";
 import { cloudOnboarding, cloudV1ImportSettings } from "./infrastructure/onboarding.ts";
 import {
   V1ImportConfiguration,
@@ -81,6 +82,7 @@ import {
   selfBinding,
   type BackgroundJob,
 } from "./infrastructure/background-jobs.ts";
+import { handledJob, jobCompleted, jobFailed } from "./contracts/job-outcome.ts";
 import { cloudEgress } from "./infrastructure/executor.ts";
 import { cloudProduct } from "./infrastructure/product.ts";
 import { cloudAuthDatabase } from "./infrastructure/auth-database.ts";
@@ -193,7 +195,12 @@ export default Api.make(
       limits: { subrequests: 50_000 },
       compatibility: {
         date: "2026-09-08",
-        flags: ["nodejs_compat", "global_fetch_strictly_public", "enable_request_signal"],
+        flags: [
+          "nodejs_compat",
+          "global_fetch_strictly_public",
+          "enable_request_signal",
+          "no_brotli_content_encoding",
+        ],
       },
       dev: {
         host: "127.0.0.1",
@@ -244,7 +251,8 @@ export default Api.make(
     );
     const v1Import = yield* v1ImportRoutes(
       yield* V1ImportWorkflow.pipe(
-        Effect.provide(Layer.mergeAll(executor, auth.mcpIdentity, v1ImportConfiguration)),
+        // A paid organization's subscription carries over to v2's billing, which syncs its seats.
+        Effect.provide(Layer.mergeAll(executor, auth.mcpIdentity, v1ImportConfiguration, billing)),
       ),
     ).pipe(Effect.provide(v1ImportConfiguration));
     const removals = Layer.merge(
@@ -275,7 +283,9 @@ export default Api.make(
         // fresh scope so execution memos cannot reuse that closed pool.
         Effect.scoped,
         Effect.withSpan("job.provisioning.dispatch"),
-        Effect.catch(() => Effect.logWarning("Provisioning outbox unavailable")),
+        Effect.catch((error) =>
+          Effect.logWarning("Provisioning outbox unavailable").pipe(Effect.as(jobFailed(error))),
+        ),
       );
     // Cron only recovers lost dispatches; their workflows install any team.
     const dispatch = dispatchWith(() => Effect.void);
@@ -283,6 +293,7 @@ export default Api.make(
     const organizationRemovals = dispatchOrganizationRemovals.pipe(
       Effect.provide(Layer.merge(executor, removals)),
       Effect.scoped,
+      Effect.as(jobCompleted),
     );
     // Jobs are queued by triggers on users, teams and members. Only auth and dashboard API
     // writes change those rows, so only their requests start the jobs at once. MCP, telemetry
@@ -319,14 +330,15 @@ export default Api.make(
       Effect.provide(executor),
       reportErrors,
       Effect.scoped,
-      Effect.catch(() => Effect.logWarning("Data steps unavailable")),
+      handledJob(Effect.logWarning("Data steps unavailable")),
     );
     const repositoryRecovery = Effect.flatten(AppRepositoryRecovery).pipe(
       Effect.provide(executor),
       reportErrors,
       Effect.scoped,
       Effect.withSpan("job.repository.recover"),
-      Effect.catch(() => Effect.logWarning("App repository recovery failed")),
+      Effect.as(jobCompleted),
+      handledJob(Effect.logWarning("App repository recovery failed")),
     );
     const appDomains = yield* cloudAppDomains;
     const siteAssets = yield* cloudSiteAssets;
@@ -334,7 +346,8 @@ export default Api.make(
     const siteAssetRetention = siteAssets.retainCurrent.pipe(
       reportErrors,
       Effect.scoped,
-      Effect.catch(() => Effect.logWarning("Site asset retention failed")),
+      Effect.as(jobCompleted),
+      handledJob(Effect.logWarning("Site asset retention failed")),
     );
     const dashboard = cloudDashboard(yield* Cloudflare.Workers.bindWorker(Dashboard), {
       resourceOrigins: auth.resourceOrigins,
@@ -360,7 +373,8 @@ export default Api.make(
       reportErrors,
       Effect.scoped,
       Effect.withSpan("job.workflow.reconcile"),
-      Effect.catch(() => Effect.logWarning("Workflow queue reconciliation failed")),
+      Effect.as(jobCompleted),
+      handledJob(Effect.logWarning("Workflow queue reconciliation failed")),
     );
     // Membership changes sync seats through durable provisioning jobs. This daily
     // pass only repairs what those jobs cannot see, such as edits made in Autumn.
@@ -368,7 +382,8 @@ export default Api.make(
       reportErrors,
       Effect.scoped,
       Effect.withSpan("job.billing.reconcile"),
-      Effect.catch(() => Effect.logError("Billing seat reconciliation failed")),
+      Effect.as(jobCompleted),
+      handledJob(Effect.logError("Billing seat reconciliation failed")),
     );
     // Repeats the reviewed idle grant data step for grants that became idle since; it does
     // nothing until that step has applied here.
@@ -381,7 +396,8 @@ export default Api.make(
       Effect.provide(executor),
       reportErrors,
       Effect.scoped,
-      Effect.catch(() => Effect.logWarning("Idle agent grant expiry failed")),
+      Effect.as(jobCompleted),
+      handledJob(Effect.logWarning("Idle agent grant expiry failed")),
     );
     const jobs = yield* cloudBackgroundJobs;
     yield* jobs.schedule(
@@ -405,7 +421,7 @@ export default Api.make(
       provisioning: dispatch,
       "data-steps": dataSteps,
       "repository-recovery": repositoryRecovery,
-      "schedule-wake": schedules.wake,
+      "schedule-wake": schedules.wake.pipe(Effect.as(jobCompleted)),
       "site-assets": siteAssetRetention,
       "app-domain-heartbeat": appDomains.heartbeat,
       "welcome-emails": welcomeEmails.deliver,
@@ -436,7 +452,10 @@ export default Api.make(
           document.document,
           catalogFeedUrl === undefined
             ? egress
-            : { ...egress, client: cachedFeedClient(apiOrigin, catalogFeedUrl, egress.client) },
+            : {
+                ...egress,
+                client: yield* cachedFeedClient(apiOrigin, catalogFeedUrl, egress.client),
+              },
           clientMetadata,
           apiOrigin,
           catalogFeedUrl,
@@ -538,18 +557,43 @@ export default Api.make(
     const routes = Layer.mergeAll(
       HttpRouter.add("POST", "/api/internal/app-domains/resume", appDomains.control("resume")),
       HttpRouter.add("POST", "/api/internal/app-domains/drain", appDomains.control("drain")),
-      HttpRouter.add("POST", "/api/internal/v1-import/start", v1Import.start),
+      // Starting an import reads the allow table (`writes.ts`) from the product database.
+      HttpRouter.add("POST", "/api/internal/v1-import/start", v1Import.start).pipe(
+        HttpRouter.provideRequest(executor),
+      ),
       HttpRouter.add(
         "GET",
         "/api/internal/v1-import/runs/:run/orgs/:organization",
         v1Import.report,
       ),
       HttpRouter.add("POST", "/api/internal/v1-import/runs/:run/aggregate", v1Import.aggregate),
+      // A rollback out of an existing organization revokes members' toolkit copies there.
       HttpRouter.add(
         "POST",
         "/api/internal/v1-import/orgs/:organization/rollback",
         v1Import.rollback,
+      ).pipe(HttpRouter.provideRequest(Layer.mergeAll(executor, auth.mcpIdentity))),
+      // The repair deploys apps with the importer's context, which holds the MCP connection store.
+      HttpRouter.add(
+        "POST",
+        "/api/internal/v1-import/orgs/:organization/repair",
+        v1Import.repair,
+      ).pipe(HttpRouter.provideRequest(Layer.mergeAll(executor, auth.mcpIdentity, billing))),
+      HttpRouter.add(
+        "POST",
+        "/api/internal/v1-import/orgs/:organization/restore",
+        v1Import.restore,
       ).pipe(HttpRouter.provideRequest(executor)),
+      HttpRouter.add(
+        "POST",
+        "/api/internal/v1-import/orgs/:organization/accounts",
+        v1Import.accounts,
+      ).pipe(HttpRouter.provideRequest(Layer.mergeAll(executor, auth.mcpIdentity, billing))),
+      HttpRouter.add(
+        "POST",
+        "/api/internal/v1-import/orgs/:organization/return-billing",
+        v1Import.giveBillingBack,
+      ).pipe(HttpRouter.provideRequest(Layer.merge(executor, billing))),
       jobs.route((job) => backgroundJobs[job]),
       authoringRoutes,
       ...(["login", "login/sso", "create"] as const).map((page) =>
@@ -600,6 +644,8 @@ export default Api.make(
         auth.handler.pipe(Effect.flatMap(hideRemovedOrganizations), Effect.provide(executor)),
       ),
       HttpRouter.add("*", "/api/auth/*", dispatchAfterWrites(auth.handler)),
+      // A member of a moved v1 workspace, signed in to v1, opens it here without signing in again.
+      HttpRouter.add("GET", v1HandoffPath, auth.v1Handoff),
       HttpRouter.add("*", "/api/email/unsubscribe", welcomeEmails.unsubscribe),
       HttpRouter.add(
         "GET",
diff --git a/apps/hosted/cloud/src/marketing.ts b/apps/hosted/cloud/src/marketing.ts
index 95706ff5a4..4e9d266c3d 100644
--- a/apps/hosted/cloud/src/marketing.ts
+++ b/apps/hosted/cloud/src/marketing.ts
@@ -32,7 +32,7 @@ export default Marketing.make(
       workersDev: false,
       build: workerBuild("marketing"),
       ...(yield* cloudObservability),
-      compatibility: { date: "2026-09-08", flags: ["nodejs_compat"] },
+      compatibility: { date: "2026-09-08", flags: ["nodejs_compat", "no_brotli_content_encoding"] },
       // Only explicitly public paths below can read this binding. Dashboard files stay private.
       assets: {
         directory: site.outdir,
diff --git a/apps/hosted/cloud/src/mcp-server.ts b/apps/hosted/cloud/src/mcp-server.ts
index bce60d0754..7192d96077 100644
--- a/apps/hosted/cloud/src/mcp-server.ts
+++ b/apps/hosted/cloud/src/mcp-server.ts
@@ -3,6 +3,7 @@
  * initializes only this Worker: the executor, the MCP grant checks and the protocol servers, not
  * the API with its routes, dashboard, sign-in, email, billing and schedules.
  */
+import { AlchemyContext } from "alchemy";
 import * as Cloudflare from "alchemy/Cloudflare";
 import { Effect, Layer, Schema } from "effect";
 import { Api } from "./infrastructure/api-worker.ts";
@@ -45,13 +46,19 @@ export default McpServer.make(
     if (globalThis.__ALCHEMY_RUNTIME__) return { main: import.meta.url };
     return {
       main: import.meta.url,
-      build: workerBuild("mcp-server"),
+      // Only `alchemy dev` bundles the local test hooks; deployed builds cannot contain them.
+      build: workerBuild("mcp-server", { localTestHooks: (yield* AlchemyContext).dev }),
       ...(yield* cloudObservability),
       workersDev: false,
       // The API Worker's flags, under which session objects ran before they moved here.
       compatibility: {
         date: "2026-09-08",
-        flags: ["nodejs_compat", "global_fetch_strictly_public", "enable_request_signal"],
+        flags: [
+          "nodejs_compat",
+          "global_fetch_strictly_public",
+          "enable_request_signal",
+          "no_brotli_content_encoding",
+        ],
       },
       env: {
         ...(yield* postHogBindings).env,
diff --git a/apps/hosted/cloud/web/src/contracts/onboarding.ts b/apps/hosted/cloud/web/src/contracts/onboarding.ts
index 2b8269b338..1319924591 100644
--- a/apps/hosted/cloud/web/src/contracts/onboarding.ts
+++ b/apps/hosted/cloud/web/src/contracts/onboarding.ts
@@ -8,6 +8,7 @@ import {
   OnboardingReady,
   OnboardingEntry,
   type CreateTeam,
+  SetupGate,
   type SetupSequence,
 } from "../../../src/contracts/onboarding.ts";
 import { CloudClient } from "./billing.ts";
@@ -87,3 +88,35 @@ export const setupSequenceAtom = Atom.family((organization: OrganizationReferenc
     (refresh) => refresh(query),
   ).pipe(Atom.withLabel("ui.onboarding.setup"));
 });
+
+/** Organizations whose dashboard this tab found open; an open dashboard never closes again. */
+const openDashboards = new Set<string>();
+
+/**
+ * Where a dashboard address sends this member instead: their current setup step while their setup
+ * is required and not finished, otherwise nowhere. `read` fetches from the API, in process on the
+ * server. A failed read leaves the dashboard open, since every API request still checks access,
+ * and is asked again on the next visit.
+ */
+export const setupGateRedirect = async (
+  read: (path: string) => Promise<Response>,
+  organization: string,
+): Promise<string | undefined> => {
+  if (openDashboards.has(organization)) return undefined;
+  const response = await read(
+    `/api/organizations/${encodeURIComponent(organization)}/setup/gate`,
+  ).catch(() => undefined);
+  if (response?.ok !== true) return undefined;
+  const gate = Schema.decodeUnknownOption(SetupGate)(await response.json().catch(() => null));
+  if (Option.isNone(gate)) return undefined;
+  if (gate.value.status === "open") {
+    // The server renders one document per request; only a tab remembers.
+    if (typeof window !== "undefined") openDashboards.add(organization);
+    return undefined;
+  }
+  const setup = `/org/${encodeURIComponent(organization)}/setup`;
+  if (gate.value.step === "assistant") return `${setup}/assistant`;
+  return gate.value.agent === undefined
+    ? `${setup}/accounts`
+    : `${setup}/accounts?${new URLSearchParams({ assistant: "other", agent: gate.value.agent })}`;
+};
diff --git a/apps/hosted/cloud/web/src/implementation/analytics-replay.ts b/apps/hosted/cloud/web/src/implementation/analytics-replay.ts
index 228317ff4d..9ee184a552 100644
--- a/apps/hosted/cloud/web/src/implementation/analytics-replay.ts
+++ b/apps/hosted/cloud/web/src/implementation/analytics-replay.ts
@@ -62,9 +62,11 @@ export const dashboardReplay: SessionRecordingOptions = {
   collectFonts: false,
   inlineStylesheet: true,
   captureCanvas: { recordCanvas: false },
-  // rrweb also uses this callback for its required page metadata. Keep only a fixed route label.
-  maskCapturedNetworkRequestFn: (request) =>
-    Object.keys(request).length === 1 && typeof request.name === "string"
-      ? { ...request, name: `${location.origin}/dashboard` }
-      : null,
+  // rrweb also uses this callback for its required page metadata. Keep only the page's path, which
+  // replayPageAllowed has already vetted; drop the query string and hash.
+  maskCapturedNetworkRequestFn: (request) => {
+    if (Object.keys(request).length !== 1 || typeof request.name !== "string") return null;
+    const url = new URL(request.name, location.origin);
+    return { ...request, name: `${url.origin}${url.pathname}` };
+  },
 };
diff --git a/apps/hosted/cloud/web/src/implementation/routeTree.gen.ts b/apps/hosted/cloud/web/src/implementation/routeTree.gen.ts
index 34427892e3..697d4ac5cf 100644
--- a/apps/hosted/cloud/web/src/implementation/routeTree.gen.ts
+++ b/apps/hosted/cloud/web/src/implementation/routeTree.gen.ts
@@ -37,6 +37,7 @@ import { Route as OrgOrganizationSlugApprovalsIndexRouteImport } from './routes/
 import { Route as OrgOrganizationSlugApprovalsRunIdRouteImport } from './routes/org.$organizationSlug.approvals.$runId'
 import { Route as OrgOrganizationSlugAppsIndexRouteImport } from './routes/org.$organizationSlug.apps.index'
 import { Route as OrgOrganizationSlugAppsAppIdRouteImport } from './routes/org.$organizationSlug.apps.$appId'
+import { Route as OrgOrganizationSlugConnectConnectionIdRouteImport } from './routes/org.$organizationSlug.connect_.$connectionId'
 import { Route as OrgOrganizationSlugConnectionsConnectionIdRouteImport } from './routes/org.$organizationSlug.connections.$connectionId'
 import { Route as OrgOrganizationSlugGroupsIndexRouteImport } from './routes/org.$organizationSlug.groups.index'
 import { Route as OrgOrganizationSlugGroupsGroupIdRouteImport } from './routes/org.$organizationSlug.groups.$groupId'
@@ -45,7 +46,6 @@ import { Route as OrgOrganizationSlugSetupAccountsRouteImport } from './routes/o
 import { Route as OrgOrganizationSlugSetupAssistantRouteImport } from './routes/org.$organizationSlug_.setup.assistant'
 import { Route as OrgOrganizationSlugAppsAppIdSetupRouteImport } from './routes/org.$organizationSlug.apps.$appId_.setup'
 import { Route as OrgOrganizationSlugAppsAddIndexRouteImport } from './routes/org.$organizationSlug.apps.add.index'
-import { Route as OrgOrganizationSlugAppsAddCustomRouteImport } from './routes/org.$organizationSlug.apps.add.custom'
 import { Route as OrgOrganizationSlugWebhooksAppIdSubscriptionIdRouteImport } from './routes/org.$organizationSlug.webhooks.$appId.$subscriptionId'
 import { Route as OrgOrganizationSlugAppsAppIdApproveRequestIdRouteImport } from './routes/org.$organizationSlug.apps.$appId_.approve.$requestId'
 
@@ -200,6 +200,12 @@ const OrgOrganizationSlugAppsAppIdRoute =
     path: '/apps/$appId',
     getParentRoute: () => OrgOrganizationSlugRoute,
   } as any)
+const OrgOrganizationSlugConnectConnectionIdRoute =
+  OrgOrganizationSlugConnectConnectionIdRouteImport.update({
+    id: '/connect_/$connectionId',
+    path: '/connect/$connectionId',
+    getParentRoute: () => OrgOrganizationSlugRoute,
+  } as any)
 const OrgOrganizationSlugConnectionsConnectionIdRoute =
   OrgOrganizationSlugConnectionsConnectionIdRouteImport.update({
     id: '/connections/$connectionId',
@@ -248,12 +254,6 @@ const OrgOrganizationSlugAppsAddIndexRoute =
     path: '/apps/add/',
     getParentRoute: () => OrgOrganizationSlugRoute,
   } as any)
-const OrgOrganizationSlugAppsAddCustomRoute =
-  OrgOrganizationSlugAppsAddCustomRouteImport.update({
-    id: '/apps/add/custom',
-    path: '/apps/add/custom',
-    getParentRoute: () => OrgOrganizationSlugRoute,
-  } as any)
 const OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute =
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRouteImport.update({
     id: '/webhooks/$appId/$subscriptionId',
@@ -293,6 +293,7 @@ export interface FileRoutesByFullPath {
   '/org/$organizationSlug/': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -303,7 +304,6 @@ export interface FileRoutesByFullPath {
   '/org/$organizationSlug/groups/': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug/setup/': typeof OrgOrganizationSlugSetupIndexRoute
   '/org/$organizationSlug/apps/$appId/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add/': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -331,6 +331,7 @@ export interface FileRoutesByTo {
   '/org/$organizationSlug': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -341,7 +342,6 @@ export interface FileRoutesByTo {
   '/org/$organizationSlug/groups': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug/setup': typeof OrgOrganizationSlugSetupIndexRoute
   '/org/$organizationSlug/apps/$appId/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -373,6 +373,7 @@ export interface FileRoutesById {
   '/org/$organizationSlug/': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect_/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug_/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -383,7 +384,6 @@ export interface FileRoutesById {
   '/org/$organizationSlug/groups/': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug_/setup/': typeof OrgOrganizationSlugSetupIndexRoute
   '/org/$organizationSlug/apps/$appId_/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add/': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId_/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -416,6 +416,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug/setup/accounts'
@@ -426,7 +427,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/groups/'
     | '/org/$organizationSlug/setup/'
     | '/org/$organizationSlug/apps/$appId/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add/'
     | '/org/$organizationSlug/apps/$appId/approve/$requestId'
@@ -454,6 +454,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug/setup/accounts'
@@ -464,7 +465,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/groups'
     | '/org/$organizationSlug/setup'
     | '/org/$organizationSlug/apps/$appId/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add'
     | '/org/$organizationSlug/apps/$appId/approve/$requestId'
@@ -495,6 +495,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect_/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug_/setup/accounts'
@@ -505,7 +506,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/groups/'
     | '/org/$organizationSlug_/setup/'
     | '/org/$organizationSlug/apps/$appId_/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add/'
     | '/org/$organizationSlug/apps/$appId_/approve/$requestId'
@@ -726,6 +726,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof OrgOrganizationSlugAppsAppIdRouteImport
       parentRoute: typeof OrgOrganizationSlugRoute
     }
+    '/org/$organizationSlug/connect_/$connectionId': {
+      id: '/org/$organizationSlug/connect_/$connectionId'
+      path: '/connect/$connectionId'
+      fullPath: '/org/$organizationSlug/connect/$connectionId'
+      preLoaderRoute: typeof OrgOrganizationSlugConnectConnectionIdRouteImport
+      parentRoute: typeof OrgOrganizationSlugRoute
+    }
     '/org/$organizationSlug/connections/$connectionId': {
       id: '/org/$organizationSlug/connections/$connectionId'
       path: '/connections/$connectionId'
@@ -782,13 +789,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof OrgOrganizationSlugAppsAddIndexRouteImport
       parentRoute: typeof OrgOrganizationSlugRoute
     }
-    '/org/$organizationSlug/apps/add/custom': {
-      id: '/org/$organizationSlug/apps/add/custom'
-      path: '/apps/add/custom'
-      fullPath: '/org/$organizationSlug/apps/add/custom'
-      preLoaderRoute: typeof OrgOrganizationSlugAppsAddCustomRouteImport
-      parentRoute: typeof OrgOrganizationSlugRoute
-    }
     '/org/$organizationSlug/webhooks/$appId/$subscriptionId': {
       id: '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
       path: '/webhooks/$appId/$subscriptionId'
@@ -831,6 +831,7 @@ interface OrgOrganizationSlugRouteChildren {
   OrgOrganizationSlugIndexRoute: typeof OrgOrganizationSlugIndexRoute
   OrgOrganizationSlugApprovalsRunIdRoute: typeof OrgOrganizationSlugApprovalsRunIdRoute
   OrgOrganizationSlugAppsAppIdRoute: typeof OrgOrganizationSlugAppsAppIdRoute
+  OrgOrganizationSlugConnectConnectionIdRoute: typeof OrgOrganizationSlugConnectConnectionIdRoute
   OrgOrganizationSlugConnectionsConnectionIdRoute: typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   OrgOrganizationSlugGroupsGroupIdRoute: typeof OrgOrganizationSlugGroupsGroupIdRoute
   OrgOrganizationSlugAccountsIndexRoute: typeof OrgOrganizationSlugAccountsIndexRoute
@@ -838,7 +839,6 @@ interface OrgOrganizationSlugRouteChildren {
   OrgOrganizationSlugAppsIndexRoute: typeof OrgOrganizationSlugAppsIndexRoute
   OrgOrganizationSlugGroupsIndexRoute: typeof OrgOrganizationSlugGroupsIndexRoute
   OrgOrganizationSlugAppsAppIdSetupRoute: typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  OrgOrganizationSlugAppsAddCustomRoute: typeof OrgOrganizationSlugAppsAddCustomRoute
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute: typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   OrgOrganizationSlugAppsAddIndexRoute: typeof OrgOrganizationSlugAppsAddIndexRoute
   OrgOrganizationSlugAppsAppIdApproveRequestIdRoute: typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -853,6 +853,8 @@ const OrgOrganizationSlugRouteChildren: OrgOrganizationSlugRouteChildren = {
   OrgOrganizationSlugApprovalsRunIdRoute:
     OrgOrganizationSlugApprovalsRunIdRoute,
   OrgOrganizationSlugAppsAppIdRoute: OrgOrganizationSlugAppsAppIdRoute,
+  OrgOrganizationSlugConnectConnectionIdRoute:
+    OrgOrganizationSlugConnectConnectionIdRoute,
   OrgOrganizationSlugConnectionsConnectionIdRoute:
     OrgOrganizationSlugConnectionsConnectionIdRoute,
   OrgOrganizationSlugGroupsGroupIdRoute: OrgOrganizationSlugGroupsGroupIdRoute,
@@ -863,7 +865,6 @@ const OrgOrganizationSlugRouteChildren: OrgOrganizationSlugRouteChildren = {
   OrgOrganizationSlugGroupsIndexRoute: OrgOrganizationSlugGroupsIndexRoute,
   OrgOrganizationSlugAppsAppIdSetupRoute:
     OrgOrganizationSlugAppsAppIdSetupRoute,
-  OrgOrganizationSlugAppsAddCustomRoute: OrgOrganizationSlugAppsAddCustomRoute,
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute:
     OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute,
   OrgOrganizationSlugAppsAddIndexRoute: OrgOrganizationSlugAppsAddIndexRoute,
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
index a41ef72fc5..09194f120a 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
@@ -1,10 +1,11 @@
 import { parseAccountsSearch } from "@executor-js/hosted-web/contracts/navigation";
 import { createFileRoute } from "@tanstack/react-router";
-import { AccountsPage } from "@executor-js/hosted-web/pages/accounts";
+import { AccountsPage, accountsPageReads } from "@executor-js/hosted-web/pages/accounts";
 
 /** Hosted account inventory. */
 export const Route = createFileRoute("/org/$organizationSlug/accounts/")({
   validateSearch: parseAccountsSearch,
+  staticData: { organizationReads: accountsPageReads },
   component: Page,
 });
 
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
index 3244f94d01..42e7e89923 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
@@ -1,5 +1,6 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { ApprovalsPage } from "@executor-js/hosted-web/pages/approvals";
+import { ApprovalsPage, approvalsPageReads } from "@executor-js/hosted-web/pages/approvals";
 export const Route = createFileRoute("/org/$organizationSlug/approvals/")({
   component: ApprovalsPage,
+  staticData: { organizationReads: approvalsPageReads },
 });
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx
deleted file mode 100644
index 56d60a3a0c..0000000000
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { CustomAppPage } from "@executor-js/hosted-web/pages/custom-app";
-
-/** Remote custom app setup is shared by both hosted products. */
-export const Route = createFileRoute("/org/$organizationSlug/apps/add/custom")({
-  component: CustomAppPage,
-});
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect.tsx
index ca6700cf11..cfd609f4eb 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect.tsx
@@ -1,4 +1,7 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { ConnectPage } from "@executor-js/hosted-web/pages/connect";
+import { ConnectPage, connectPageReads } from "@executor-js/hosted-web/pages/connect";
 
-export const Route = createFileRoute("/org/$organizationSlug/connect")({ component: ConnectPage });
+export const Route = createFileRoute("/org/$organizationSlug/connect")({
+  component: ConnectPage,
+  staticData: { organizationReads: connectPageReads },
+});
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx
new file mode 100644
index 0000000000..0402fe0521
--- /dev/null
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { ConnectionPage, connectionPageReads } from "@executor-js/hosted-web/pages/connect";
+
+export const Route = createFileRoute("/org/$organizationSlug/connect_/$connectionId")({
+  component: () => <ConnectionPage connectionId={Route.useParams().connectionId} />,
+  staticData: { organizationReads: connectionPageReads },
+});
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
index 89c82cb06a..8d29c79612 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
@@ -1,7 +1,8 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { GroupsPage } from "@executor-js/hosted-web/pages/groups";
+import { GroupsPage, groupsPageReads } from "@executor-js/hosted-web/pages/groups";
 
 /** Group membership detail stays scoped to the organization route. */
 export const Route = createFileRoute("/org/$organizationSlug/groups/$groupId")({
   component: () => <GroupsPage id={Route.useParams().groupId} />,
+  staticData: { organizationReads: groupsPageReads },
 });
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
index 23a05196d7..56905d47e5 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
@@ -1,5 +1,8 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { GroupsPage } from "@executor-js/hosted-web/pages/groups";
+import { GroupsPage, groupsPageReads } from "@executor-js/hosted-web/pages/groups";
 
 /** Group directory shared by hosted products. */
-export const Route = createFileRoute("/org/$organizationSlug/groups/")({ component: GroupsPage });
+export const Route = createFileRoute("/org/$organizationSlug/groups/")({
+  component: GroupsPage,
+  staticData: { organizationReads: groupsPageReads },
+});
diff --git a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.tsx b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.tsx
index c0143c1e52..3759458e81 100644
--- a/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.tsx
+++ b/apps/hosted/cloud/web/src/implementation/routes/org.$organizationSlug.tsx
@@ -1,4 +1,4 @@
-import { createFileRoute, Outlet, useLocation } from "@tanstack/react-router";
+import { createFileRoute, Outlet, redirect, useLocation } from "@tanstack/react-router";
 import { DashboardEntryPending } from "@executor-js/hosted-web/entry";
 import { CloudPagePending } from "../components/page-pending.tsx";
 import { ErrorTrackingProvider } from "@executor-js/ui/dashboard/error-tracking";
@@ -8,10 +8,28 @@ import { NameAccountDialog } from "@executor-js/hosted-web/pages/name-account-di
 import { HostedNavigation } from "@executor-js/hosted-web/navigation";
 import { CloudSupport } from "../components/support.tsx";
 import { CloudNavigation } from "../components/navigation.tsx";
+import { setupGateRedirect } from "../../contracts/onboarding.ts";
+import { serverDocument } from "../document.ts";
 
 /** The URL owns this tab's organization; all product pages inherit this boundary. Cloud records
  * product failures in PostHog, so its error cards can say a failure was tracked. */
 export const Route = createFileRoute("/org/$organizationSlug")({
+  /**
+   * A member whose setup is required stays in it until both steps are done: the server answers
+   * their dashboard address with a redirect to the current step before any HTML, and the router
+   * does the same before showing the dashboard when they arrive from outside it. Moving between
+   * dashboard pages asks nothing.
+   */
+  beforeLoad: async ({ params, cause, preload }) => {
+    if (preload || (!import.meta.env.SSR && cause !== "enter")) return;
+    const href = await setupGateRedirect(
+      import.meta.env.SSR ? serverDocument().apiFetch : (path) => fetch(path),
+      params.organizationSlug,
+    );
+    if (href !== undefined) throw redirect({ href, replace: true });
+  },
+  // The page being left stays on screen while that is asked, not a dashboard that may not open.
+  pendingMs: 2000,
   component: OrganizationLayout,
   // The server streams the dashboard frame and navigation first, then the organization.
   pendingComponent: OrganizationPending,
diff --git a/apps/hosted/self-host/Dockerfile b/apps/hosted/self-host/Dockerfile
index 858376133f..89fefe7f02 100644
--- a/apps/hosted/self-host/Dockerfile
+++ b/apps/hosted/self-host/Dockerfile
@@ -1,5 +1,5 @@
-FROM node:24.18.0-bookworm-slim AS build
-COPY --from=oven/bun:1.4.2 /usr/local/bin/bun /usr/local/bin/bun
+FROM node:24.22.1-bookworm-slim AS build
+COPY --from=oven/bun:1.4.4 /usr/local/bin/bun /usr/local/bin/bun
 ARG EXECUTOR_BUILD_VERSION
 RUN test -n "$EXECUTOR_BUILD_VERSION" || { echo "EXECUTOR_BUILD_VERSION is required. Pass --build-arg EXECUTOR_BUILD_VERSION=<version>, or set it in the environment for docker compose build." >&2; exit 1; }
 ENV EXECUTOR_BUILD_VERSION=$EXECUTOR_BUILD_VERSION EXECUTOR_ENVIRONMENT=self-host
diff --git a/apps/hosted/self-host/scripts/package-runtime.ts b/apps/hosted/self-host/scripts/package-runtime.ts
index 73effcf65c..e7d096291f 100644
--- a/apps/hosted/self-host/scripts/package-runtime.ts
+++ b/apps/hosted/self-host/scripts/package-runtime.ts
@@ -271,7 +271,7 @@ const packageRuntime = Effect.gen(function* () {
   // host names on each command line: the product reaches `apps` over HTTP and capnweb, and the apps
   // Worker calls back to the product's SelfOrigin and WorkflowCallbacks entrypoints.
   const productWorker = (bindings: { readonly apps: string }) => `(name="product",worker=(
-   compatibilityDate="2026-09-01",compatibilityFlags=["nodejs_compat"],
+   compatibilityDate="2026-09-01",compatibilityFlags=["nodejs_compat","no_brotli_content_encoding"],
    modules=[(name="product.mjs",esModule=embed "@@RUNTIME@@/product.mjs"),(name="executor:pglite.wasm",wasm=embed "@@RUNTIME@@/pglite.wasm"),(name="executor:initdb.wasm",wasm=embed "@@RUNTIME@@/initdb.wasm"),(name="executor:pglite.data",data=embed "@@RUNTIME@@/pglite.data")],
    bindings=[(name="PRODUCT",durableObjectNamespace="ExecutorProduct"),(name="NATIVE",service="native"),(name="LEGACY_DATABASE",service="legacy-data"),(name="BLOBS",service="builds"),(name="DASHBOARD",service="dashboard"),(name="PUBLIC_FETCH",service="public"),(name="PRIVATE_FETCH",service="internet"),(name="MOTEL",service="motel"),(name="SELF",service=(name="product",entrypoint="SelfOrigin")),(name="APPS",service=${bindings.apps}),(name="UNSAFE_EVAL",unsafeEval=void)],
    durableObjectNamespaces=[(className="ExecutorProduct",uniqueKey="executor-product",enableSql=true,preventEviction=true)],durableObjectStorage=(localDisk="product-data")
@@ -280,12 +280,12 @@ const packageRuntime = Effect.gen(function* () {
     readonly self: string;
     readonly host: string;
   }) => `(name="apps",worker=(
-   compatibilityDate="2026-07-30",compatibilityFlags=["nodejs_compat"],modules=[${moduleConfig.join(",")}],
+   compatibilityDate="2026-07-30",compatibilityFlags=["nodejs_compat","no_brotli_content_encoding"],modules=[${moduleConfig.join(",")}],
    bindings=[(name="LOADER",workerLoader=()),(name="DATA",durableObjectNamespace="AppDataSupervisor"),(name="AUTH",text="service-binding"),(name="CREDENTIAL_SECRET",fromEnvironment="EXECUTOR_CREDENTIAL_HANDLE_SECRET"),(name="APPS_PRIVATE_FETCH",json="@@APPS_PRIVATE_FETCH@@"),(name="APP_WORKERS",json="@@APP_WORKERS@@"),(name="APP_WORKER_IDLE_SECONDS",json="@@APP_WORKER_IDLE_SECONDS@@"),(name="PUBLIC_FETCH",service="public"),(name="SELF_ORIGIN",text=@@SELF_ORIGIN@@),(name="NPM_REGISTRY",text=@@NPM_REGISTRY@@),(name="SELF",service=${bindings.self}),(name="HOST",service=${bindings.host}),(name="RUNS",wrapped=(moduleName="cloudflare-runtime:workflows-wrapped-binding",innerBindings=[(name="binding",service=(name="workflows",entrypoint="WorkflowBinding"))]))],
    durableObjectNamespaces=[(className="AppDataSupervisor",uniqueKey="executor-app-data",enableSql=true)],durableObjectStorage=(localDisk="app-data")
   ))`;
   const workflowsWorker = `(name="workflows",worker=(
-   compatibilityDate="2026-09-01",compatibilityFlags=["experimental","nodejs_compat"],modules=[${workflowModules.join(",")}],
+   compatibilityDate="2026-09-01",compatibilityFlags=["experimental","nodejs_compat","no_brotli_content_encoding"],modules=[${workflowModules.join(",")}],
    bindings=[(name="ENGINE",durableObjectNamespace="Engine"),(name="USER_WORKFLOW",service=(name="apps",entrypoint="AppWorkflows")),(name="BINDING_NAME",json=${JSON.stringify(JSON.stringify("executor-app-workflows"))}),(name="WORKFLOW_NAME",json=${JSON.stringify(JSON.stringify("executor-app-workflows"))})],
    durableObjectNamespaces=[${workflowEngines}],durableObjectStorage=(localDisk="workflow-data")
   ))`;
diff --git a/apps/hosted/self-host/src/auth.ts b/apps/hosted/self-host/src/auth.ts
index a0bfa2bacb..862ac7d521 100644
--- a/apps/hosted/self-host/src/auth.ts
+++ b/apps/hosted/self-host/src/auth.ts
@@ -14,6 +14,7 @@ import {
   provisionHostedOAuthResources,
   ApiAuthentication,
   apiBearerAccess,
+  callerSpanAttributes,
   mcpBearerAccess,
   Authentication,
   AuthenticationUnavailable,
@@ -104,8 +105,8 @@ export const selfHostAuth = Effect.gen(function* () {
     authenticate: (headers, mode, organization, connection) =>
       mcpBearerAccess(origins, { headers, mode, organization, connection }).pipe(
         Effect.provideService(SqlClient.SqlClient, sql),
-        Effect.tap(({ access }) =>
-          Effect.annotateCurrentSpan("executor.organization.id", access.organization),
+        Effect.tap(({ access, userId }) =>
+          Effect.annotateCurrentSpan(callerSpanAttributes(access.organization, userId)),
         ),
         Effect.withSpan("auth.authenticate"),
       ),
@@ -140,8 +141,8 @@ export const selfHostAuth = Effect.gen(function* () {
     authenticate: (headers, organization) =>
       apiBearerAccess(origins, { headers, organization }).pipe(
         Effect.provideService(SqlClient.SqlClient, sql),
-        Effect.tap(({ access }) =>
-          Effect.annotateCurrentSpan("executor.organization.id", access.organization),
+        Effect.tap(({ access, userId }) =>
+          Effect.annotateCurrentSpan(callerSpanAttributes(access.organization, userId)),
         ),
         Effect.withSpan("auth.authenticate"),
       ),
diff --git a/apps/hosted/self-host/src/contracts/api.ts b/apps/hosted/self-host/src/contracts/api.ts
index 87b9753bed..6cdff1615c 100644
--- a/apps/hosted/self-host/src/contracts/api.ts
+++ b/apps/hosted/self-host/src/contracts/api.ts
@@ -1,12 +1,12 @@
 import { HostedAppUi } from "@executor-js/hosted-server/app-ui/contracts";
 import { HostedApi, hostedApiDocument } from "@executor-js/hosted-server/contracts";
+import { RequestRejection } from "@executor-js/sdk/core";
 import { OpenApi } from "effect/http-api";
 
 /** Complete Executor Self-host API. Compose every self-host product endpoint here. */
-export const ExecutorSelfHostApi = HostedApi.add(HostedAppUi).annotate(
-  OpenApi.Title,
-  "Executor Self-host",
-);
+export const ExecutorSelfHostApi = HostedApi.add(HostedAppUi)
+  .middleware(RequestRejection)
+  .annotate(OpenApi.Title, "Executor Self-host");
 
 /** The exact product contract used by the router, published spec and generated Executor app. */
 export const executorSelfHostApiDocument = (origin: string) =>
diff --git a/apps/hosted/self-host/src/executor.ts b/apps/hosted/self-host/src/executor.ts
index 5c4b305106..8368183403 100644
--- a/apps/hosted/self-host/src/executor.ts
+++ b/apps/hosted/self-host/src/executor.ts
@@ -1,5 +1,5 @@
 /** Native development host resources. The packaged product uses workerd bindings. */
-import { nativeRepositories } from "@executor-js/app-source/node";
+import { nativeRepositories, systemGit } from "@executor-js/app-source/node";
 import { filesystemBlobStore, workerdApps } from "@executor-js/sdk/node/workerd";
 import type { HostEgress } from "@executor-js/utils/url-policy";
 import { Config, Effect, Option, Path } from "effect";
@@ -40,7 +40,8 @@ export const selfHostExecutor = (egress: HostEgress) =>
       return {
         ...host,
         blobs,
-        repositories: nativeRepositories(path.resolve(directory, "repositories")),
+        // The image installs Git on PATH.
+        repositories: nativeRepositories(path.resolve(directory, "repositories"), systemGit),
       };
     }),
   );
diff --git a/apps/hosted/self-host/src/implementation/executor-services.ts b/apps/hosted/self-host/src/implementation/executor-services.ts
index fd06feae5e..a76622496a 100644
--- a/apps/hosted/self-host/src/implementation/executor-services.ts
+++ b/apps/hosted/self-host/src/implementation/executor-services.ts
@@ -30,6 +30,8 @@ import {
   organizationDefaults,
   noOrganizationRemovals,
   lazyHostedApiDocument,
+  hostedApi,
+  hostedApiRevision,
   authSettings,
   clientMetadataSetting,
   firstPartyOAuthClients,
@@ -102,6 +104,11 @@ export const selfHostExecutorServices = <E, R>(
           "EXECUTOR_REGISTRY_URL is set but has no effect: this self-host serves its organization's own registry.",
         );
       const lifecycle = yield* hostedResourceLifecycle;
+      const api = lazyHostedApiDocument(() => executorSelfHostApiDocument(origin));
+      // The Executor app reads this server's API; its cache and listings follow the API's revision.
+      const revision = yield* hostedApiRevision(yield* api.body).pipe(
+        Effect.provide(BrowserCrypto.layer),
+      );
       const executor = yield* createExecutor({
         database: storage,
         secret: key,
@@ -133,6 +140,7 @@ export const selfHostExecutorServices = <E, R>(
           durable: declarations,
           toolListings: evaluation.toolListings,
         },
+        hostApi: hostedApi([origin], revision),
         // Stale declarations refresh on the server's own lifetime.
         background: (work) => Effect.forkIn(work, server).pipe(Effect.as(true)),
         events: {
@@ -180,7 +188,7 @@ export const selfHostExecutorServices = <E, R>(
       const initialize = yield* organizationDefaults(
         executor,
         origin,
-        lazyHostedApiDocument(() => executorSelfHostApiDocument(origin)).document,
+        api.document,
         // Password registration is admitted locally; self-host does not send verification mail.
         false,
       );
diff --git a/apps/hosted/self-host/src/implementation/routes.ts b/apps/hosted/self-host/src/implementation/routes.ts
index 5dc97f5bc3..7068328b6b 100644
--- a/apps/hosted/self-host/src/implementation/routes.ts
+++ b/apps/hosted/self-host/src/implementation/routes.ts
@@ -208,7 +208,6 @@ export const selfHostRouteMap = <DashboardE, DashboardR>(options: {
       ),
       HttpRouter.add("GET", appSignInCallbackPath, appUi.callback),
       HttpRouter.add("GET", "/_executor/assets/:version/*", appUi.asset),
-      HttpRouter.add("GET", "/_executor/watch.js", appUi.watch),
       HttpRouter.add("GET", "/_executor/version", appUi.versions),
       HttpRouter.add("POST", "/_executor/api/telemetry/traces", appUi.telemetry("traces")),
       HttpRouter.add("POST", "/_executor/api/telemetry/logs", appUi.telemetry("logs")),
diff --git a/apps/hosted/self-host/web/src/contracts/auth.ts b/apps/hosted/self-host/web/src/contracts/auth.ts
index 20cda066da..8946e5ff92 100644
--- a/apps/hosted/self-host/web/src/contracts/auth.ts
+++ b/apps/hosted/self-host/web/src/contracts/auth.ts
@@ -109,3 +109,37 @@ export const selfHostSignInAtom = BrowserAtoms.fn((input: SelfHostSignIn, get) =
     Effect.asVoid,
   );
 });
+
+/** The providers the signed-in person can sign in with; `sso` once they connected SSO. */
+const LinkedAccounts = Schema.Array(Schema.Struct({ providerId: Schema.String }));
+
+/** Whether the signed-in person has connected the operator's SSO to their account. */
+export const ssoConnectedAtom = browserOnly(
+  BrowserAtoms.atom(
+    authRequest((options) => authClient.listAccounts({}, options)).pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(LinkedAccounts)),
+      Effect.map((accounts) => accounts.some((account) => account.providerId === "sso")),
+      Effect.catchTag("SchemaError", () =>
+        Effect.fail(new AuthFailed({ message: "Unable to read your sign-in methods." })),
+      ),
+      Effect.withSpan("ui.auth.sso_connected"),
+    ),
+  ),
+);
+
+/**
+ * Connect the operator's SSO to the signed-in account. The provider returns to the Security page,
+ * with an `error` code when the instance refused the link.
+ */
+export const connectSsoAtom = BrowserAtoms.fn(() =>
+  authRequest((options) =>
+    authClient.linkSocial(
+      {
+        provider: "sso",
+        callbackURL: "/account/security",
+        errorCallbackURL: "/account/security",
+      },
+      options,
+    ),
+  ).pipe(Effect.withSpan("ui.auth.connect_sso"), Effect.asVoid),
+);
diff --git a/apps/hosted/self-host/web/src/contracts/sso.ts b/apps/hosted/self-host/web/src/contracts/sso.ts
index 27335cb3f9..2bce3d653a 100644
--- a/apps/hosted/self-host/web/src/contracts/sso.ts
+++ b/apps/hosted/self-host/web/src/contracts/sso.ts
@@ -19,12 +19,26 @@ const explanations: Readonly<Record<string, string>> = {
   [SsoRefusal.instanceNotReady]:
     "This instance is not set up yet. Ask your administrator to finish setup.",
   // Better Auth links SSO only to an account whose email was verified, and password accounts
-  // here never are.
+  // here never are. The signed-in owner connects it on the Security page instead.
   account_not_linked:
-    "This email already has a password account on this instance. Sign in with your password.",
+    "This email already has a password account on this instance. Sign in with your password, then connect SSO on your account's Security page.",
 };
 
 /** The explanation for a callback error code; unknown codes get a general one. */
 export const ssoRefusalExplanation = (code: string): string =>
   explanations[code] ??
   "SSO sign-in failed. Use an approved account or contact your administrator.";
+
+/** Why Better Auth refused to connect SSO to the signed-in account, by its callback code. */
+const linkExplanations: Readonly<Record<string, string>> = {
+  email_does_not_match:
+    "Your identity provider signed you in with a different email address. Connect the SSO account that uses this account's email.",
+  account_already_linked_to_different_user:
+    "That SSO account is already connected to another account on this instance.",
+  unable_to_link_account:
+    "Your identity provider did not confirm that this email address is verified, so SSO was not connected.",
+};
+
+/** The explanation for a refused SSO connection; unknown codes get a general one. */
+export const ssoLinkRefusalExplanation = (code: string): string =>
+  linkExplanations[code] ?? "SSO could not be connected. Try again.";
diff --git a/apps/hosted/self-host/web/src/implementation/components/connect-sso.tsx b/apps/hosted/self-host/web/src/implementation/components/connect-sso.tsx
new file mode 100644
index 0000000000..2021d15bd2
--- /dev/null
+++ b/apps/hosted/self-host/web/src/implementation/components/connect-sso.tsx
@@ -0,0 +1,78 @@
+import { useAtomSet, useAtomValue } from "@effect/atom-react";
+import { Exit } from "effect";
+import { AsyncResult } from "effect/reactivity";
+import { useState } from "react";
+import { Button } from "@executor-js/ui/components/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+} from "@executor-js/ui/components/card";
+import { accountSettingClass } from "@executor-js/hosted-web/account";
+import { configurationAtom, connectSsoAtom, ssoConnectedAtom } from "../../contracts/auth.ts";
+import { ssoLinkRefusalExplanation } from "../../contracts/sso.ts";
+
+/**
+ * Connect the operator's SSO to an account that signs in with a password. SSO never links itself
+ * to a password account, so its owner does it here while signed in. Shown only when the operator
+ * enabled SSO; `refused` is the code the instance returned the provider's sign-in with.
+ */
+export function ConnectSso({ refused }: { readonly refused: string | undefined }) {
+  const configuration = useAtomValue(configurationAtom);
+  const connected = useAtomValue(ssoConnectedAtom);
+  const connect = useAtomSet(connectSsoAtom, { mode: "promiseExit" });
+  const state = useAtomValue(connectSsoAtom);
+  const [error, setError] = useState<string>();
+  if (!AsyncResult.isSuccess(configuration) || !configuration.value.sso) return null;
+  const linked = AsyncResult.isSuccess(connected) && connected.value;
+  const message =
+    error ??
+    (AsyncResult.isFailure(connected)
+      ? "Unable to read your sign-in methods. Reload to try again."
+      : refused === undefined || linked
+        ? undefined
+        : ssoLinkRefusalExplanation(refused));
+  return (
+    <Card className={accountSettingClass}>
+      <CardHeader>
+        <CardTitle>
+          <h2>Single sign-on</h2>
+        </CardTitle>
+        <CardDescription>
+          {linked
+            ? "Connected. You can sign in with SSO or with your password."
+            : "Connect your identity provider account to sign in with SSO as well as your password."}
+        </CardDescription>
+      </CardHeader>
+      {message && (
+        <CardContent>
+          <p role="alert" className="auth-error text-destructive text-[13px]">
+            {message}
+          </p>
+        </CardContent>
+      )}
+      {!linked && (
+        <CardFooter>
+          <div className="flex items-center gap-2.5 text-[12px] [&_>_button]:h-7.5 [&_>_button]:py-0 [&_>_button]:px-[12px] [&_>_button]:text-[12px] [&_>_button]:bg-transparent [&_>_button]:shadow-none max-[640px]:[&_>_button]:min-h-10">
+            <Button
+              variant="outline"
+              loading={state.waiting}
+              disabled={!AsyncResult.isSuccess(connected)}
+              onClick={async () => {
+                setError(undefined);
+                // On success the browser leaves for the identity provider.
+                if (Exit.isFailure(await connect()))
+                  setError("SSO could not be started. Try again.");
+              }}
+            >
+              Connect SSO
+            </Button>
+          </div>
+        </CardFooter>
+      )}
+    </Card>
+  );
+}
diff --git a/apps/hosted/self-host/web/src/implementation/routeTree.gen.ts b/apps/hosted/self-host/web/src/implementation/routeTree.gen.ts
index b8f31096b1..823de1800d 100644
--- a/apps/hosted/self-host/web/src/implementation/routeTree.gen.ts
+++ b/apps/hosted/self-host/web/src/implementation/routeTree.gen.ts
@@ -33,6 +33,7 @@ import { Route as OrgOrganizationSlugApprovalsIndexRouteImport } from './routes/
 import { Route as OrgOrganizationSlugApprovalsRunIdRouteImport } from './routes/org.$organizationSlug.approvals.$runId'
 import { Route as OrgOrganizationSlugAppsIndexRouteImport } from './routes/org.$organizationSlug.apps.index'
 import { Route as OrgOrganizationSlugAppsAppIdRouteImport } from './routes/org.$organizationSlug.apps.$appId'
+import { Route as OrgOrganizationSlugConnectConnectionIdRouteImport } from './routes/org.$organizationSlug.connect_.$connectionId'
 import { Route as OrgOrganizationSlugConnectionsConnectionIdRouteImport } from './routes/org.$organizationSlug.connections.$connectionId'
 import { Route as OrgOrganizationSlugGroupsIndexRouteImport } from './routes/org.$organizationSlug.groups.index'
 import { Route as OrgOrganizationSlugGroupsGroupIdRouteImport } from './routes/org.$organizationSlug.groups.$groupId'
@@ -40,7 +41,6 @@ import { Route as OrgOrganizationSlugSetupAccountsRouteImport } from './routes/o
 import { Route as OrgOrganizationSlugSetupAssistantRouteImport } from './routes/org.$organizationSlug_.setup.assistant'
 import { Route as OrgOrganizationSlugAppsAppIdSetupRouteImport } from './routes/org.$organizationSlug.apps.$appId_.setup'
 import { Route as OrgOrganizationSlugAppsAddIndexRouteImport } from './routes/org.$organizationSlug.apps.add.index'
-import { Route as OrgOrganizationSlugAppsAddCustomRouteImport } from './routes/org.$organizationSlug.apps.add.custom'
 import { Route as OrgOrganizationSlugWebhooksAppIdSubscriptionIdRouteImport } from './routes/org.$organizationSlug.webhooks.$appId.$subscriptionId'
 import { Route as OrgOrganizationSlugAppsAppIdApproveRequestIdRouteImport } from './routes/org.$organizationSlug.apps.$appId_.approve.$requestId'
 
@@ -174,6 +174,12 @@ const OrgOrganizationSlugAppsAppIdRoute =
     path: '/apps/$appId',
     getParentRoute: () => OrgOrganizationSlugRoute,
   } as any)
+const OrgOrganizationSlugConnectConnectionIdRoute =
+  OrgOrganizationSlugConnectConnectionIdRouteImport.update({
+    id: '/connect_/$connectionId',
+    path: '/connect/$connectionId',
+    getParentRoute: () => OrgOrganizationSlugRoute,
+  } as any)
 const OrgOrganizationSlugConnectionsConnectionIdRoute =
   OrgOrganizationSlugConnectionsConnectionIdRouteImport.update({
     id: '/connections/$connectionId',
@@ -216,12 +222,6 @@ const OrgOrganizationSlugAppsAddIndexRoute =
     path: '/apps/add/',
     getParentRoute: () => OrgOrganizationSlugRoute,
   } as any)
-const OrgOrganizationSlugAppsAddCustomRoute =
-  OrgOrganizationSlugAppsAddCustomRouteImport.update({
-    id: '/apps/add/custom',
-    path: '/apps/add/custom',
-    getParentRoute: () => OrgOrganizationSlugRoute,
-  } as any)
 const OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute =
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRouteImport.update({
     id: '/webhooks/$appId/$subscriptionId',
@@ -257,6 +257,7 @@ export interface FileRoutesByFullPath {
   '/org/$organizationSlug/': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -266,7 +267,6 @@ export interface FileRoutesByFullPath {
   '/org/$organizationSlug/apps/': typeof OrgOrganizationSlugAppsIndexRoute
   '/org/$organizationSlug/groups/': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug/apps/$appId/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add/': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -291,6 +291,7 @@ export interface FileRoutesByTo {
   '/org/$organizationSlug': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -300,7 +301,6 @@ export interface FileRoutesByTo {
   '/org/$organizationSlug/apps': typeof OrgOrganizationSlugAppsIndexRoute
   '/org/$organizationSlug/groups': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug/apps/$appId/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -328,6 +328,7 @@ export interface FileRoutesById {
   '/org/$organizationSlug/': typeof OrgOrganizationSlugIndexRoute
   '/org/$organizationSlug/approvals/$runId': typeof OrgOrganizationSlugApprovalsRunIdRoute
   '/org/$organizationSlug/apps/$appId': typeof OrgOrganizationSlugAppsAppIdRoute
+  '/org/$organizationSlug/connect_/$connectionId': typeof OrgOrganizationSlugConnectConnectionIdRoute
   '/org/$organizationSlug/connections/$connectionId': typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   '/org/$organizationSlug/groups/$groupId': typeof OrgOrganizationSlugGroupsGroupIdRoute
   '/org/$organizationSlug_/setup/accounts': typeof OrgOrganizationSlugSetupAccountsRoute
@@ -337,7 +338,6 @@ export interface FileRoutesById {
   '/org/$organizationSlug/apps/': typeof OrgOrganizationSlugAppsIndexRoute
   '/org/$organizationSlug/groups/': typeof OrgOrganizationSlugGroupsIndexRoute
   '/org/$organizationSlug/apps/$appId_/setup': typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  '/org/$organizationSlug/apps/add/custom': typeof OrgOrganizationSlugAppsAddCustomRoute
   '/org/$organizationSlug/webhooks/$appId/$subscriptionId': typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   '/org/$organizationSlug/apps/add/': typeof OrgOrganizationSlugAppsAddIndexRoute
   '/org/$organizationSlug/apps/$appId_/approve/$requestId': typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -366,6 +366,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug/setup/accounts'
@@ -375,7 +376,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/apps/'
     | '/org/$organizationSlug/groups/'
     | '/org/$organizationSlug/apps/$appId/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add/'
     | '/org/$organizationSlug/apps/$appId/approve/$requestId'
@@ -400,6 +400,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug/setup/accounts'
@@ -409,7 +410,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/apps'
     | '/org/$organizationSlug/groups'
     | '/org/$organizationSlug/apps/$appId/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add'
     | '/org/$organizationSlug/apps/$appId/approve/$requestId'
@@ -436,6 +436,7 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/'
     | '/org/$organizationSlug/approvals/$runId'
     | '/org/$organizationSlug/apps/$appId'
+    | '/org/$organizationSlug/connect_/$connectionId'
     | '/org/$organizationSlug/connections/$connectionId'
     | '/org/$organizationSlug/groups/$groupId'
     | '/org/$organizationSlug_/setup/accounts'
@@ -445,7 +446,6 @@ export interface FileRouteTypes {
     | '/org/$organizationSlug/apps/'
     | '/org/$organizationSlug/groups/'
     | '/org/$organizationSlug/apps/$appId_/setup'
-    | '/org/$organizationSlug/apps/add/custom'
     | '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
     | '/org/$organizationSlug/apps/add/'
     | '/org/$organizationSlug/apps/$appId_/approve/$requestId'
@@ -635,6 +635,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof OrgOrganizationSlugAppsAppIdRouteImport
       parentRoute: typeof OrgOrganizationSlugRoute
     }
+    '/org/$organizationSlug/connect_/$connectionId': {
+      id: '/org/$organizationSlug/connect_/$connectionId'
+      path: '/connect/$connectionId'
+      fullPath: '/org/$organizationSlug/connect/$connectionId'
+      preLoaderRoute: typeof OrgOrganizationSlugConnectConnectionIdRouteImport
+      parentRoute: typeof OrgOrganizationSlugRoute
+    }
     '/org/$organizationSlug/connections/$connectionId': {
       id: '/org/$organizationSlug/connections/$connectionId'
       path: '/connections/$connectionId'
@@ -684,13 +691,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof OrgOrganizationSlugAppsAddIndexRouteImport
       parentRoute: typeof OrgOrganizationSlugRoute
     }
-    '/org/$organizationSlug/apps/add/custom': {
-      id: '/org/$organizationSlug/apps/add/custom'
-      path: '/apps/add/custom'
-      fullPath: '/org/$organizationSlug/apps/add/custom'
-      preLoaderRoute: typeof OrgOrganizationSlugAppsAddCustomRouteImport
-      parentRoute: typeof OrgOrganizationSlugRoute
-    }
     '/org/$organizationSlug/webhooks/$appId/$subscriptionId': {
       id: '/org/$organizationSlug/webhooks/$appId/$subscriptionId'
       path: '/webhooks/$appId/$subscriptionId'
@@ -732,6 +732,7 @@ interface OrgOrganizationSlugRouteChildren {
   OrgOrganizationSlugIndexRoute: typeof OrgOrganizationSlugIndexRoute
   OrgOrganizationSlugApprovalsRunIdRoute: typeof OrgOrganizationSlugApprovalsRunIdRoute
   OrgOrganizationSlugAppsAppIdRoute: typeof OrgOrganizationSlugAppsAppIdRoute
+  OrgOrganizationSlugConnectConnectionIdRoute: typeof OrgOrganizationSlugConnectConnectionIdRoute
   OrgOrganizationSlugConnectionsConnectionIdRoute: typeof OrgOrganizationSlugConnectionsConnectionIdRoute
   OrgOrganizationSlugGroupsGroupIdRoute: typeof OrgOrganizationSlugGroupsGroupIdRoute
   OrgOrganizationSlugAccountsIndexRoute: typeof OrgOrganizationSlugAccountsIndexRoute
@@ -739,7 +740,6 @@ interface OrgOrganizationSlugRouteChildren {
   OrgOrganizationSlugAppsIndexRoute: typeof OrgOrganizationSlugAppsIndexRoute
   OrgOrganizationSlugGroupsIndexRoute: typeof OrgOrganizationSlugGroupsIndexRoute
   OrgOrganizationSlugAppsAppIdSetupRoute: typeof OrgOrganizationSlugAppsAppIdSetupRoute
-  OrgOrganizationSlugAppsAddCustomRoute: typeof OrgOrganizationSlugAppsAddCustomRoute
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute: typeof OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute
   OrgOrganizationSlugAppsAddIndexRoute: typeof OrgOrganizationSlugAppsAddIndexRoute
   OrgOrganizationSlugAppsAppIdApproveRequestIdRoute: typeof OrgOrganizationSlugAppsAppIdApproveRequestIdRoute
@@ -753,6 +753,8 @@ const OrgOrganizationSlugRouteChildren: OrgOrganizationSlugRouteChildren = {
   OrgOrganizationSlugApprovalsRunIdRoute:
     OrgOrganizationSlugApprovalsRunIdRoute,
   OrgOrganizationSlugAppsAppIdRoute: OrgOrganizationSlugAppsAppIdRoute,
+  OrgOrganizationSlugConnectConnectionIdRoute:
+    OrgOrganizationSlugConnectConnectionIdRoute,
   OrgOrganizationSlugConnectionsConnectionIdRoute:
     OrgOrganizationSlugConnectionsConnectionIdRoute,
   OrgOrganizationSlugGroupsGroupIdRoute: OrgOrganizationSlugGroupsGroupIdRoute,
@@ -763,7 +765,6 @@ const OrgOrganizationSlugRouteChildren: OrgOrganizationSlugRouteChildren = {
   OrgOrganizationSlugGroupsIndexRoute: OrgOrganizationSlugGroupsIndexRoute,
   OrgOrganizationSlugAppsAppIdSetupRoute:
     OrgOrganizationSlugAppsAppIdSetupRoute,
-  OrgOrganizationSlugAppsAddCustomRoute: OrgOrganizationSlugAppsAddCustomRoute,
   OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute:
     OrgOrganizationSlugWebhooksAppIdSubscriptionIdRoute,
   OrgOrganizationSlugAppsAddIndexRoute: OrgOrganizationSlugAppsAddIndexRoute,
diff --git a/apps/hosted/self-host/web/src/implementation/routes/account.security.tsx b/apps/hosted/self-host/web/src/implementation/routes/account.security.tsx
index cb576bd582..afe3461443 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/account.security.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/account.security.tsx
@@ -1,12 +1,20 @@
 import { createFileRoute } from "@tanstack/react-router";
+import { Option, Schema } from "effect";
 import { parseAccountSearch } from "@executor-js/hosted-web/contracts/navigation";
 import { SecurityPending } from "@executor-js/hosted-web/account";
 import { SecurityPage } from "@executor-js/hosted-web/pages/security";
 import { ChangePassword, ChangePasswordPending } from "../components/change-password.tsx";
+import { ConnectSso } from "../components/connect-sso.tsx";
 
-/** Self-host signs in with a password (or SSO); the password is changed here. */
+/**
+ * Self-host signs in with a password (or SSO); the password is changed and SSO connected here. A
+ * refused SSO connection returns with its `error` code.
+ */
 export const Route = createFileRoute("/account/security")({
-  validateSearch: parseAccountSearch,
+  validateSearch: (search: Record<string, unknown>) => ({
+    ...parseAccountSearch(search),
+    error: Option.getOrUndefined(Schema.decodeUnknownOption(Schema.NonEmptyString)(search.error)),
+  }),
   pendingComponent: () => (
     <SecurityPending>
       <ChangePasswordPending />
@@ -15,6 +23,7 @@ export const Route = createFileRoute("/account/security")({
   component: () => (
     <SecurityPage>
       <ChangePassword />
+      <ConnectSso refused={Route.useSearch().error} />
     </SecurityPage>
   ),
 });
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
index a41ef72fc5..09194f120a 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.accounts.index.tsx
@@ -1,10 +1,11 @@
 import { parseAccountsSearch } from "@executor-js/hosted-web/contracts/navigation";
 import { createFileRoute } from "@tanstack/react-router";
-import { AccountsPage } from "@executor-js/hosted-web/pages/accounts";
+import { AccountsPage, accountsPageReads } from "@executor-js/hosted-web/pages/accounts";
 
 /** Hosted account inventory. */
 export const Route = createFileRoute("/org/$organizationSlug/accounts/")({
   validateSearch: parseAccountsSearch,
+  staticData: { organizationReads: accountsPageReads },
   component: Page,
 });
 
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
index 3244f94d01..42e7e89923 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.approvals.index.tsx
@@ -1,5 +1,6 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { ApprovalsPage } from "@executor-js/hosted-web/pages/approvals";
+import { ApprovalsPage, approvalsPageReads } from "@executor-js/hosted-web/pages/approvals";
 export const Route = createFileRoute("/org/$organizationSlug/approvals/")({
   component: ApprovalsPage,
+  staticData: { organizationReads: approvalsPageReads },
 });
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx
deleted file mode 100644
index 56d60a3a0c..0000000000
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.apps.add.custom.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { CustomAppPage } from "@executor-js/hosted-web/pages/custom-app";
-
-/** Remote custom app setup is shared by both hosted products. */
-export const Route = createFileRoute("/org/$organizationSlug/apps/add/custom")({
-  component: CustomAppPage,
-});
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect.tsx
index ca6700cf11..cfd609f4eb 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect.tsx
@@ -1,4 +1,7 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { ConnectPage } from "@executor-js/hosted-web/pages/connect";
+import { ConnectPage, connectPageReads } from "@executor-js/hosted-web/pages/connect";
 
-export const Route = createFileRoute("/org/$organizationSlug/connect")({ component: ConnectPage });
+export const Route = createFileRoute("/org/$organizationSlug/connect")({
+  component: ConnectPage,
+  staticData: { organizationReads: connectPageReads },
+});
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx
new file mode 100644
index 0000000000..0402fe0521
--- /dev/null
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.connect_.$connectionId.tsx
@@ -0,0 +1,7 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { ConnectionPage, connectionPageReads } from "@executor-js/hosted-web/pages/connect";
+
+export const Route = createFileRoute("/org/$organizationSlug/connect_/$connectionId")({
+  component: () => <ConnectionPage connectionId={Route.useParams().connectionId} />,
+  staticData: { organizationReads: connectionPageReads },
+});
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
index 89c82cb06a..8d29c79612 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.$groupId.tsx
@@ -1,7 +1,8 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { GroupsPage } from "@executor-js/hosted-web/pages/groups";
+import { GroupsPage, groupsPageReads } from "@executor-js/hosted-web/pages/groups";
 
 /** Group membership detail stays scoped to the organization route. */
 export const Route = createFileRoute("/org/$organizationSlug/groups/$groupId")({
   component: () => <GroupsPage id={Route.useParams().groupId} />,
+  staticData: { organizationReads: groupsPageReads },
 });
diff --git a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
index 23a05196d7..56905d47e5 100644
--- a/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
+++ b/apps/hosted/self-host/web/src/implementation/routes/org.$organizationSlug.groups.index.tsx
@@ -1,5 +1,8 @@
 import { createFileRoute } from "@tanstack/react-router";
-import { GroupsPage } from "@executor-js/hosted-web/pages/groups";
+import { GroupsPage, groupsPageReads } from "@executor-js/hosted-web/pages/groups";
 
 /** Group directory shared by hosted products. */
-export const Route = createFileRoute("/org/$organizationSlug/groups/")({ component: GroupsPage });
+export const Route = createFileRoute("/org/$organizationSlug/groups/")({
+  component: GroupsPage,
+  staticData: { organizationReads: groupsPageReads },
+});
diff --git a/apps/hosted/server/scripts/check-better-auth-security.mjs b/apps/hosted/server/scripts/check-better-auth-security.mjs
new file mode 100644
index 0000000000..d0c5bfe95a
--- /dev/null
+++ b/apps/hosted/server/scripts/check-better-auth-security.mjs
@@ -0,0 +1,176 @@
+import assert from "node:assert/strict";
+import { DatabaseSync } from "node:sqlite";
+import { betterAuth } from "better-auth";
+import { applySetCookies, splitSetCookieHeader } from "better-auth/cookies";
+import { getMigrations } from "better-auth/db/migration";
+import { admin } from "better-auth/plugins/admin";
+import { getGooglePublicKey, github } from "better-auth/social-providers";
+
+const redirectedJwk = {
+  kty: "RSA",
+  n: "z1SP_mnWgCxTAEptaVgsCGCfjPCV0nOHu5iqmLtANbVQJlcl-XgGKSyoPcBFn6IJ4Q8nGBhrWhugYqnl3ZhffW8YtAJb-XgZqfLNVrRDcMjV7tlEP5QcGxKlqjGatvSntg_6iXMNG59_GVEZVN3RVMblqp0Btzxp3Kwaz8mvC8aS8KoaUFJ1sp8rscQOVO2XuCDud39wlLQ8ommqXF3YV6k8EkwWFVkrV956tsRlI0i_u7mFPIjlGLpIPzGApYyNxJz-Zeeki3Jwod6dDcDq6enFUZ_e7sSF3y_a14Ai6ED3i14TzMgXrX_Uq-_Bzr1R8IakIO30CLsDo5lV_6BCFw",
+  e: "AQAB",
+  alg: "RS256",
+  kid: "redirected-key",
+};
+
+const redirect = () =>
+  new Response(null, {
+    status: 307,
+    headers: { location: "https://redirect-target.invalid/collect" },
+  });
+
+const opaqueRedirect = () => {
+  const response = new Response(null);
+  Object.defineProperties(response, {
+    ok: { value: false },
+    status: { value: 0 },
+    type: { value: "opaqueredirect" },
+  });
+  return response;
+};
+
+const provider = github({ clientId: "synthetic-client", clientSecret: "synthetic-secret" });
+const originalFetch = globalThis.fetch;
+const followed = [];
+globalThis.fetch = async (input, init) => {
+  const url = input instanceof Request ? input.url : String(input);
+  assert.equal(init?.redirect, "manual");
+  if (init.redirect === "manual") return redirect();
+  followed.push(url);
+  return Response.json({ access_token: "redirected-access", token_type: "bearer" });
+};
+try {
+  await assert.rejects(
+    provider.validateAuthorizationCode({
+      code: "synthetic-code",
+      codeVerifier: "synthetic-verifier",
+      redirectURI: "https://executor.example/api/auth/callback/github",
+    }),
+    /returned an HTTP redirect/u,
+  );
+  await assert.rejects(getGooglePublicKey(redirectedJwk.kid), /returned an HTTP redirect/u);
+  assert.deepEqual(followed, []);
+} finally {
+  globalThis.fetch = originalFetch;
+}
+
+globalThis.fetch = async () => opaqueRedirect();
+try {
+  await assert.rejects(
+    provider.validateAuthorizationCode({
+      code: "synthetic-code",
+      codeVerifier: "synthetic-verifier",
+      redirectURI: "https://executor.example/api/auth/callback/github",
+    }),
+    /returned an HTTP redirect/u,
+  );
+} finally {
+  globalThis.fetch = originalFetch;
+}
+
+const fetched = [];
+globalThis.fetch = async (input, init) => {
+  assert.equal(init?.redirect, "manual");
+  const url = input instanceof Request ? input.url : String(input);
+  fetched.push(url);
+  if (url === "https://github.com/login/oauth/access_token") {
+    return Response.json({ access_token: "direct-access", token_type: "bearer" });
+  }
+  assert.equal(url, "https://www.googleapis.com/oauth2/v3/certs");
+  return Response.json({ keys: [redirectedJwk] });
+};
+try {
+  assert.equal(
+    (
+      await provider.validateAuthorizationCode({
+        code: "synthetic-code",
+        codeVerifier: "synthetic-verifier",
+        redirectURI: "https://executor.example/api/auth/callback/github",
+      })
+    ).accessToken,
+    "direct-access",
+  );
+  assert.ok(await getGooglePublicKey(redirectedJwk.kid));
+  assert.deepEqual(fetched, [
+    "https://github.com/login/oauth/access_token",
+    "https://www.googleapis.com/oauth2/v3/certs",
+  ]);
+} finally {
+  globalThis.fetch = originalFetch;
+}
+
+const database = new DatabaseSync(":memory:");
+const authOptions = {
+  baseURL: "http://localhost:3000",
+  database,
+  emailAndPassword: { enabled: true },
+  plugins: [admin()],
+  rateLimit: { enabled: false },
+  secret: "synthetic-secret-that-is-long-enough-for-better-auth",
+};
+await (await getMigrations(authOptions)).runMigrations();
+const auth = betterAuth(authOptions);
+await auth.api.signUpEmail({
+  body: {
+    email: "admin@example.test",
+    name: "Admin",
+    password: "synthetic-password",
+  },
+});
+const context = await auth.$context;
+const adminUser = (await context.internalAdapter.findUserByEmail("admin@example.test"))?.user;
+assert.ok(adminUser);
+await context.internalAdapter.updateUser(adminUser.id, { role: "admin" });
+const signedIn = await auth.api.signInEmail({
+  body: { email: "admin@example.test", password: "synthetic-password" },
+  returnHeaders: true,
+});
+const headers = new Headers();
+applySetCookies(headers, splitSetCookieHeader(signedIn.headers.get("set-cookie") ?? ""));
+
+const target = await context.internalAdapter.createUser(
+  {
+    email: "security-control@example.test",
+    emailVerified: false,
+    name: "Security Control",
+  },
+  { method: "admin" },
+);
+await assert.rejects(
+  auth.api.adminUpdateUser({
+    body: { userId: target.id, data: { id: "replacement-user-id" } },
+    headers,
+  }),
+  (error) => error?.body?.code === "USER_ID_CANNOT_BE_UPDATED",
+);
+assert.ok(await context.internalAdapter.findUserById(target.id));
+assert.equal(await context.internalAdapter.findUserById("replacement-user-id"), null);
+
+const updated = await auth.api.adminUpdateUser({
+  body: { userId: target.id, data: { name: "Updated Security Control" } },
+  headers,
+});
+assert.equal(updated.name, "Updated Security Control");
+
+await context.internalAdapter.updateUser(target.id, { banned: true });
+await assert.rejects(
+  context.internalAdapter.createSession(target.id),
+  (error) => error?.body?.code === "BANNED_USER",
+);
+await context.internalAdapter.updateUser(target.id, {
+  banned: true,
+  banExpires: new Date(Date.now() - 1_000),
+  banReason: "expired control",
+});
+assert.equal((await context.internalAdapter.createSession(target.id)).userId, target.id);
+assert.deepEqual(
+  {
+    banned: (await context.internalAdapter.findUserById(target.id))?.banned,
+    banExpires: (await context.internalAdapter.findUserById(target.id))?.banExpires,
+    banReason: (await context.internalAdapter.findUserById(target.id))?.banReason,
+  },
+  { banned: false, banExpires: null, banReason: null },
+);
+database.close();
+console.log("Better Auth security boundaries passed.");
diff --git a/apps/hosted/server/src/contracts/api.ts b/apps/hosted/server/src/contracts/api.ts
index 9f541eed7a..f1d6acfd3d 100644
--- a/apps/hosted/server/src/contracts/api.ts
+++ b/apps/hosted/server/src/contracts/api.ts
@@ -6,6 +6,7 @@ import { HostedAppAccess, HostedAppManagementApi, HostedFrameworkApi } from "./a
 export { HostedAppManagementApi } from "./app-management.ts";
 /** Common hosted contracts. Product reads require a hosted session. */
 import { CatalogEntry, CatalogQuery, CatalogUnavailable } from "@executor-js/catalog/contracts";
+import { RequestRejection } from "@executor-js/sdk/core";
 import { Context, Schema } from "effect";
 import { HostedGroups } from "./groups.ts";
 import { HostedMcpConnections } from "./mcp-connections.ts";
@@ -74,6 +75,11 @@ export const hostedApiDocument = <Id extends string, Groups extends HttpApiGroup
     onEndpoint: ({ endpoint, group, middleware, mergedAnnotations }) => {
       if (Context.get(mergedAnnotations, OpenApi.Exclude))
         throw new Error("Product API endpoints must appear in OpenAPI.");
+      // Agents read each operation's declared errors; an undeclared 400 reaches them without its cause.
+      if (![...middleware].some((service) => service.key === RequestRejection.key))
+        throw new Error(
+          `Product API endpoint ${group.identifier}.${endpoint.identifier} must declare request rejections.`,
+        );
       const id = Context.getOrElse(endpoint.annotations, OpenApi.Identifier, () =>
         group.topLevel ? endpoint.identifier : `${group.identifier}.${endpoint.identifier}`,
       );
@@ -222,4 +228,5 @@ export const HostedApi = HttpApi.make("executor-hosted")
       .middleware(RequireUser),
   )
   .addHttpApi(HostedAppManagementApi)
-  .addHttpApi(HostedFrameworkApi);
+  .addHttpApi(HostedFrameworkApi)
+  .middleware(RequestRejection);
diff --git a/apps/hosted/server/src/contracts/app-ui.ts b/apps/hosted/server/src/contracts/app-ui.ts
index 31bce589f1..78d4a8a467 100644
--- a/apps/hosted/server/src/contracts/app-ui.ts
+++ b/apps/hosted/server/src/contracts/app-ui.ts
@@ -7,6 +7,7 @@ import {
   AppNotFound,
   VersionNotFound,
   HttpUrl,
+  RequestRejection,
   StorageError,
   type Runtime,
 } from "@executor-js/sdk/core";
@@ -212,4 +213,6 @@ export const HostedAppUi = HttpApiGroup.make("appUi").add(
     .middleware(RequireOrganization),
 );
 /** A browser client can consume the same narrow contract without importing a host's full API. */
-export const HostedAppUiApi = HttpApi.make("executor-hosted").add(HostedAppUi);
+export const HostedAppUiApi = HttpApi.make("executor-hosted")
+  .add(HostedAppUi)
+  .middleware(RequestRejection);
diff --git a/apps/hosted/server/src/contracts/auth.ts b/apps/hosted/server/src/contracts/auth.ts
index 3e0abae2ff..f3e79e1b12 100644
--- a/apps/hosted/server/src/contracts/auth.ts
+++ b/apps/hosted/server/src/contracts/auth.ts
@@ -167,6 +167,17 @@ export class Authentication extends Context.Service<
  */
 export const CurrentUserId = CurrentActor;
 
+/**
+ * What a request's spans record about its caller once the organization is known to be the
+ * caller's own: the organization's opaque ID and the caller's Better Auth user ID, never an
+ * email, a name or a slug. Both are recorded together, so a span names a user only where it names
+ * that user's organization, and a request refused for another organization names neither.
+ */
+export const callerSpanAttributes = (organization: string, user: string) => ({
+  "executor.organization.id": organization,
+  "executor.user.id": user,
+});
+
 /** Request-local identity supplied only after successful authentication. */
 export class CurrentPrincipal extends Context.Service<CurrentPrincipal, Principal>()(
   "hosted/CurrentPrincipal",
diff --git a/apps/hosted/server/src/contracts/organization-defaults.ts b/apps/hosted/server/src/contracts/organization-defaults.ts
index 2bfb777679..d1b931bb0f 100644
--- a/apps/hosted/server/src/contracts/organization-defaults.ts
+++ b/apps/hosted/server/src/contracts/organization-defaults.ts
@@ -62,8 +62,8 @@ export interface ExecutorUserAccount {
 
 /**
  * One-time product setup; installed apps retain their ordinary lifecycle afterward. Setup that
- * saves webhook source intent, an upgrade or a new link, wakes source reconciliation through the
- * caller's {@link ScheduleWakeup}.
+ * saves webhook source intent, a new link, wakes source reconciliation through the caller's
+ * {@link ScheduleWakeup}.
  */
 export class OrganizationDefaults extends Context.Service<
   OrganizationDefaults,
diff --git a/apps/hosted/server/src/contracts/organization.ts b/apps/hosted/server/src/contracts/organization.ts
index 6919abcdff..29008d1103 100644
--- a/apps/hosted/server/src/contracts/organization.ts
+++ b/apps/hosted/server/src/contracts/organization.ts
@@ -19,6 +19,7 @@ import {
   OwnerId,
   HttpUrl,
   StorageError,
+  publishingDomain,
 } from "@executor-js/sdk/core";
 import {
   OrganizationIconUrl,
@@ -112,8 +113,6 @@ export type OrganizationForbidden = typeof OrganizationForbidden.Type;
 export class CurrentOrganization extends Context.Service<CurrentOrganization, OrganizationAccess>()(
   "hosted/CurrentOrganization",
 ) {}
-/** Public packages are published under the organization's current slug on this domain. */
-export const publishingDomain = "executor.community";
 /** An organization's publishing scope. It follows renames; the slug it had is free to reuse. */
 export const publishingScope = (slug: string) => `${slug}.${publishingDomain}`;
 /** The slug a publishing scope names, or undefined for a scope on another domain. */
diff --git a/apps/hosted/server/src/contracts/setup.ts b/apps/hosted/server/src/contracts/setup.ts
index ba52b03042..1996739f26 100644
--- a/apps/hosted/server/src/contracts/setup.ts
+++ b/apps/hosted/server/src/contracts/setup.ts
@@ -7,3 +7,15 @@ import { Schema } from "effect";
  */
 export const SetupOrder = Schema.Literals(["accounts_first", "assistant_first"]);
 export type SetupOrder = typeof SetupOrder.Type;
+
+/**
+ * Whether a new team's setup steps can be skipped. Cloud's onboarding skip experiment assigns one
+ * to each member creating their first team through team setup: `required` steps only move on once
+ * done, and the dashboard waits until both are. Every other member, and every other host, can skip.
+ */
+export const SetupSkip = Schema.Literals(["skippable", "required"]);
+export type SetupSkip = typeof SetupSkip.Type;
+
+/** The two steps before the first prompt. */
+export const SetupStep = Schema.Literals(["accounts", "assistant"]);
+export type SetupStep = typeof SetupStep.Type;
diff --git a/apps/hosted/server/src/implementation/access.ts b/apps/hosted/server/src/implementation/access.ts
index 050fdb835f..9ebdf7b5f0 100644
--- a/apps/hosted/server/src/implementation/access.ts
+++ b/apps/hosted/server/src/implementation/access.ts
@@ -433,8 +433,18 @@ const checkAppLinked = (app: AppId, linked: AppAccounts["app"]) =>
  * links now is still checked by the caller's use.
  */
 export const checkScopedAccounts = (owner: OwnerId, app: AppId, accounts: AppAccounts) =>
+  Effect.flatMap(currentResourceAuthority, (actor) =>
+    checkScopedAccountsAs(actor, owner, app, accounts),
+  );
+/** {@link checkScopedAccounts} for an actor already resolved in this operation. */
+export const checkScopedAccountsAs = (
+  actor: ResourceAuthority,
+  owner: OwnerId,
+  app: AppId,
+  accounts: AppAccounts,
+) =>
   Effect.gen(function* () {
-    yield* checkAccounts(owner, accounts.user ?? {});
+    yield* checkAccountsAs(actor, owner, accounts.user ?? {});
     yield* checkAppLinked(app, accounts.app);
   });
 /** Pending approvals retain their original accounts even if the caller's links later change. */
diff --git a/apps/hosted/server/src/implementation/accounts.ts b/apps/hosted/server/src/implementation/accounts.ts
index b05a2108bb..61b2efdcc4 100644
--- a/apps/hosted/server/src/implementation/accounts.ts
+++ b/apps/hosted/server/src/implementation/accounts.ts
@@ -48,6 +48,7 @@ import { HostedExecutor } from "../contracts/executor.ts";
 import { currentOwner, ownedConnection } from "./access.ts";
 import { appLinkApps, appLinkedAccounts, callerLinkedAccounts } from "./app-accounts.ts";
 import { AccountLinkedToApp } from "../contracts/accounts.ts";
+import { visibleAccountRefusal } from "./webhooks.ts";
 import { RequirementMismatch } from "../contracts/app-accounts.ts";
 
 /** The apps the caller can use and linked this account to, or that link it for everyone. */
@@ -163,7 +164,8 @@ export const oauthSetup = (
 /**
  * Delete saved credentials and remove their user links through the transactional lifecycle hook.
  * An account linked to an app for everyone is refused until it is unlinked: the app uses it for
- * every caller.
+ * every caller. One a webhook subscription holds is refused naming only the holders the caller
+ * may see.
  */
 export const disconnectAccount = Effect.gen(function* () {
   const { owner, account } = yield* AccountGrants.delete;
@@ -172,7 +174,13 @@ export const disconnectAccount = Effect.gen(function* () {
   const [first, ...rest] = yield* appLinkApps(yield* policyDatabase, account);
   if (first !== undefined)
     return yield* new AccountLinkedToApp({ account, apps: [first, ...rest] });
-  return yield* executor.accounts.remove({ owner, account });
+  return yield* executor.accounts
+    .remove({ owner, account })
+    .pipe(
+      Effect.catchTag("AccountWebhooksActive", (refusal) =>
+        Effect.flatMap(visibleAccountRefusal(executor, refusal), Effect.fail),
+      ),
+    );
 });
 /** Update the label or description using the owner-filtered SDK primitive. */
 export const updateAccount = (metadata: {
diff --git a/apps/hosted/server/src/implementation/api-document.ts b/apps/hosted/server/src/implementation/api-document.ts
index 2d5d5bdb87..5e10146dd9 100644
--- a/apps/hosted/server/src/implementation/api-document.ts
+++ b/apps/hosted/server/src/implementation/api-document.ts
@@ -1,5 +1,7 @@
-import { Effect } from "effect";
+import { Crypto, Effect } from "effect";
+import { Hex } from "effect/encoding";
 import { HttpRouter, HttpServerResponse } from "effect/http";
+import type { HostApi } from "@executor-js/sdk/core";
 import type { HostedApiDocument } from "../contracts/api.ts";
 
 /** The product document and its /openapi.json body, each computed on first use. */
@@ -34,3 +36,36 @@ export const hostedApiDocumentRoute = (api: LazyHostedApiDocument) =>
       HttpServerResponse.text(body, { contentType: "application/json" }),
     ),
   );
+
+/**
+ * The revision of the API served at /openapi.json: the SHA-256 of the exact body, as `LazyHostedApiDocument`
+ * serves it. Apps' outbound network computes the same digest of the document they fetch and
+ * refuses one whose revision their cache does not belong to; see `HostApiCheck` in the SDK.
+ */
+export const hostedApiRevision = (body: string) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) =>
+    crypto.digest("SHA-256", new TextEncoder().encode(body)),
+  ).pipe(Effect.map(Hex.encode), Effect.orDie);
+
+/**
+ * This installation's API as the apps that sign in to it read it. Executor apps declare a provider
+ * that discovers OAuth at `<origin>/api` for one of `origins`, the API's resource origins, and read
+ * the document at `<origin>/openapi.json`.
+ */
+export const hostedApi = (origins: ReadonlyArray<string>, revision: string): HostApi => {
+  const discovery = new Set(origins.map((origin) => `${origin}/api`));
+  return {
+    revision,
+    documents: origins.map((origin) => `${origin}/openapi.json`),
+    reads: (requirements) =>
+      Object.values(requirements.accounts).some(({ definition }) =>
+        Object.values(definition.auth).some(
+          (method) =>
+            method.type === "oauth2" &&
+            "discover" in method &&
+            method.discover !== undefined &&
+            discovery.has(method.discover),
+        ),
+      ),
+  };
+};
diff --git a/apps/hosted/server/src/implementation/api.ts b/apps/hosted/server/src/implementation/api.ts
index b3d8f665d3..98666a8c28 100644
--- a/apps/hosted/server/src/implementation/api.ts
+++ b/apps/hosted/server/src/implementation/api.ts
@@ -10,6 +10,7 @@ import { hostedResourceAccessHandlers } from "./resource-access.ts";
 import { hostedOAuthClientHandlers } from "./oauth-clients.ts";
 import { hostedScheduleHandlers } from "./schedules.ts";
 /** Shared hosted handlers. No Cloudflare, Node, or local-product dependencies. */
+import { requestRejections } from "@executor-js/sdk/core";
 import { Effect, Layer } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HttpServerRequest } from "effect/http";
@@ -99,4 +100,4 @@ export const hostedHandlers = Layer.mergeAll(
       }),
     ),
   ),
-);
+).pipe(Layer.provide(requestRejections));
diff --git a/apps/hosted/server/src/implementation/app-ui.ts b/apps/hosted/server/src/implementation/app-ui.ts
index 67e5595bcf..12d38e6d6d 100644
--- a/apps/hosted/server/src/implementation/app-ui.ts
+++ b/apps/hosted/server/src/implementation/app-ui.ts
@@ -24,6 +24,7 @@ import {
   type AppDataInput,
   type App,
   type VersionMetadata,
+  requestRejections,
 } from "@executor-js/sdk/core";
 import {
   AppSignInCallback,
@@ -44,10 +45,10 @@ import {
   UiForbidden,
   UiUnauthorized,
 } from "apps/ui/contracts";
-import { appAsset, appDocument, appWatchScript, assetPath, storedAppFile } from "apps/ui/serving";
+import { appAsset, appDocument, appFile, assetPath, storedAppFile } from "apps/ui/serving";
 import { receiveBrowserTelemetry } from "@executor-js/telemetry/http";
 import { currentTraceContext, recordRoute } from "@executor-js/telemetry";
-import { Clock, Context, Effect, Option, Redacted, Schema, Stream } from "effect";
+import { Clock, Context, Effect, Layer, Option, Redacted, Schema, Stream } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import {
@@ -339,7 +340,7 @@ export const hostedAppUi = <R = never>(
         return status === "ready" ? { status, url } : { status, url: null };
       }),
     ),
-  );
+  ).pipe(Layer.provide(requestRejections));
   const dataFailure = (error: unknown) =>
     Schema.is(OrganizationForbidden)(error)
       ? new UiForbidden()
@@ -569,15 +570,6 @@ export const hostedAppUi = <R = never>(
         HttpServerResponse.text("App unavailable.", { status: 422, headers: appPrivateHeaders }),
       ),
   });
-  const watch = authorize.pipe(
-    Effect.as(
-      HttpServerResponse.text(appWatchScript, {
-        contentType: "text/javascript",
-        headers: appPrivateHeaders,
-      }),
-    ),
-    htmlFailure,
-  );
   const versions = Effect.gen(function* () {
     const current = yield* authorize;
     const request = yield* HttpServerRequest.HttpServerRequest;
@@ -639,6 +631,12 @@ export const hostedAppUi = <R = never>(
     if (Option.isNone(authorized)) return yield* beginSignIn(resolved);
     const current = authorized.value;
     const version = yield* readVersion(current.app);
+    // A file needs no accounts, and fetching one is no app view.
+    const file = yield* appFile({
+      origin: current.target.origin,
+      asset: (path) => assets(version, path),
+    });
+    if (Option.isSome(file)) return file.value;
     const executor = yield* Effect.flatten(HostedExecutor).pipe(Effect.mapError(unavailable));
     const asCaller = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
       effect.pipe(
@@ -653,29 +651,31 @@ export const hostedAppUi = <R = never>(
     fix.searchParams.set("view", "accounts");
     // The page runs with the app's linked accounts and the caller's linked accounts; a plain
     // requirement with none shows what to link.
-    const resolution = yield* callerAccounts(current.app).pipe(
-      asCaller,
-      Effect.map((accounts) => ({ kind: "resolved" as const, accounts })),
-      Effect.catchTag("AccountRequired", (error) =>
-        Effect.succeed({ kind: "missing" as const, slot: error.slot }),
-      ),
-      Effect.mapError((error) =>
-        Schema.is(OrganizationForbidden)(error) ? new UiForbidden() : unavailable(),
-      ),
-    );
-    const accounts = resolution.kind === "resolved" ? resolution.accounts : undefined;
-    const accountNotice = Effect.gen(function* () {
+    const accountReads = Effect.gen(function* () {
+      const resolution = yield* callerAccounts(current.app).pipe(
+        asCaller,
+        Effect.map((accounts) => ({ kind: "resolved" as const, accounts })),
+        Effect.catchTag("AccountRequired", (error) =>
+          Effect.succeed({ kind: "missing" as const, slot: error.slot }),
+        ),
+        Effect.mapError((error) =>
+          Schema.is(OrganizationForbidden)(error) ? new UiForbidden() : unavailable(),
+        ),
+      );
       if (resolution.kind === "missing") {
         const requirement = current.app.requirements.accounts[resolution.slot];
         if (requirement === undefined) return yield* unavailable();
         return {
-          app: current.app.name,
-          problems: [{ provider: requirement.definition.name, reason: "missing" as const }],
-          fix: fix.href,
+          accounts: undefined,
+          notice: {
+            app: current.app.name,
+            problems: [{ provider: requirement.definition.name, reason: "missing" as const }],
+            fix: fix.href,
+          },
         };
       }
       const used = accountIds(resolution.accounts);
-      if (used.length === 0) return undefined;
+      if (used.length === 0) return { accounts: resolution.accounts, notice: undefined };
       const found = yield* Effect.forEach(used, (account) =>
         Effect.all({
           account: executor.accounts.get({ owner: current.access.owner, account }),
@@ -691,16 +691,24 @@ export const hostedAppUi = <R = never>(
         ),
       );
       const problems = accountProblems(current.app, resolution.accounts, new Map(found.flat()));
-      if (problems.length === 0) return undefined;
-      return { app: current.app.name, problems, fix: fix.href };
+      return {
+        accounts: resolution.accounts,
+        notice:
+          problems.length === 0 ? undefined : { app: current.app.name, problems, fix: fix.href },
+      };
     });
+    // The document's read needs only the version and no SQL, so it runs beside the account
+    // reads. Its failure counts only where the document reads it, as before.
+    const [{ accounts, notice }, index] = yield* Effect.all(
+      [accountReads, Effect.exit(assets(version, "index.html"))],
+      { concurrency: 2 },
+    );
     const document = yield* appDocument({
       // The page names the caller's own accounts; the app's are not theirs to see.
       accountIds: accounts?.user,
-      accounts: yield* accountNotice,
-      origin: current.target.origin,
+      accounts: notice,
       version: version.id,
-      asset: (path) => assets(version, path),
+      asset: (path) => (path === "index.html" ? index : assets(version, path)),
     });
     yield* recordUsage("app_viewed", { app_id: current.app.id, version_id: version.id }).pipe(
       Effect.provideService(CurrentUserId, current.access.userId),
@@ -789,7 +797,6 @@ export const hostedAppUi = <R = never>(
     calls,
     page,
     asset,
-    watch,
     versions,
     originAccess,
     sessionAccess,
diff --git a/apps/hosted/server/src/implementation/auth.ts b/apps/hosted/server/src/implementation/auth.ts
index 5fe9a7879e..ec273deaf6 100644
--- a/apps/hosted/server/src/implementation/auth.ts
+++ b/apps/hosted/server/src/implementation/auth.ts
@@ -1,4 +1,5 @@
 import { apiKeys, apiKeyManagement } from "./api-keys.ts";
+import { requestAuthentication } from "./batch-authentication.ts";
 import {
   CurrentUsage,
   isReadMethod,
@@ -159,7 +160,8 @@ export const requireUserLive = Layer.effect(
         ) {
           return yield* Effect.fail(new Forbidden());
         }
-        const principal = yield* auth.current(new Headers(request.headers));
+        const identity = yield* requestAuthentication(auth);
+        const principal = yield* identity.current(new Headers(request.headers));
         if (principal === null) return yield* Effect.fail(new Unauthorized());
         const operation = {
           area: group.identifier,
diff --git a/apps/hosted/server/src/implementation/batch-authentication.ts b/apps/hosted/server/src/implementation/batch-authentication.ts
new file mode 100644
index 0000000000..c120d546fe
--- /dev/null
+++ b/apps/hosted/server/src/implementation/batch-authentication.ts
@@ -0,0 +1,88 @@
+import { dashboardBatchPath, maxBatchReads } from "@executor-js/dashboard-start/batch";
+import { Cache, Context, Data, Duration, Effect, Exit, Option } from "effect";
+import { HttpRouter, HttpServerRequest } from "effect/http";
+import { Authentication, type Principal } from "../contracts/auth.ts";
+import { OrganizationTombstones } from "../contracts/organization-removal.ts";
+import type { OrganizationId } from "../contracts/organization.ts";
+
+const BatchAuthentication = Context.Reference<typeof Authentication.Service | undefined>(
+  "hosted/BatchAuthentication",
+  { defaultValue: () => undefined },
+);
+const BatchTombstones = Context.Reference<typeof OrganizationTombstones.Service | undefined>(
+  "hosted/BatchTombstones",
+  { defaultValue: () => undefined },
+);
+
+class Membership extends Data.Class<{
+  readonly principal: Principal;
+  readonly organization: OrganizationId;
+}> {}
+
+/**
+ * Keep an answer for the rest of the batch, but not a failure: a read after a failed lookup asks
+ * again, as it would in a request of its own. Reads already waiting on the lookup share its result.
+ */
+const answersOnly = (exit: Exit.Exit<unknown, unknown>) =>
+  Exit.isSuccess(exit) ? Duration.infinity : Duration.zero;
+
+/** A batch's reads all carry its one identity; other requests use the native checks. */
+export const requestAuthentication = (native: typeof Authentication.Service) =>
+  Effect.map(BatchAuthentication, (batch) => batch ?? native);
+
+export const requestTombstones = Effect.gen(function* () {
+  return (yield* BatchTombstones) ?? (yield* OrganizationTombstones);
+});
+
+/**
+ * Share pending and completed identity reads only inside one dashboard batch. The router's
+ * streaming response captures this context, so every read shares it until the batch ends.
+ * Resource permissions still run in each endpoint, and the next request reads authority again.
+ */
+export const batchAuthentication = HttpRouter.middleware(
+  Effect.gen(function* () {
+    const native = yield* Authentication;
+    const tombstones = yield* OrganizationTombstones;
+    return (handler) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = HttpServerRequest.toURL(request);
+        if (
+          request.method !== "POST" ||
+          Option.isNone(url) ||
+          url.value.pathname !== dashboardBatchPath ||
+          request.headers.authorization !== undefined
+        )
+          return yield* handler;
+        const headers = new Headers(request.headers);
+        const sessions = yield* Cache.makeWith(() => native.current(headers), {
+          capacity: 1,
+          timeToLive: answersOnly,
+        });
+        const organizations = yield* Cache.makeWith(native.organization, {
+          capacity: maxBatchReads,
+          timeToLive: answersOnly,
+        });
+        const memberships = yield* Cache.makeWith(
+          ({ principal, organization }: Membership) => native.membership(principal, organization),
+          { capacity: maxBatchReads, timeToLive: answersOnly },
+        );
+        const removed = yield* Cache.makeWith(tombstones, {
+          capacity: maxBatchReads,
+          timeToLive: answersOnly,
+        });
+        return yield* handler.pipe(
+          Effect.provideService(BatchAuthentication, {
+            ...native,
+            current: () => Cache.get(sessions, undefined),
+            organization: (reference) => Cache.get(organizations, reference),
+            membership: (principal, organization) =>
+              Cache.get(memberships, new Membership({ principal, organization })),
+          }),
+          Effect.provideService(BatchTombstones, (organization) =>
+            Cache.get(removed, organization),
+          ),
+        );
+      });
+  }),
+);
diff --git a/apps/hosted/server/src/implementation/bearer-access.ts b/apps/hosted/server/src/implementation/bearer-access.ts
index 62779fe97e..992248ec6c 100644
--- a/apps/hosted/server/src/implementation/bearer-access.ts
+++ b/apps/hosted/server/src/implementation/bearer-access.ts
@@ -41,6 +41,7 @@ import {
   AuthenticationUnavailable,
   ConnectionKeyRefused,
   Unauthorized,
+  callerSpanAttributes,
 } from "../contracts/auth.ts";
 import { OrganizationForbidden } from "../contracts/organization.ts";
 import { isApiKey } from "./api-keys.ts";
@@ -154,6 +155,17 @@ const requestedOrganization = (
     return byUrl ?? byHeader;
   });
 
+/**
+ * Name the caller's own organization and the caller on the caller's span (`auth.authenticate`), by
+ * their opaque IDs, once the check knows the organization is theirs, so a refusal after this point
+ * still names both: an OAuth grant's organization and user, or a pinned key's organization and its
+ * user, from when the statement answers, and the organization an unpinned key names only after its
+ * user's membership there holds. Neither is recorded before then, so refused requests for another
+ * organization never count against it, nor count their user among its users.
+ */
+const recordCaller = (organization: string, user: string) =>
+  Effect.annotateCurrentSpan(callerSpanAttributes(organization, user));
+
 /** Organizations matching a reference by ID or slug; two rows prove the reference ambiguous. */
 const matches = (sql: SqlClient.SqlClient, reference: string | null) =>
   sql`(select coalesce(json_agg(o.id), '[]'::json)::text from (
@@ -357,6 +369,9 @@ const oauthAccess = (
     const organization = yield* Schema.decodeUnknownEffect(OrganizationId)(row.grantResource).pipe(
       Effect.mapError(() => forbidden("membership")),
     );
+    // The grant's organization and user are the caller's own, whatever organization the request
+    // names; the grant's user is the token's subject (checked above).
+    yield* recordCaller(organization, row.subject);
     const role = yield* Schema.decodeUnknownEffect(OrganizationRole)(row.role).pipe(
       Effect.mapError(() => forbidden("membership")),
     );
@@ -525,6 +540,9 @@ const patAccess = (sql: SqlClient.SqlClient, token: string, request: BearerReque
       Effect.mapError(() => unauthorized),
     );
     const pinned = metadata?.organization;
+    // A pinned key's organization is its own, so a refusal from here on names that one and the
+    // key's user, never another organization the request names.
+    if (pinned !== undefined) yield* recordCaller(pinned, row.userId);
     // The named organization, else the one the key is pinned to.
     const organization =
       (yield* requestedOrganization(
@@ -544,6 +562,8 @@ const patAccess = (sql: SqlClient.SqlClient, token: string, request: BearerReque
     const role = yield* Schema.decodeUnknownEffect(OrganizationRole)(membership?.role).pipe(
       Effect.mapError(() => forbidden("membership")),
     );
+    // An unpinned key can name any organization; it is the caller's own once membership holds.
+    if (pinned === undefined) yield* recordCaller(organization, row.userId);
     return {
       userId: row.userId,
       email: row.userEmail ?? null,
diff --git a/apps/hosted/server/src/implementation/events.ts b/apps/hosted/server/src/implementation/events.ts
index aa21518685..6bdca017d4 100644
--- a/apps/hosted/server/src/implementation/events.ts
+++ b/apps/hosted/server/src/implementation/events.ts
@@ -18,11 +18,7 @@ import { GroupDatabase } from "../contracts/groups.ts";
 import { OrganizationId, organizationOwner } from "../contracts/organization.ts";
 import { patGrantOf } from "./mcp-oauth.ts";
 import { patConnectionPolicy } from "./bearer-access.ts";
-import {
-  requireAccountAccessAs,
-  requireAppAccessAs,
-  resourceAuthority,
-} from "./resource-policy.ts";
+import { accountAccesses, resourceAuthorityForApp } from "./resource-policy.ts";
 
 const GrantRow = Schema.Struct({
   userId: Schema.String,
@@ -125,18 +121,21 @@ export const hostedEventAuthority =
       const access = grantEventAccess(standing.value.policy, subscription.app, subscription.event);
       if (access === undefined) return yield* new EventAccessRevoked();
       const revoked = () => Effect.fail(new EventAccessRevoked());
-      const actor = yield* resourceAuthority(
+      const { actor, access: app } = yield* resourceAuthorityForApp(
         standing.value.organization,
         standing.value.userId,
+        subscription.app,
       ).pipe(Effect.catchTag("OrganizationForbidden", revoked));
-      yield* requireAppAccessAs(actor, subscription.app, "use").pipe(
-        Effect.catchTag("OrganizationForbidden", revoked),
-      );
+      if (!app.canUse) return yield* new EventAccessRevoked();
       // The event may carry data from any account its invocation used, not only its source.
+      const policies = new Map(
+        (yield* accountAccesses([...new Set(accounts)], actor)).map((policy) => [
+          policy.account,
+          policy,
+        ]),
+      );
       for (const account of accounts)
-        yield* requireAccountAccessAs(actor, account, "use").pipe(
-          Effect.catchTag("OrganizationForbidden", () => Effect.fail(new EventNotVisible())),
-        );
+        if (policies.get(account)?.canUse !== true) return yield* new EventNotVisible();
       // A grant limited to some accounts receives only occurrences that use no others.
       return access;
     }).pipe(
diff --git a/apps/hosted/server/src/implementation/executor-app-upgrades.ts b/apps/hosted/server/src/implementation/executor-app-upgrades.ts
index 887a3a376b..d98e76ff2a 100644
--- a/apps/hosted/server/src/implementation/executor-app-upgrades.ts
+++ b/apps/hosted/server/src/implementation/executor-app-upgrades.ts
@@ -3,12 +3,12 @@ import { SqlClient } from "effect/sql";
 import { StorageError, type App, type VersionId } from "@executor-js/sdk/core";
 
 /**
- * One-off: ask every organization's default Executor app to move to the current template.
- * Member setup redeploys a copy only while the version Executor installed is still active
- * and its workspace has no unsaved edits; customized copies are left alone.
+ * One-off, kept for its recorded migration steps: queued member setup for every organization when
+ * member setup still redeployed the default Executor app to the current template. Member setup no
+ * longer changes the app, so these jobs only link missing keys. Do not append new steps.
  *
  * Jobs start after a delay so the replacement server, not the one still serving during the
- * deployment, runs them. Append a new step when the template changes again.
+ * deployment, runs them.
  */
 export const queueExecutorAppUpgrades = Effect.gen(function* () {
   const sql = yield* SqlClient.SqlClient;
diff --git a/apps/hosted/server/src/implementation/first-party-oauth.ts b/apps/hosted/server/src/implementation/first-party-oauth.ts
index c7aaeddbfa..def2a6cd39 100644
--- a/apps/hosted/server/src/implementation/first-party-oauth.ts
+++ b/apps/hosted/server/src/implementation/first-party-oauth.ts
@@ -21,8 +21,9 @@ export type FirstPartyOAuthClientDefinition = typeof FirstPartyOAuthClientDefini
  * presets (Calendar, Meet, Gmail, Sheets, Drive, Docs, Slides, Forms, Tasks, People, Photos
  * Library, Photos Picker and Search Console), each with `openid email profile`, and
  * `gmail.modify`, which Gmail connections made before the full-Gmail review keep. It is the scope
- * set submitted for the production app's review. Google reports `email` and `profile` as granted
- * under their `userinfo` names, and a grant holds only allowed scopes, so those two are allowed
+ * set approved for the production app, extended on 2026-10-25 for YouTube, Google Ads,
+ * BigQuery and Apps Script. Apps Script metrics is non-sensitive. Google reports `email` and
+ * `profile` as granted under their `userinfo` names, and a grant holds only allowed scopes, so those two are allowed
  * as well.
  */
 const googleAllowedScopes = [
@@ -60,6 +61,14 @@ const googleAllowedScopes = [
   "https://www.googleapis.com/auth/photoslibrary.readonly.appcreateddata",
   "https://www.googleapis.com/auth/photospicker.mediaitems.readonly",
   "https://www.googleapis.com/auth/webmasters",
+  "https://www.googleapis.com/auth/youtube",
+  "https://www.googleapis.com/auth/youtube.force-ssl",
+  "https://www.googleapis.com/auth/adwords",
+  "https://www.googleapis.com/auth/bigquery",
+  "https://www.googleapis.com/auth/script.projects",
+  "https://www.googleapis.com/auth/script.deployments",
+  "https://www.googleapis.com/auth/script.processes",
+  "https://www.googleapis.com/auth/script.metrics",
 ];
 
 /**
@@ -112,8 +121,8 @@ const slackMcpUserScopes = [
  *   `uploads.github.com`, where GitHub takes release asset uploads; and `api.githubcopilot.com`,
  *   GitHub's MCP server. GitHub accepts GitHub App user tokens on all three, and v1 sent this
  *   client's tokens to every GitHub REST operation, uploads included, and to GitHub's MCP server.
- * - `google` is Executor for Google, v1's Google client. `access_type=offline` and
- *   `prompt=consent` make every sign-in return a refresh token. It has no revocation URL: Google
+ * - `google` is Executor for Google, v1's Google client. Like every Google
+ *   sign-in, it sends `access_type=offline` and `prompt=consent`, so each returns a refresh token. It has no revocation URL: Google
  *   revokes every grant a user gave the client at once, so removing one account would end the
  *   user's other Google accounts in every organization. Its tokens go to Google's API hosts.
  * - `slack` is Executor for Slack, v1's Slack MCP client (`apps/cloud/src/engine/first-party-oauth-
@@ -151,7 +160,6 @@ export const firstPartyOAuthClientDefinitions: readonly FirstPartyOAuthClientDef
     server: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
-      authorizationParams: { access_type: "offline", prompt: "consent" },
     },
     tokenEndpointAuthMethod: "client_secret_post",
     defaultScopes: ["openid", "email", "profile"],
diff --git a/apps/hosted/server/src/implementation/mcp-http.ts b/apps/hosted/server/src/implementation/mcp-http.ts
index 179528838e..7d11ba9e1a 100644
--- a/apps/hosted/server/src/implementation/mcp-http.ts
+++ b/apps/hosted/server/src/implementation/mcp-http.ts
@@ -3,7 +3,11 @@ import { CurrentUsage } from "../contracts/product-analytics.ts";
 import { requiresToolMetadata } from "@executor-js/authorization";
 import { grantAuthorization } from "@executor-js/mcp-auth";
 import { GroupDatabase } from "../contracts/groups.ts";
-import { AuthenticationUnavailable, CurrentUserId } from "../contracts/auth.ts";
+import {
+  AuthenticationUnavailable,
+  CurrentUserId,
+  callerSpanAttributes,
+} from "../contracts/auth.ts";
 import { CurrentCaller } from "@executor-js/sdk/core";
 import { mcpCaller } from "./caller.ts";
 import {
@@ -19,6 +23,7 @@ import {
 import {
   defaultMcpLimits,
   makeMcp,
+  McpRequestAttributes,
   refusedMcpRequest,
   type McpBackend,
   type McpOptions,
@@ -150,11 +155,13 @@ export const makeHostedMcp = (
   beforeExecute?: McpOptions["beforeExecute"],
   limits: McpOptions["limits"] = defaultMcpLimits,
   sessions?: McpOptions["sessions"],
+  interactions?: McpOptions["interactions"],
 ) =>
   makeMcp({
     backend: requestBackend,
     ...(beforeExecute === undefined ? {} : { beforeExecute }),
     ...(sessions === undefined ? {} : { sessions }),
+    ...(interactions === undefined ? {} : { interactions }),
     caller: requestCaller,
     instructions: executorIntro,
     limits,
@@ -222,18 +229,19 @@ export const dispatchHostedMcp = <E, R>(
     // move it to another organization. The same bearer keeps its user, client and grant.
     const headers = new Headers(request.headers);
     headers.delete("x-executor-organization");
-    // The organization's opaque ID goes on the request's span and on each operation that rechecks
-    // (`mcp.tool.call`, `mcp.tool.resume`), so their latency can be split by organization.
-    const organization = { "executor.organization.id": access.access.organization };
-    yield* Effect.annotateCurrentSpan(organization);
-    const current = Effect.annotateCurrentSpan(organization).pipe(
+    // The organization's and the caller's opaque IDs go on the request's span, on every MCP
+    // operation's span (`McpRequestAttributes`) and on each operation that rechecks
+    // (`mcp.tool.call`, `mcp.tool.resume`), so their latency and failures can be split by
+    // organization and the users they affect counted.
+    const caller = callerSpanAttributes(access.access.organization, access.userId);
+    yield* Effect.annotateCurrentSpan(caller);
+    const current = Effect.annotateCurrentSpan(caller).pipe(
       Effect.andThen(
-        authentication.authenticate(
-          headers,
-          address.mode,
-          access.access.organization,
-          address.connection,
-        ),
+        authentication
+          .authenticate(headers, address.mode, access.access.organization, address.connection)
+          // A recheck is for this organization and user from its start, so one refused or failed
+          // before its statement answers still names them.
+          .pipe(Effect.annotateSpans(caller)),
       ),
       Effect.flatMap(scoped),
       Effect.provideContext(services),
@@ -446,6 +454,7 @@ export const dispatchHostedMcp = <E, R>(
         ),
       ),
       Effect.provideService(RequestCaller, mcpSessionKey(access)),
+      Effect.provideService(McpRequestAttributes, caller),
       Effect.provideService(CurrentUsage, { source: "mcp", client_id: access.clientId }),
     );
   });
diff --git a/apps/hosted/server/src/implementation/middleware.ts b/apps/hosted/server/src/implementation/middleware.ts
index 5767f70900..187cc5619f 100644
--- a/apps/hosted/server/src/implementation/middleware.ts
+++ b/apps/hosted/server/src/implementation/middleware.ts
@@ -2,6 +2,7 @@ import { Layer } from "effect";
 import { requireUserLive } from "./auth.ts";
 import { requireOrganizationLive } from "./organization.ts";
 import { requireAccountTargetLive } from "./proofs/account-access.ts";
+import { batchAuthentication } from "./batch-authentication.ts";
 
 /**
  * Every hosted API middleware implementation. Hosts provide this once where they build the API;
@@ -11,4 +12,5 @@ export const hostedMiddlewareLive = Layer.mergeAll(
   requireUserLive,
   requireOrganizationLive,
   requireAccountTargetLive,
+  batchAuthentication.layer,
 );
diff --git a/apps/hosted/server/src/implementation/migrations.ts b/apps/hosted/server/src/implementation/migrations.ts
index 8cba4c9324..95733bbab1 100644
--- a/apps/hosted/server/src/implementation/migrations.ts
+++ b/apps/hosted/server/src/implementation/migrations.ts
@@ -2,7 +2,7 @@
 import type { BetterAuthOptions } from "better-auth";
 import { getMigrations } from "better-auth/db/migration";
 import { createDataStepJournal } from "@executor-js/app-management/data-steps";
-import { makeExecutorStorage } from "@executor-js/sdk/core";
+import { makeExecutorStorage, StorageMigrationFailed } from "@executor-js/sdk/core";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import * as Migrator from "effect/sql/Migrator";
@@ -26,11 +26,12 @@ export class HostedMigrationFailed extends Schema.TaggedError<HostedMigrationFai
     stage: Schema.Literals(["auth", "product"]),
     causeTags: Schema.optionalKey(Schema.Array(Schema.String)),
     sqlState: Schema.optionalKey(Schema.String),
+    migrationVersion: Schema.optionalKey(Schema.String),
   },
 ) {
   override get message() {
     const tags = this.causeTags?.join(" > ") ?? "unknown cause";
-    return `${this.stage} migration failed: ${tags}${this.sqlState ? ` (SQLSTATE ${this.sqlState})` : ""}`;
+    return `${this.stage} migration failed${this.migrationVersion ? ` at executor version ${this.migrationVersion}` : ""}: ${tags}${this.sqlState ? ` (SQLSTATE ${this.sqlState})` : ""}`;
   }
 }
 
@@ -38,6 +39,15 @@ export class HostedMigrationFailed extends Schema.TaggedError<HostedMigrationFai
 export const migrationFailed =
   (stage: HostedMigrationFailed["stage"]) =>
   (cause: unknown): HostedMigrationFailed => {
+    if (cause instanceof StorageMigrationFailed)
+      return new HostedMigrationFailed({
+        stage,
+        causeTags: ["StorageMigrationFailed", ...cause.causeTags],
+        ...(cause.sqlState === undefined ? {} : { sqlState: cause.sqlState }),
+        ...(cause.migrationVersion === undefined
+          ? {}
+          : { migrationVersion: cause.migrationVersion }),
+      });
     const causeTags: Array<string> = [];
     let sqlState: string | undefined;
     let current: unknown = cause;
diff --git a/apps/hosted/server/src/implementation/organization-defaults.ts b/apps/hosted/server/src/implementation/organization-defaults.ts
index f7cc67c372..edfe9e2ee2 100644
--- a/apps/hosted/server/src/implementation/organization-defaults.ts
+++ b/apps/hosted/server/src/implementation/organization-defaults.ts
@@ -1,16 +1,8 @@
 import { organizationAppCreation, personalAccountCreation } from "./resource-lifecycle.ts";
 import type { HostedApiDocument } from "../contracts/api.ts";
 import { managedAccountKey } from "./api-keys.ts";
-import { pinnedOnly } from "@executor-js/app-management/data-steps";
 import { sourceFilesEqual } from "@executor-js/sdk/core";
-import {
-  AccountId,
-  AppId,
-  VersionId,
-  StorageError,
-  StorageHost,
-  type Executor,
-} from "@executor-js/sdk/core";
+import { AccountId, AppId, StorageError, StorageHost, type Executor } from "@executor-js/sdk/core";
 import { Effect, Redacted, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import {
@@ -28,14 +20,14 @@ const executorApp = Effect.promise(() => import("./executor-app.ts"));
 const State = Schema.Struct({
   initialized: Schema.Boolean,
   app: Schema.NullOr(AppId),
-  version: Schema.NullOr(VersionId),
   accounts: Schema.Record(Schema.String, AccountId),
 });
 const Accounts = Schema.Struct({ accounts: Schema.Record(Schema.String, AccountId) });
 
 /**
- * Install once, then create missing user accounts or repair their links. Completed setup is
- * read-only. The Executor app calls this installation's API at its resource origin.
+ * Install once, then give each new member a managed key linked to the installed app. The app is
+ * never redeployed here; it changes only as the organization edits it, like any other app. The
+ * Executor app calls this installation's API at its resource origin.
  */
 export const organizationDefaults = (
   executor: Executor,
@@ -46,14 +38,13 @@ export const organizationDefaults = (
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
     return OrganizationDefaults.of((organization, user) => {
-      // Upgrading the installed app makes its webhook sources pending, and member setup links an
-      // account. Either is saved intent, which must wake source reconciliation once it commits.
+      // Member setup linking an account is saved intent, which must wake source reconciliation
+      // once it commits.
       let intent = false;
       return Effect.gen(function* () {
         const rows = yield* sql`select
           coalesce((metadata::jsonb -> 'executorDefaults' ->> 'installed')::boolean, false) as initialized,
           metadata::jsonb -> 'executorDefaults' ->> 'app' as app,
-          metadata::jsonb -> 'executorDefaults' ->> 'deployment' as version,
           coalesce(metadata::jsonb -> 'executorKeyAccounts', '{}'::jsonb) as accounts
           from "organization" where id = ${organization}`.pipe(
           Effect.mapError(() => new StorageError()),
@@ -110,6 +101,9 @@ export const organizationDefaults = (
           );
         }
         if (user === undefined) return;
+        // A recorded member already has a key, or deliberately deleted it. Setup never replaces
+        // either, and never changes the app: it is the organization's to edit and deploy.
+        if (Object.hasOwn(state.accounts, user.userId)) return;
         // The stored ID follows renames; deletion never recreates an initialized app.
         const app =
           state.app === null
@@ -118,84 +112,6 @@ export const organizationDefaults = (
                 .get({ owner, app: state.app })
                 .pipe(Effect.catchTag("AppNotFound", () => Effect.succeed(undefined)));
         if (app === undefined) return;
-        let current = app;
-        // The recorded version is the one Executor installed or verified. While it is still
-        // active nobody has deployed over it, so the current template may replace it.
-        if (state.version !== null && state.version === app.activeVersion) {
-          const version = yield* executor.apps.source({ owner, app: app.id });
-          if (version.id !== app.activeVersion) return;
-          const { defaultExecutorAppSource } = yield* executorApp;
-          const source = yield* defaultExecutorAppSource(resourceOrigin, yield* document);
-          if (!sourceFilesEqual(version.files, source.files)) {
-            // A failed upgrade keeps the working installation, and member setup continues.
-            const upgraded = yield* Effect.gen(function* () {
-              const workspace = yield* executor.apps.workspace({ owner, app: app.id });
-              // Unsaved edits mean someone is changing this copy; leave it to them. The framework
-              // pin is a system commit, not an edit.
-              if (!pinnedOnly(workspace.files, version.files)) return undefined;
-              const deployed = yield* executor.apps.deploy({
-                owner,
-                app: app.id,
-                files: source.files,
-              });
-              intent = true;
-              return deployed.app;
-            }).pipe(
-              Effect.catch(() =>
-                Effect.logWarning("Executor app upgrade failed").pipe(Effect.as(undefined)),
-              ),
-            );
-            if (upgraded !== undefined) {
-              current = upgraded;
-              yield* sql`update "organization" set metadata = jsonb_set(
-                coalesce(metadata::jsonb, '{}'::jsonb), '{executorDefaults,deployment}',
-                to_jsonb(${upgraded.activeVersion}::text)
-              )::text where id = ${organization}`.pipe(Effect.mapError(() => new StorageError()));
-            }
-          }
-        } else if (state.version !== app.activeVersion) {
-          const version = yield* executor.apps.source({ owner, app: app.id });
-          if (version.id !== app.activeVersion) return;
-          const { defaultExecutorAppSource, executorAppSource } = yield* executorApp;
-          const source = yield* defaultExecutorAppSource(resourceOrigin, yield* document);
-          if (!sourceFilesEqual(version.files, source.files)) {
-            // Upgrade only the untouched, unconfigured catalog version. Preserve user edits and connections.
-            const catalog = yield* executorAppSource(resourceOrigin, yield* document);
-            if (!sourceFilesEqual(version.files, catalog.files)) return;
-            const workspace = yield* executor.apps.workspace({ owner, app: app.id });
-            if (!pinnedOnly(workspace.files, version.files)) return;
-            current = (yield* executor.apps.deploy({
-              owner,
-              app: app.id,
-              files: source.files,
-            })).app;
-            intent = true;
-          }
-        }
-        const requirement = current.requirements.accounts.service;
-        if (requirement === undefined) return yield* new StorageError();
-        const savedAccount = (accounts: Readonly<Record<string, AccountId>>) => {
-          const id = Object.hasOwn(accounts, user.userId) ? accounts[user.userId] : undefined;
-          return id === undefined
-            ? Effect.succeed(undefined)
-            : executor.accounts
-                .get({ owner, account: id })
-                .pipe(Effect.catchTag("AccountNotFound", () => Effect.succeed(undefined)));
-        };
-        const saved = yield* savedAccount(state.accounts);
-        // A recorded account that was deliberately deleted is not a new-user setup.
-        // Keep that intent: inventory reads must not recreate credentials or choose a replacement.
-        if (Object.hasOwn(state.accounts, user.userId) && saved === undefined) return;
-        if (
-          saved !== undefined &&
-          (saved.provider !== requirement.provider || saved.method !== "apiKey")
-        )
-          return yield* new StorageError();
-        // Existing saved accounts keep their credential and links; setup does not mint replacement
-        // keys or link them again, so a member's unlink stays. Read current SQL metadata on every
-        // call; this is not an isolate-local result cache.
-        if (state.version === current.activeVersion && saved !== undefined) return;
-        // Build/network work finished above. Only account creation or selection repair needs the lock.
         yield* executor[StorageHost]
           .transaction(
             Effect.gen(function* () {
@@ -211,69 +127,56 @@ export const organizationDefaults = (
               const state = yield* Schema.decodeUnknownEffect(Accounts)(rows[0]).pipe(
                 Effect.mapError(() => new StorageError()),
               );
+              if (Object.hasOwn(state.accounts, user.userId)) return;
               // Serialize member setup per app without touching the SDK's rows; the SDK read
               // below runs inside this transaction and observes a committed version.
               yield* sql`select pg_advisory_xact_lock(hashtextextended(${`executor-defaults:${app.id}`}, 0))`.pipe(
                 Effect.mapError(() => new StorageError()),
               );
-              const locked = yield* executor.apps.get({ owner, app: app.id });
-              if (locked.activeVersion !== current.activeVersion) return;
-              const saved = yield* savedAccount(state.accounts);
-              // A recorded account that was deliberately deleted is not a new-user setup.
-              // Keep that intent: inventory reads must not recreate credentials or choose a replacement.
-              if (Object.hasOwn(state.accounts, user.userId) && saved === undefined) return;
-              if (
-                saved !== undefined &&
-                (saved.provider !== requirement.provider || saved.method !== "apiKey")
-              )
-                return yield* new StorageError();
+              // The key fits whatever version is active now; an app without the slot gets none.
+              const requirement = (yield* executor.apps.get({ owner, app: app.id })).requirements
+                .accounts.service;
+              if (requirement === undefined) return;
               const eligible =
                 yield* sql`select member.id from member join "user" on "user".id = member."userId"
                 where member."organizationId" = ${organization} and member."userId" = ${user.userId}
                 and member.role in ('owner', 'admin', 'member') and (${requireVerifiedEmail} = false or "user"."emailVerified" = true)
                 for share of member, "user"`.pipe(Effect.mapError(() => new StorageError()));
               if (eligible.length === 0) return;
-              const account =
-                saved ??
-                (yield* Effect.gen(function* () {
-                  const token = yield* managedAccountKey(organization, user.userId).pipe(
-                    Effect.provideService(SqlClient.SqlClient, sql),
-                  );
-                  const created = yield* executor.managedAccounts
-                    .add({
-                      owner,
-                      provider: requirement.provider,
-                      method: "apiKey",
-                      // Email sign-ups have no name; say whose access this is instead.
-                      label: "Your Executor access",
-                      fields: Redacted.make({ token: Redacted.value(token), organization }),
-                    })
-                    .pipe(personalAccountCreation(user.userId));
-                  // A new managed key is linked to the common Executor app once, when it is
-                  // created. A member who unlinks it later keeps that choice.
-                  if (
-                    yield* addLink(sql, executor.webhooks, {
-                      app: app.id,
-                      requirement: "service",
-                      account: created.id,
-                      subject: user.userId,
-                      linkedBy: user.userId,
-                    }).pipe(
-                      Effect.catchTags({
-                        RequirementMismatch: () => new StorageError(),
-                        AccountNotFound: () => new StorageError(),
-                      }),
-                    )
-                  )
-                    intent = true;
-                  return created;
-                }));
+              const token = yield* managedAccountKey(organization, user.userId).pipe(
+                Effect.provideService(SqlClient.SqlClient, sql),
+              );
+              const account = yield* executor.managedAccounts
+                .add({
+                  owner,
+                  provider: requirement.provider,
+                  method: "apiKey",
+                  // Email sign-ups have no name; say whose access this is instead.
+                  label: "Your Executor access",
+                  fields: Redacted.make({ token: Redacted.value(token), organization }),
+                })
+                .pipe(personalAccountCreation(user.userId));
+              // A new managed key is linked to the common Executor app once, when it is
+              // created. A member who unlinks it later keeps that choice.
+              if (
+                yield* addLink(sql, executor.webhooks, {
+                  app: app.id,
+                  requirement: "service",
+                  account: account.id,
+                  subject: user.userId,
+                  linkedBy: user.userId,
+                }).pipe(
+                  Effect.catchTags({
+                    RequirementMismatch: () => new StorageError(),
+                    AccountNotFound: () => new StorageError(),
+                  }),
+                )
+              )
+                intent = true;
               const accounts = JSON.stringify({ ...state.accounts, [user.userId]: account.id });
-              yield* sql`update "organization" set metadata = jsonb_set(jsonb_set(
-            coalesce(metadata::jsonb, '{}'::jsonb), '{executorKeyAccounts}', ${accounts}::jsonb),
-            '{executorDefaults}', jsonb_build_object('installed', true, 'app', ${app.id}::text, 'deployment', ${current.activeVersion}::text)
+              yield* sql`update "organization" set metadata = jsonb_set(
+            coalesce(metadata::jsonb, '{}'::jsonb), '{executorKeyAccounts}', ${accounts}::jsonb
           )::text where id = ${organization}`.pipe(Effect.mapError(() => new StorageError()));
-              return saved === undefined;
             }),
           )
           .pipe(Effect.uninterruptible);
diff --git a/apps/hosted/server/src/implementation/organization-removals.ts b/apps/hosted/server/src/implementation/organization-removals.ts
index a2587b6ae4..db78d5b972 100644
--- a/apps/hosted/server/src/implementation/organization-removals.ts
+++ b/apps/hosted/server/src/implementation/organization-removals.ts
@@ -15,6 +15,7 @@ const Row = Schema.Struct({
   status: OrganizationRemovalRecord.fields.status,
   logo: OrganizationRemovalRecord.fields.logo,
 });
+const Removed = Schema.Array(Schema.Struct({ organization_id: Row.fields.organization_id }));
 const decode = (rows: unknown) =>
   Schema.decodeUnknownEffect(Schema.Array(Row))(rows).pipe(
     Effect.mapError(unavailable),
@@ -45,6 +46,23 @@ export const makeOrganizationRemovals = (
   return {
     tombstones: (organization: OrganizationId) =>
       Effect.map(read(organization), (record) => record !== null),
+    /** The removed organizations among `organizations`, in one read for a whole list. */
+    removed: (
+      organizations: ReadonlyArray<OrganizationId>,
+    ): Effect.Effect<ReadonlySet<OrganizationId>, OrganizationRemovalUnavailable> =>
+      organizations.length === 0
+        ? Effect.succeed(new Set<OrganizationId>())
+        : database.pipe(
+            Effect.flatMap(
+              (sql) =>
+                sql`select organization_id from hosted_organization_removal where ${sql.in("organization_id", organizations)}`,
+            ),
+            Effect.mapError(unavailable),
+            Effect.flatMap((rows) =>
+              Schema.decodeUnknownEffect(Removed)(rows).pipe(Effect.mapError(unavailable)),
+            ),
+            Effect.map((rows) => new Set(rows.map((row) => row.organization_id))),
+          ),
     removals: OrganizationRemovals.of({
       read,
       // Accepting the same removal twice must reuse the first instance, or a
diff --git a/apps/hosted/server/src/implementation/organization.ts b/apps/hosted/server/src/implementation/organization.ts
index d3a42d0a34..88d4ee129d 100644
--- a/apps/hosted/server/src/implementation/organization.ts
+++ b/apps/hosted/server/src/implementation/organization.ts
@@ -1,5 +1,6 @@
 import type { AuthContext } from "@better-auth/core";
 import type { Principal } from "../contracts/auth.ts";
+import { requestAuthentication, requestTombstones } from "./batch-authentication.ts";
 import { accountOAuthRedirectUri } from "./auth.ts";
 import {
   CurrentUsage,
@@ -22,7 +23,7 @@ import { readOrganizationIconUpload } from "./organization-icons.ts";
 import { OrganizationTombstones } from "../contracts/organization-removal.ts";
 import { requireOrganizationAdmin } from "./access.ts";
 import { callerLinkedAccounts } from "./app-accounts.ts";
-import { CurrentPrincipal, CurrentUserId } from "../contracts/auth.ts";
+import { CurrentPrincipal, CurrentUserId, callerSpanAttributes } from "../contracts/auth.ts";
 import { APIError } from "better-auth/api";
 import { ErrorReporter, Effect, Layer, Schema } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
@@ -100,7 +101,7 @@ export const lookupOrganizationSlug = (call: () => Promise<unknown>) =>
  * organization that is being erased.
  */
 const refuseRemoved = (organization: OrganizationId) =>
-  Effect.flatMap(OrganizationTombstones, (removed) => removed(organization)).pipe(
+  Effect.flatMap(requestTombstones, (removed) => removed(organization)).pipe(
     Effect.mapError(() => new AuthenticationUnavailable()),
     Effect.flatMap((gone) => (gone ? Effect.fail(new OrganizationForbidden()) : Effect.void)),
   );
@@ -126,8 +127,12 @@ export const withOrganizationRequest = <E, R>(
         return yield* new Forbidden();
       const grant = yield* api.authenticate(headers, reference);
       // The request's span records the organization's opaque ID, never the route's reference,
-      // which can be its slug.
-      yield* Effect.annotateCurrentSpan("executor.organization.id", grant.access.organization);
+      // which can be its slug, and the caller's user ID: an OAuth grant's user or a key's. The
+      // bearer check returns only an organization it authorized for the caller, so the refusals
+      // below, a removed organization or a key's policy, keep both.
+      yield* Effect.annotateCurrentSpan(
+        callerSpanAttributes(grant.access.organization, grant.userId),
+      );
       yield* refuseRemoved(grant.access.organization);
       if (!permitsAction(grant.policy, action)) return yield* new OrganizationForbidden();
       if (params.app !== undefined) {
@@ -137,10 +142,7 @@ export const withOrganizationRequest = <E, R>(
         if (!permitsApp(grant.policy, app)) return yield* new OrganizationForbidden();
       }
       if (grant.key !== undefined)
-        yield* Effect.annotateCurrentSpan({
-          "executor.api_key.id": grant.key.id,
-          "executor.user.id": grant.userId,
-        });
+        yield* Effect.annotateCurrentSpan("executor.api_key.id", grant.key.id);
       const scope = Effect.succeed(publishingScope(grant.organizationSlug));
       return (yield* response(scope).pipe(
         Effect.tapCause(ErrorReporter.report),
@@ -158,15 +160,20 @@ export const withOrganizationRequest = <E, R>(
       request.headers.origin !== auth.origin
     )
       return yield* new Forbidden();
-    const principal = yield* auth.current(headers);
+    const identity = yield* requestAuthentication(auth);
+    const principal = yield* identity.current(headers);
     if (principal === null) return yield* new Unauthorized();
-    const organization = yield* auth.organization(reference);
-    yield* Effect.annotateCurrentSpan("executor.organization.id", organization);
+    const organization = yield* identity.organization(reference);
     // Removal is reported before membership. The reads run one after the other: on Cloud they
     // share the event's one SQL connection, and overlapping them would open a second one, a TLS
     // login that costs far more than the few milliseconds the second read waits.
     yield* refuseRemoved(organization);
-    const membership = yield* auth.membership(principal, organization);
+    const membership = yield* identity.membership(principal, organization);
+    // The route's reference resolves to any organization, so the request names it, and the session's
+    // user, only once the membership shows it is the caller's own. A request refused before then,
+    // for an organization the caller does not belong to or one being removed, names neither, and so
+    // never counts against that organization's failures or among its users.
+    yield* Effect.annotateCurrentSpan(callerSpanAttributes(organization, principal.userId));
     const access = {
       organization,
       owner: organizationOwner(organization),
diff --git a/apps/hosted/server/src/implementation/provisioning.ts b/apps/hosted/server/src/implementation/provisioning.ts
index 7d19d465ba..0f969f3b01 100644
--- a/apps/hosted/server/src/implementation/provisioning.ts
+++ b/apps/hosted/server/src/implementation/provisioning.ts
@@ -2,6 +2,7 @@
 import { StorageError } from "@executor-js/sdk/core";
 import { Effect, Exit, Schedule, Schema } from "effect";
 import { SqlClient } from "effect/sql";
+import { traceFailure } from "@executor-js/telemetry/failed-span";
 import { OrganizationId } from "../contracts/organization.ts";
 import {
   OrganizationDefaults,
@@ -210,6 +211,10 @@ export const drainProvisioning = (services: ProvisioningServices) =>
       Effect.flatMap(
         Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ id: Schema.String }))),
       ),
+      // Self-host polls every second. The poll records nothing, unless it fails; the jobs it
+      // finds are traced.
+      Effect.withTracerEnabled(false),
+      traceFailure("hosted.provisioning.poll"),
     );
     for (const job of jobs)
       yield* provision(job.id, services).pipe(
diff --git a/apps/hosted/server/src/implementation/resource-policy.ts b/apps/hosted/server/src/implementation/resource-policy.ts
index e4759381ab..e8e3f76594 100644
--- a/apps/hosted/server/src/implementation/resource-policy.ts
+++ b/apps/hosted/server/src/implementation/resource-policy.ts
@@ -207,18 +207,26 @@ export const resourceAuthorityForApp = (
  * and `where` of a read over `l` (the link) and `a` (the account): the account belongs to the app's
  * organization, the subject is a member, and the account is their personal account or shared with
  * everyone or one of their groups.
+ *
+ * The links are read first, with their app's owner, and `offset 0` keeps Postgres from merging that
+ * read into the joins after it. Merged, Postgres can reach the apps through the account's owner
+ * instead of the link: it then pairs every account of the organization with every app of it and
+ * looks up a link for each pair, about 18,000 buffers for one discovery read across 40 apps instead
+ * of about 1,000.
  */
 export const usableLinks = (
   sql: SqlClient.SqlClient,
   input: { readonly subject: string; readonly apps: readonly AppId[] },
-) => sql`hosted_app_account_links l
-      join executor_apps app on app.id = l.app
-      join executor_accounts a on a.id = l.account and a.owner = app.owner
+) => sql`(select l.app, l.requirement, l.account, l.subject, l.created_at, app.owner
+        from hosted_app_account_links l
+        join executor_apps app on app.id = l.app
+        where l.subject = ${input.subject} and ${sql.in("l.app", input.apps)}
+        offset 0) l
+      join executor_accounts a on a.id = l.account and a.owner = l.owner
       join hosted_account_access p on p.account_id = a.id
         and a.owner = 'organization:' || p.organization_id
       join member m on m."organizationId" = p.organization_id and m."userId" = l.subject
-      where l.subject = ${input.subject} and ${sql.in("l.app", input.apps)}
-        and ((p.kind = 'personal' and p.personal_user_id = m."userId")
+      where ((p.kind = 'personal' and p.personal_user_id = m."userId")
           or (p.kind = 'shared' and (p.audience = 'everyone' or exists(
             select 1 from hosted_account_groups g
             join hosted_group_members gm on gm.group_id = g.group_id
@@ -228,16 +236,19 @@ export const usableLinks = (
  * The app links of these apps whose accounts their app requirements may use now, as the `from` and
  * `where` of a read over `l` (the link) and `a` (the account): the account belongs to the app's
  * organization, which holds its access record, and a personal account's member is still in it. No
- * caller's use of the account is checked: using an app link follows app access.
+ * caller's use of the account is checked: using an app link follows app access. The links are read
+ * first, as in {@link usableLinks}.
  */
 export const usableAppLinks = (sql: SqlClient.SqlClient, apps: readonly AppId[]) =>
-  sql`hosted_app_account_links l
-      join executor_apps app on app.id = l.app
-      join executor_accounts a on a.id = l.account and a.owner = app.owner
+  sql`(select l.app, l.requirement, l.account, l.created_at, app.owner
+        from hosted_app_account_links l
+        join executor_apps app on app.id = l.app
+        where l.subject is null and ${sql.in("l.app", apps)}
+        offset 0) l
+      join executor_accounts a on a.id = l.account and a.owner = l.owner
       join hosted_account_access p on p.account_id = a.id
         and a.owner = 'organization:' || p.organization_id
-      where l.subject is null and ${sql.in("l.app", apps)}
-        and (p.kind <> 'personal' or exists(select 1 from member owner_member
+      where (p.kind <> 'personal' or exists(select 1 from member owner_member
           where owner_member."organizationId" = p.organization_id
             and owner_member."userId" = p.personal_user_id))`;
 /** The JSON of one usable link, for a read over {@link usableLinks} or {@link usableAppLinks}. */
diff --git a/apps/hosted/server/src/implementation/schedules.ts b/apps/hosted/server/src/implementation/schedules.ts
index 89bbf91739..9a4e69dc3a 100644
--- a/apps/hosted/server/src/implementation/schedules.ts
+++ b/apps/hosted/server/src/implementation/schedules.ts
@@ -2,7 +2,7 @@ import { requireAppAccess } from "./resource-policy.ts";
 import { GroupDatabase } from "../contracts/groups.ts";
 import { CurrentOrganization } from "../contracts/organization.ts";
 /** Scheduled work has a saved actor, not a retained browser session or an invented service account. */
-import { Effect, Schema } from "effect";
+import { Effect, Result, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { HttpApiBuilder } from "effect/http-api";
 import {
@@ -84,6 +84,18 @@ export const makeScheduledAuthority = (executor: Executor) =>
       });
   });
 const wake = Effect.flatten(ScheduleWakeup);
+/** A check's outcome for each app, read once in this operation and reused for its later runs. */
+const perApp = <A, E, R>(check: (app: AppId) => Effect.Effect<A, E, R>) => {
+  const outcomes = new Map<AppId, Result.Result<A, E>>();
+  return (app: AppId) =>
+    Effect.gen(function* () {
+      const known = outcomes.get(app);
+      if (known !== undefined) return yield* Effect.fromResult(known);
+      const outcome = yield* Effect.result(check(app));
+      outcomes.set(app, outcome);
+      return yield* Effect.fromResult(outcome);
+    });
+};
 /** The saved actor of each schedule copy of an app; null for an app schedule. */
 const scheduleActors = (executor: Executor, owner: OwnerId, app: AppId) =>
   executor.schedules
@@ -279,18 +291,27 @@ export const hostedScheduleHandlers = HttpApiBuilder.group(HostedApi, "schedules
         if (query.app !== undefined) yield* requireAppAccess(query.app, "read");
         const runs = yield* executor.schedules.runs({ ...query, owner });
         const actors = new Map(
-          yield* Effect.forEach([...new Set(runs.map((run) => run.app))], (app) =>
-            scheduleActors(executor, owner, app).pipe(
-              Effect.map((byId) => [app, byId] as const),
-              Effect.catchTag("AppNotFound", () => Effect.succeed([app, new Map()] as const)),
-            ),
-          ),
+          query.pending
+            ? yield* Effect.forEach([...new Set(runs.map((run) => run.app))], (app) =>
+                scheduleActors(executor, owner, app).pipe(
+                  Effect.map((byId) => [app, byId] as const),
+                  Effect.catchTag("AppNotFound", () => Effect.succeed([app, new Map()] as const)),
+                ),
+              )
+            : [],
         );
+        const caller = yield* CurrentUserId;
+        // Runs of one app share its checks; each is read once, when its first run needs it.
+        const usable = perApp((app) => usableApp(executor, owner, app));
+        const manages = perApp((app) => requireAppAccess(app, "manage"));
         return yield* Effect.filter(runs, (run) =>
           Effect.gen(function* () {
-            yield* usableApp(executor, owner, run.app);
-            if (query.pending)
-              yield* actorManagerOwner(run.app, actors.get(run.app)?.get(run.scheduleId) ?? null);
+            yield* usable(run.app);
+            if (query.pending) {
+              // As `actorManagerOwner`: another member's or the app's run needs app management.
+              const actor = actors.get(run.app)?.get(run.scheduleId) ?? null;
+              if (actor === null || actor !== caller) yield* manages(run.app);
+            }
             return true;
           }).pipe(
             Effect.catchTags({
diff --git a/apps/hosted/server/src/implementation/setup-progress.ts b/apps/hosted/server/src/implementation/setup-progress.ts
new file mode 100644
index 0000000000..a7faa83477
--- /dev/null
+++ b/apps/hosted/server/src/implementation/setup-progress.ts
@@ -0,0 +1,42 @@
+/** What a member has done of a new team's setup steps, read on the server. */
+import type { GrantId } from "@executor-js/mcp-auth";
+import { Effect } from "effect";
+import { CurrentUserId } from "../contracts/auth.ts";
+import { executorCatalogPackage } from "../contracts/catalog.ts";
+import { HostedExecutor } from "../contracts/executor.ts";
+import { McpAuthentication } from "../contracts/mcp.ts";
+import { CurrentOrganization, OrganizationForbidden } from "../contracts/organization.ts";
+import { callerLinkedAccounts } from "./app-accounts.ts";
+
+export interface SetupProgress {
+  /** The member linked an account to one of the team's apps other than Executor's own. */
+  readonly accounts: boolean;
+  /** The member's newest agent connected over MCP to this team; API clients do not count. */
+  readonly agent: GrantId | undefined;
+}
+
+/**
+ * The current member's progress through the current organization's setup steps. Each step's page
+ * counts a narrower set (accounts of catalog apps, an agent connected while it is open), so
+ * whatever a page calls done, this calls done too.
+ */
+export const memberSetupProgress = Effect.gen(function* () {
+  const organization = yield* CurrentOrganization;
+  const userId = yield* CurrentUserId;
+  if (userId === undefined) return yield* new OrganizationForbidden();
+  const executor = yield* Effect.flatten(HostedExecutor);
+  const auth = yield* McpAuthentication;
+  // Executor's own app is how the assistant reaches the others, as on the account step.
+  const apps = (yield* executor.apps.list({ owner: organization.owner }))
+    .filter((app) => app.copiedFrom?.name !== executorCatalogPackage)
+    .map((app) => app.id);
+  const linked = apps.length === 0 ? [] : yield* callerLinkedAccounts(apps);
+  const agents = yield* auth.connections.agents({
+    userId,
+    resource: organization.organization,
+  });
+  const [newest] = agents
+    .filter((agent) => agent.access.kind !== "api")
+    .toSorted((a, b) => b.connectedAt.localeCompare(a.connectedAt));
+  return { accounts: linked.length > 0, agent: newest?.id } satisfies SetupProgress;
+}).pipe(Effect.withSpan("setup.progress"));
diff --git a/apps/hosted/server/src/implementation/webhook-setup.ts b/apps/hosted/server/src/implementation/webhook-setup.ts
index a2c4b56736..cd0ac50bf8 100644
--- a/apps/hosted/server/src/implementation/webhook-setup.ts
+++ b/apps/hosted/server/src/implementation/webhook-setup.ts
@@ -13,6 +13,7 @@ import {
   type OrganizationReference,
 } from "../contracts/organization.ts";
 import { HostedExecutor } from "../contracts/executor.ts";
+import { ScheduleWakeup } from "../contracts/schedules.ts";
 const authorized = (
   auth: typeof Authentication.Service,
   input: { organization: OrganizationReference; app: AppId; subscription: WebhookId },
@@ -54,6 +55,9 @@ export const hostedWebhookSetupHandlers = HttpApiBuilder.group(
         .handle("complete", ({ params, payload }) =>
           Effect.flatMap(authorized(auth, params), (executor) =>
             executor.webhookSetup.complete({ ...params, ...payload }),
+          ).pipe(
+            // A finished setup is new intent for the webhook source waiting on it.
+            Effect.tap(() => Effect.flatten(ScheduleWakeup)),
           ),
         )
         .handle("remove", ({ params }) =>
diff --git a/apps/hosted/server/src/implementation/webhooks.ts b/apps/hosted/server/src/implementation/webhooks.ts
index 3c34de7787..0ba3352fff 100644
--- a/apps/hosted/server/src/implementation/webhooks.ts
+++ b/apps/hosted/server/src/implementation/webhooks.ts
@@ -5,18 +5,22 @@ import { HttpServerRequest } from "effect/http";
 import { HttpServerResponse } from "effect/http";
 import { Effect } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
+import { permitsAction, permitsApp } from "@executor-js/authorization";
 import {
+  AccountWebhooksActive,
   WebhookNotFound,
   webhookCallback,
   type Executor,
   type AccountId,
   type AppId,
   type OwnerId,
+  type StorageError,
   type WebhookSource,
   type WebhookSubscription,
 } from "@executor-js/sdk/core";
 import { HostedApi } from "../contracts/api.ts";
 import { HostedExecutor } from "../contracts/executor.ts";
+import { CurrentAuthorization } from "../contracts/authorization.ts";
 import { ScheduleWakeup } from "../contracts/schedules.ts";
 import {
   actorManagerOwner,
@@ -43,6 +47,58 @@ const checkSubscriptionAccounts = (owner: OwnerId, subscription: WebhookSubscrip
   subscription.actor === null
     ? Effect.void
     : checkAccounts(owner, { source: subscription.sourceAccount });
+/** `list` shows a subscription to its actor or an app manager while they can use its accounts. */
+const listed = (owner: OwnerId, app: AppId, subscription: WebhookSubscription) =>
+  Effect.gen(function* () {
+    yield* actorManagerOwner(app, subscription.actor);
+    yield* checkSubscriptionAccounts(owner, subscription);
+  }).pipe(
+    Effect.as(true),
+    Effect.catchTags({
+      OrganizationForbidden: () => Effect.succeed(false),
+      AccountNotFound: () => Effect.succeed(false),
+    }),
+  );
+const failedToRead = <E extends { readonly _tag: string }>(
+  error: E,
+): error is Exclude<E, StorageError> => error._tag !== "StorageError";
+/**
+ * The app's subscriptions `list` shows the caller: none unless their API token and access let
+ * them read the app. A read refused for any reason but storage shows none.
+ */
+const listedIn = (executor: Executor, owner: OwnerId, app: AppId) =>
+  Effect.gen(function* () {
+    const policy = yield* CurrentAuthorization;
+    if (!permitsAction(policy, "read") || !permitsApp(policy, app)) return [];
+    yield* appReaderOwner(app);
+    yield* executor.apps.get({ owner, app });
+    const subscriptions = yield* executor.webhooks.list({ app });
+    return yield* Effect.filter(subscriptions, (subscription) => listed(owner, app, subscription));
+  }).pipe(Effect.catchIf(failedToRead, () => Effect.succeed([])));
+/**
+ * Every subscription holding an account refuses its deletion, but the refusal names only those
+ * `list` shows the caller and counts the rest, so it never reveals an app or subscription they
+ * cannot read.
+ */
+export const visibleAccountRefusal = (executor: Executor, refusal: AccountWebhooksActive) =>
+  Effect.gen(function* () {
+    if (refusal.dependents === undefined) return refusal;
+    const owner = yield* currentOwner;
+    const holders = refusal.dependents.visible;
+    const apps = [...new Set(holders.map((holder) => holder.app))];
+    const shown = new Set(
+      (yield* Effect.forEach(apps, (app) =>
+        Effect.map(listedIn(executor, owner, app), (subscriptions) =>
+          subscriptions.map((subscription) => `${app}/${subscription.id}`),
+        ),
+      )).flat(),
+    );
+    const visible = holders.filter((holder) => shown.has(`${holder.app}/${holder.subscription}`));
+    return new AccountWebhooksActive({
+      account: refusal.account,
+      dependents: { visible, hidden: refusal.dependents.hidden + holders.length - visible.length },
+    });
+  });
 /** A subscription's actor, or an app manager, may change it once its accounts pass. */
 const managedSubscription = (
   executor: Executor,
@@ -128,16 +184,7 @@ export const hostedWebhookHandlers = HttpApiBuilder.group(HostedApi, "webhooks",
             yield* executor.apps.get({ owner, app: params.app });
             const subscriptions = yield* executor.webhooks.list(params);
             return yield* Effect.filter(subscriptions, (subscription) =>
-              Effect.gen(function* () {
-                yield* actorManagerOwner(params.app, subscription.actor);
-                yield* checkSubscriptionAccounts(owner, subscription);
-              }).pipe(
-                Effect.as(true),
-                Effect.catchTags({
-                  OrganizationForbidden: () => Effect.succeed(false),
-                  AccountNotFound: () => Effect.succeed(false),
-                }),
-              ),
+              listed(owner, params.app, subscription),
             );
           }),
         )
diff --git a/apps/hosted/server/src/implementation/workflow-access.ts b/apps/hosted/server/src/implementation/workflow-access.ts
index 752690e9ed..c81d1684d4 100644
--- a/apps/hosted/server/src/implementation/workflow-access.ts
+++ b/apps/hosted/server/src/implementation/workflow-access.ts
@@ -10,8 +10,8 @@ import {
 import { Effect } from "effect";
 import { CurrentUserId } from "../contracts/auth.ts";
 import { OrganizationForbidden } from "../contracts/organization.ts";
-import { requireAppAccess } from "./resource-policy.ts";
-import { checkScopedAccounts } from "./access.ts";
+import { requireCurrentAppAccess, type ResourceAuthority } from "./resource-policy.ts";
+import { checkScopedAccountsAs } from "./access.ts";
 /**
  * Check current app use, that the run is the caller's own or was started without an actor, and
  * every account that contributed to the retained run, by the scope its requirement had on the
@@ -25,7 +25,21 @@ export const requireWorkflowAccess = (
   run: string,
 ) =>
   Effect.gen(function* () {
-    yield* requireAppAccess(app, "use");
+    const { actor } = yield* requireCurrentAppAccess(app, "use");
+    return yield* workflowRunAccessAs(executor, owner, app, actor, run);
+  });
+/**
+ * {@link requireWorkflowAccess} after the caller's use of the app was checked in this operation,
+ * as `actor`, so a list checks it once rather than per run.
+ */
+export const workflowRunAccessAs = (
+  executor: Executor,
+  owner: OwnerId,
+  app: AppId,
+  actor: ResourceAuthority,
+  run: string,
+) =>
+  Effect.gen(function* () {
     const saved = yield* executor.apps.workflowRuns
       .pinned({ owner, app, run: WorkflowRunId.make(run) })
       .pipe(
@@ -33,9 +47,9 @@ export const requireWorkflowAccess = (
           Effect.fail(new WorkflowFailure({ reason: "not_found", retryable: false })),
         ),
       );
-    if (saved.actor !== null && saved.actor !== (yield* CurrentUserId))
+    if (saved.actor !== null && saved.actor !== actor.user)
       return yield* new OrganizationForbidden();
-    yield* checkScopedAccounts(owner, app, saved.accounts);
+    yield* checkScopedAccountsAs(actor, owner, app, saved.accounts);
     return saved;
   });
 
diff --git a/apps/hosted/server/src/implementation/workflows.ts b/apps/hosted/server/src/implementation/workflows.ts
index 3c5503ddc2..12f543efb1 100644
--- a/apps/hosted/server/src/implementation/workflows.ts
+++ b/apps/hosted/server/src/implementation/workflows.ts
@@ -1,10 +1,14 @@
-import { requireWorkflowAccess, requireWorkflowReplayAccess } from "./workflow-access.ts";
+import {
+  requireWorkflowAccess,
+  requireWorkflowReplayAccess,
+  workflowRunAccessAs,
+} from "./workflow-access.ts";
 /** Keep product permissions outside the reusable workflow SDK. */
 import { Effect } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HostedApi } from "../contracts/api.ts";
 import { HostedExecutor } from "../contracts/executor.ts";
-import { requireAppAccess } from "./resource-policy.ts";
+import { requireCurrentAppAccess } from "./resource-policy.ts";
 import { actorManagerOwner, currentOwner, selectedApp } from "./access.ts";
 
 /** Run reads check current membership and the run's accounts; starts use the caller's accounts. */
@@ -42,10 +46,10 @@ export const hostedWorkflowHandlers = HttpApiBuilder.group(HostedApi, "workflows
       Effect.gen(function* () {
         const owner = yield* currentOwner,
           executor = yield* Effect.flatten(HostedExecutor);
-        yield* requireAppAccess(params.app, "use");
+        const { actor } = yield* requireCurrentAppAccess(params.app, "use");
         const page = yield* executor.apps.workflowRuns.list({ ...params, ...query });
         const items = yield* Effect.filter(page.items, (run) =>
-          requireWorkflowAccess(executor, owner, params.app, run.id).pipe(
+          workflowRunAccessAs(executor, owner, params.app, actor, run.id).pipe(
             Effect.as(true),
             Effect.catchTags({
               OrganizationForbidden: () => Effect.succeed(false),
diff --git a/apps/hosted/server/src/index.ts b/apps/hosted/server/src/index.ts
index 0ae5d8e26f..766abc12a1 100644
--- a/apps/hosted/server/src/index.ts
+++ b/apps/hosted/server/src/index.ts
@@ -8,11 +8,14 @@ export { HostedCatalog } from "./contracts/catalog.ts";
 export { hostedHandlers } from "./implementation/api.ts";
 export { catalogLive } from "./implementation/catalog.ts";
 export {
+  hostedApi,
   hostedApiDocumentRoute,
+  hostedApiRevision,
   lazyHostedApiDocument,
   type LazyHostedApiDocument,
 } from "./implementation/api-document.ts";
 export {
+  callerSpanAttributes,
   CurrentUserId,
   ApiAuthentication,
   Authentication,
@@ -35,6 +38,7 @@ export { organizationDefaults } from "./implementation/organization-defaults.ts"
 export { executorDefaultRedeployed } from "./implementation/executor-app-upgrades.ts";
 export { hostedAppCopies } from "./implementation/profile-app-copies.ts";
 export { linkAppAccount, linkUserAccount } from "./implementation/app-accounts.ts";
+export { memberSetupProgress, type SetupProgress } from "./implementation/setup-progress.ts";
 export {
   lookupMembership,
   lookupOrganizationSlug,
diff --git a/apps/hosted/testing/api-document-fixture.ts b/apps/hosted/testing/api-document-fixture.ts
new file mode 100644
index 0000000000..f009e849f4
--- /dev/null
+++ b/apps/hosted/testing/api-document-fixture.ts
@@ -0,0 +1,63 @@
+/**
+ * Test host only: while armed, /openapi.json serves another revision of the product's API, as an
+ * API deployed apart from the Workers that call apps can for a few seconds of a rollout. Every
+ * operation of that revision has `otherRevisionSuffix` on its operationId, so a listing read from
+ * it is told apart from the product's own. The server still binds its apps to the SHA-256 of the
+ * document it generated, so the served one is not of that revision. Production entry points never
+ * provide it.
+ */
+import { Effect, Layer, Option, Schema } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+
+const path = "/api/devtools/api-document";
+/** The suffix another revision's operations carry. */
+export const otherRevisionSuffix = "OtherRevision";
+
+const Operation = Schema.Struct({ operationId: Schema.String });
+const Document = Schema.Struct({
+  paths: Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Unknown)),
+});
+
+/** The product's document with every operation renamed. */
+const otherRevision = (served: string) => {
+  const document: unknown = JSON.parse(served);
+  for (const methods of Object.values(Schema.decodeUnknownSync(Document)(document).paths))
+    for (const operation of Object.values(methods))
+      if (Schema.is(Operation)(operation))
+        Object.assign(operation, { operationId: `${operation.operationId}${otherRevisionSuffix}` });
+  return JSON.stringify(document);
+};
+
+export const apiDocumentFixture = Effect.sync(() => {
+  let armed = false;
+  const toggle = (value: boolean) =>
+    Effect.sync(() => {
+      armed = value;
+      return HttpServerResponse.jsonUnsafe({ armed });
+    });
+  return Layer.mergeAll(
+    HttpRouter.add("POST", path, toggle(true)),
+    HttpRouter.add("DELETE", path, toggle(false)),
+    HttpRouter.middleware(
+      (app) =>
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const url = HttpServerRequest.toURL(request);
+          if (
+            !armed ||
+            request.method !== "GET" ||
+            Option.isNone(url) ||
+            url.value.pathname !== "/openapi.json"
+          )
+            return yield* app;
+          const served = yield* app;
+          if (served.status !== 200 || served.body._tag !== "Uint8Array") return served;
+          return HttpServerResponse.text(
+            otherRevision(new TextDecoder().decode(served.body.body)),
+            { contentType: "application/json" },
+          );
+        }),
+      { global: true },
+    ),
+  );
+});
diff --git a/apps/hosted/testing/cloud-evaluated-fixture.ts b/apps/hosted/testing/cloud-evaluated-fixture.ts
new file mode 100644
index 0000000000..409dd6ebf3
--- /dev/null
+++ b/apps/hosted/testing/cloud-evaluated-fixture.ts
@@ -0,0 +1,54 @@
+/**
+ * Local-only: expire one evaluated result kept in the managed Cloud's app data supervisors, as a
+ * day passing does, so the supervisor's next command removes it and a read of it misses. The
+ * supervisors are Alchemy's local Durable Objects, each a SQLite file under `directory`; only rows
+ * of the exact `key` are changed. Prints how many rows were expired. Never installed in a server.
+ */
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { DatabaseSync } from "node:sqlite";
+import { Config, Console, Effect, FileSystem, Schema } from "effect";
+import { Command, Flag } from "effect/cli";
+
+const command = Command.make("cloud-evaluated-fixture", {
+  directory: Flag.String("directory"),
+  key: Flag.String("key"),
+}).pipe(
+  Command.withHandler((args) =>
+    Effect.gen(function* () {
+      yield* Config.String("NODE_ENV").pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Literal("test"))),
+      );
+      const fs = yield* FileSystem.FileSystem;
+      const supervisors = (yield* fs.readDirectory(args.directory)).filter((name) =>
+        name.endsWith("-AppDataSupervisor"),
+      );
+      let expired = 0;
+      for (const supervisor of supervisors)
+        for (const name of yield* fs.readDirectory(`${args.directory}/${supervisor}`)) {
+          if (!name.endsWith(".sqlite")) continue;
+          const database = new DatabaseSync(`${args.directory}/${supervisor}/${name}`, {
+            timeout: 2_000,
+          });
+          try {
+            const table = database
+              .prepare("SELECT 1 FROM sqlite_master WHERE name = 'executor_evaluated'")
+              .get();
+            if (table !== undefined)
+              expired += Number(
+                database
+                  .prepare("UPDATE executor_evaluated SET until = 0 WHERE key = ?")
+                  .run(args.key).changes,
+              );
+          } finally {
+            database.close();
+          }
+        }
+      yield* Console.log(JSON.stringify({ expired }));
+    }),
+  ),
+);
+
+NodeRuntime.runMain(
+  Command.run(command, { version: "0.0.0" }).pipe(Effect.provide(NodeServices.layer)),
+);
diff --git a/apps/hosted/testing/database-pool-fixture.ts b/apps/hosted/testing/database-pool-fixture.ts
index 7783b2befb..bf716af744 100644
--- a/apps/hosted/testing/database-pool-fixture.ts
+++ b/apps/hosted/testing/database-pool-fixture.ts
@@ -37,11 +37,13 @@ import {
   Effect,
   Cause,
   Context,
+  Deferred,
   Exit,
   Fiber,
   FileSystem,
   Layer,
   Redacted,
+  Schedule,
   Schema,
   type Scope,
 } from "effect";
@@ -141,9 +143,11 @@ const command = Command.make("database-pool-fixture", {
         const applicationName = `e2e pool ${run}`;
         const table = `e2e_pool_${run}`;
         const lockKey = Number.parseInt(run.slice(0, 7), 16);
+        // A second lock of the run's, above every run's first.
+        const gateKey = lockKey + 2 ** 28;
 
         const admin = yield* Effect.acquireRelease(
-          Effect.sync(() => new Pool({ connectionString: target.toString(), max: 2 })),
+          Effect.sync(() => new Pool({ connectionString: target.toString(), max: 3 })),
           (pool) => Effect.promise(() => pool.end()),
         );
         const adminQuery = (text: string, values: ReadonlyArray<unknown> = []) =>
@@ -197,19 +201,20 @@ const command = Command.make("database-pool-fixture", {
               Effect.orDie,
             );
 
-        /** Holds the run's advisory lock on its own connection until the scope closes. */
-        const holdLock = Effect.acquireRelease(
-          Effect.promise(async () => {
-            const client = await admin.connect();
-            await client.query("SELECT pg_advisory_lock($1)", [lockKey]);
-            return client;
-          }),
-          (client) =>
+        /** Holds the advisory lock `key` on its own connection until the scope closes. */
+        const holdLock = (key: number) =>
+          Effect.acquireRelease(
             Effect.promise(async () => {
-              await client.query("SELECT pg_advisory_unlock($1)", [lockKey]);
-              client.release();
+              const client = await admin.connect();
+              await client.query("SELECT pg_advisory_lock($1)", [key]);
+              return client;
             }),
-        );
+            (client) =>
+              Effect.promise(async () => {
+                await client.query("SELECT pg_advisory_unlock($1)", [key]);
+                client.release();
+              }),
+          );
         /** A statement that waits on the run's lock, given up on after `millis`. */
         const lockWait = (pool: PgPool.PgPool, millis: number) =>
           pool
@@ -217,6 +222,18 @@ const command = Command.make("database-pool-fixture", {
               connection.query("SELECT pg_advisory_xact_lock($1)", [lockKey], false),
             )
             .pipe(Effect.timeoutOption(`${millis} millis`), Effect.exit);
+        /** Waits until a statement of the run's pools waits on an advisory lock. */
+        const waitingOnLock = adminQuery(
+          "SELECT count(*)::int AS waiting FROM pg_stat_activity WHERE application_name = $1 AND wait_event = 'advisory'",
+          [applicationName],
+        ).pipe(
+          Effect.filterOrFail(
+            (result) => result.rows[0].waiting > 0,
+            () => new Error("No statement of the run waits on a lock"),
+          ),
+          Effect.retry({ schedule: Schedule.spaced("10 millis"), times: 1_000 }),
+          Effect.orDie,
+        );
 
         const since = (start: number) => Date.now() - start;
         const outcome = <A, E>(exit: Exit.Exit<A, E>) =>
@@ -231,11 +248,15 @@ const command = Command.make("database-pool-fixture", {
             case "use-once": {
               yield* adminQuery(`CREATE TABLE ${table} (id serial PRIMARY KEY)`);
               yield* Effect.addFinalizer(() => adminQuery(`DROP TABLE IF EXISTS ${table}`));
-              yield* holdLock;
+              yield* holdLock(lockKey);
               // Cancels never land, so the abandoned lock wait keeps its connection refusing.
               const { pool: shared } = yield* pool({ maxConnections: 4, cancels: "dropped" });
               // One group: a callback inserts, then reads after its sibling on the same connection
-              // has given up on a lock wait. The read is refused unsent; the insert was sent.
+              // has given up on a lock wait. The read is refused unsent; the insert was sent. Each
+              // sibling starts once its callback has the group's connection, so its lock wait goes
+              // out on that connection, behind what the callback sent.
+              const inserted = yield* Deferred.make<void>();
+              const gaveUp = yield* Deferred.make<void>();
               const [twoStatements, sibling] = yield* PgPool.grouped(
                 Effect.all(
                   [
@@ -244,30 +265,40 @@ const command = Command.make("database-pool-fixture", {
                         connection
                           .query(`INSERT INTO ${table} DEFAULT VALUES`, [], false)
                           .pipe(
-                            Effect.andThen(Effect.sleep("150 millis")),
+                            Effect.ensuring(Deferred.succeed(inserted, undefined)),
+                            Effect.andThen(Deferred.await(gaveUp)),
                             Effect.andThen(connection.query("SELECT 1", [], false)),
                           ),
                       )
                       .pipe(Effect.exit),
-                    Effect.sleep("20 millis").pipe(Effect.andThen(lockWait(shared, 40))),
+                    Deferred.await(inserted).pipe(
+                      Effect.andThen(lockWait(shared, 40)),
+                      Effect.tap(() => Deferred.succeed(gaveUp, undefined)),
+                    ),
                   ],
                   { concurrency: "unbounded" },
                 ),
               );
               // Another group: the same, but the callback sends nothing before its read is refused.
+              const leased = yield* Deferred.make<void>();
+              const otherGaveUp = yield* Deferred.make<void>();
               const [firstRead, otherSibling] = yield* PgPool.grouped(
                 Effect.all(
                   [
                     shared
                       .use((connection) =>
-                        Effect.sleep("150 millis").pipe(
+                        Deferred.succeed(leased, undefined).pipe(
+                          Effect.andThen(Deferred.await(otherGaveUp)),
                           Effect.andThen(
                             connection.query("SELECT pg_backend_pid() AS pid", [], false),
                           ),
                         ),
                       )
                       .pipe(Effect.exit),
-                    Effect.sleep("20 millis").pipe(Effect.andThen(lockWait(shared, 40))),
+                    Deferred.await(leased).pipe(
+                      Effect.andThen(lockWait(shared, 40)),
+                      Effect.tap(() => Deferred.succeed(otherGaveUp, undefined)),
+                    ),
                   ],
                   { concurrency: "unbounded" },
                 ),
@@ -377,7 +408,7 @@ const command = Command.make("database-pool-fixture", {
               const arm = (cancels: "dropped" | "delivered") =>
                 Effect.scoped(
                   Effect.gen(function* () {
-                    yield* holdLock;
+                    yield* holdLock(lockKey);
                     const { pool: single, cancels: seen } = yield* pool({
                       maxConnections: 1,
                       cancels,
@@ -508,34 +539,34 @@ const command = Command.make("database-pool-fixture", {
               };
             }
             case "sibling": {
-              yield* holdLock;
+              yield* holdLock(lockKey);
               const { pool: shared } = yield* pool({ maxConnections: 4, cancels: "dropped" });
-              const start = Date.now();
-              // A sibling queued behind the awaited statement gives up on its lock wait; its
-              // cancel never lands, so draining it takes the 5 s bound.
-              const [awaited, abandoned] = yield* PgPool.grouped(
-                Effect.all(
-                  [
-                    shared
-                      .use((connection) => connection.query("SELECT pg_sleep(0.2)", [], false))
-                      .pipe(
-                        Effect.exit,
-                        Effect.map((exit) => ({ exit, at: since(start) })),
-                      ),
-                    Effect.sleep("10 millis").pipe(
-                      Effect.andThen(lockWait(shared, 50)),
-                      Effect.map((exit) => ({ exit, at: since(start) })),
-                    ),
-                  ],
-                  { concurrency: "unbounded" },
-                ),
+              // The awaited statement waits on a second lock, the gate, so a sibling queued behind
+              // it gives up on its lock wait while it still runs. The sibling's cancel never lands,
+              // so draining it takes the 5 s bound. The gate opens once the sibling has given up.
+              return yield* PgPool.grouped(
+                Effect.gen(function* () {
+                  const { awaited, abandoned } = yield* Effect.scoped(
+                    Effect.gen(function* () {
+                      yield* holdLock(gateKey);
+                      const awaited = yield* shared
+                        .use((connection) =>
+                          connection.query("SELECT pg_advisory_xact_lock($1)", [gateKey], false),
+                        )
+                        .pipe(Effect.exit, Effect.forkChild);
+                      yield* waitingOnLock;
+                      return { awaited, abandoned: yield* lockWait(shared, 50) };
+                    }),
+                  );
+                  const opened = Date.now();
+                  const exit = yield* Fiber.join(awaited);
+                  return {
+                    awaited: outcome(exit),
+                    awaitedReturned: since(opened),
+                    gaveUp: Exit.isSuccess(abandoned) && abandoned.value._tag === "None",
+                  };
+                }),
               );
-              return {
-                awaited: outcome(awaited.exit),
-                awaitedReturned: awaited.at,
-                gaveUp: Exit.isSuccess(abandoned.exit) && abandoned.exit.value._tag === "None",
-                abandonedReturned: abandoned.at,
-              };
             }
           }
         });
diff --git a/apps/hosted/testing/self-host.ts b/apps/hosted/testing/self-host.ts
index 9f3b685d94..2d35e98027 100644
--- a/apps/hosted/testing/self-host.ts
+++ b/apps/hosted/testing/self-host.ts
@@ -15,6 +15,7 @@ import { developmentSettings, developmentSignIn } from "./development.ts";
 import { accessCheckFixture } from "./access-check-fixture.ts";
 import { statementHoldFixture } from "./statement-hold-fixture.ts";
 import { storageFaultFixture } from "./storage-fault-fixture.ts";
+import { apiDocumentFixture } from "./api-document-fixture.ts";
 
 /**
  * Zero-config defaults; explicit settings win. The hostname is per checkout so browser
@@ -55,12 +56,13 @@ const command = Command.make("test-self-host", {
         Effect.gen(function* () {
           const development = yield* developmentSignIn(target, organization);
           const statementHold = yield* statementHoldFixture;
-          const product = yield* statementHold.provide(selfHostRoutes);
+          const product = yield* storageFault.provide(statementHold.provide(selfHostRoutes));
           const routes = Layer.mergeAll(
             HttpRouter.add("GET", "/api/devtools", development.status),
             HttpRouter.add("POST", "/api/devtools/operator", development.signIn),
             statementHold.routes,
             storageFault.routes,
+            yield* apiDocumentFixture,
             product,
             accessCheckFixture,
           );
diff --git a/apps/hosted/testing/storage-fault-fixture.ts b/apps/hosted/testing/storage-fault-fixture.ts
index 6742657113..15a4ae6c57 100644
--- a/apps/hosted/testing/storage-fault-fixture.ts
+++ b/apps/hosted/testing/storage-fault-fixture.ts
@@ -4,17 +4,39 @@
  * names the spans the read must run inside (for example `sdk.invocation.snapshot`), so reads of
  * the same ID elsewhere, such as the host's own authorization reads, pass untouched. The
  * statement is replaced by one the database rejects, so the failure is a real SQL error from the
- * driver. Production entry points never provide it.
+ * driver. It can instead fail the commit of the next transaction inside the named spans: the
+ * database refuses the commit, or answers it with its timeout error, and rolls the transaction
+ * back; or the commit applies and its answer is lost, as a dropped connection would lose it.
+ * Production entry points never provide it.
  */
 import { Effect, Layer, Option, Schema, type Tracer } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { SqlClient, SqlError } from "effect/sql";
 import * as Statement from "effect/sql/Statement";
 
 const path = "/api/devtools/storage-fault";
-const Arm = Schema.Struct({
-  binds: Schema.NonEmptyString,
-  within: Schema.NonEmptyArray(Schema.NonEmptyString),
-});
+const Within = Schema.NonEmptyArray(Schema.NonEmptyString);
+const Arm = Schema.Union([
+  Schema.Struct({ binds: Schema.NonEmptyString, within: Within }),
+  Schema.Struct({ commit: Schema.Literals(["refused", "timeout", "lost"]), within: Within }),
+]);
+/**
+ * Runs last in the transaction: a deferred trigger the database fires at COMMIT, which fails it.
+ * PGlite has no statement timer, so the timeout is the error PostgreSQL's timer raises.
+ */
+const commitFault = (fault: "refused" | "timeout") => `
+create temp table executor_test_commit_fault (id int) on commit drop;
+create function pg_temp.executor_test_commit_fault() returns trigger language plpgsql as $$
+begin
+  ${
+    fault === "refused"
+      ? "raise exception 'storage fault fixture: commit refused';"
+      : "perform pg_sleep(0.2); raise exception 'canceling statement due to statement timeout' using errcode = 'query_canceled';"
+  }
+end $$;
+create constraint trigger executor_test_commit_fault after insert on executor_test_commit_fault
+  deferrable initially deferred for each row execute function pg_temp.executor_test_commit_fault();
+insert into executor_test_commit_fault values (1);`;
 
 /** Names of the spans enclosing a statement, innermost first. */
 const enclosing = (span: Tracer.AnySpan): ReadonlyArray<string> => {
@@ -28,13 +50,16 @@ const enclosing = (span: Tracer.AnySpan): ReadonlyArray<string> => {
 };
 
 export const storageFaultFixture = Effect.sync(() => {
-  /** Armed until a read binding the ID inside every named span reaches it; then reported until the next arm. */
+  /**
+   * Armed until a read binding the ID, or a transaction for a commit fault, inside every named span
+   * reaches it; then reported until the next arm.
+   */
   let armed: typeof Arm.Type | undefined;
   let failed: ReadonlyArray<string> | undefined;
   const transformer: Statement.Transformer = (statement, sql, _fiber, span) =>
     Effect.sync(() => {
       const fault = armed;
-      if (fault === undefined) return statement;
+      if (fault === undefined || !("binds" in fault)) return statement;
       const [text, params] = statement.compile();
       if (!/^\s*select\b/iu.test(text) || !params.includes(fault.binds)) return statement;
       const spans = enclosing(span);
@@ -43,6 +68,47 @@ export const storageFaultFixture = Effect.sync(() => {
       failed = spans;
       return sql`select executor_test_storage_fault()`;
     });
+  const sql = (client: SqlClient.SqlClient): SqlClient.SqlClient =>
+    new Proxy(client, {
+      get: (target, property, receiver) =>
+        property !== "withTransaction"
+          ? Reflect.get(target, property, receiver)
+          : <A, E, R>(work: Effect.Effect<A, E, R>) =>
+              Effect.flatMap(
+                Effect.currentParentSpan.pipe(
+                  Effect.map(enclosing),
+                  Effect.orElseSucceed((): ReadonlyArray<string> => []),
+                ),
+                (spans) => {
+                  const fault = armed;
+                  if (
+                    fault === undefined ||
+                    !("commit" in fault) ||
+                    !fault.within.every((name) => spans.includes(name))
+                  )
+                    return target.withTransaction(work);
+                  armed = undefined;
+                  failed = spans;
+                  const commit = fault.commit;
+                  if (commit !== "lost")
+                    return target.withTransaction(
+                      Effect.tap(work, () => target.unsafe(commitFault(commit)).unprepared),
+                    );
+                  return Effect.andThen(
+                    target.withTransaction(work),
+                    Effect.die(
+                      new SqlError.SqlError({
+                        reason: new SqlError.ConnectionError({
+                          cause: new Error("Connection closed"),
+                          message: "Storage fault fixture: commit answer lost",
+                          operation: "commit",
+                        }),
+                      }),
+                    ),
+                  );
+                },
+              ),
+    });
   const routes = Layer.mergeAll(
     HttpRouter.add(
       "POST",
@@ -75,6 +141,9 @@ export const storageFaultFixture = Effect.sync(() => {
   return {
     /** Every statement the server runs passes through the transformer. */
     transformer,
+    /** Compose the product with its SQL client's transactions open to the commit fault. */
+    provide: <A, E, R>(product: Effect.Effect<A, E, R>) =>
+      product.pipe(Effect.updateService(SqlClient.SqlClient, sql)),
     routes,
   };
 });
diff --git a/apps/hosted/web/src/contracts/accounts.ts b/apps/hosted/web/src/contracts/accounts.ts
index b5847ea89d..4be09956a7 100644
--- a/apps/hosted/web/src/contracts/accounts.ts
+++ b/apps/hosted/web/src/contracts/accounts.ts
@@ -1,6 +1,6 @@
 import { hydrated } from "@executor-js/ui/contracts/http";
 import { revalidated } from "@executor-js/ui/contracts/refresh";
-import { refreshAppLinks } from "./app-accounts.ts";
+import { acknowledgeLinkChecks, refreshAppLinks } from "./app-accounts.ts";
 import { discoveryTarget, refreshAppDiscovery } from "./app-discovery.ts";
 import { linkedAccountIds } from "@executor-js/ui/contracts/app-accounts";
 import { acknowledgeResourceAccount, resourceDirectoryAtom } from "./resource-access.ts";
@@ -72,9 +72,12 @@ class AppAccountKey extends Data.Class<{
 const checkAppAccount = Atom.family((key: AppAccountKey) =>
   HostedClient.runtime.fn((_: void, get) =>
     runCheck(get, new AccountKey({ organization: key.organization, account: key.account })).pipe(
-      // The app's Accounts tab shows each linked account's health from the app's links.
-      Effect.tap(() =>
-        Effect.sync(() => refreshAppLinks(get, { organization: key.organization, app: key.app })),
+      // The app's Accounts tab shows each linked account's health from the app's links, which
+      // show the results before the check settles, so the row never falls back to the old ones.
+      Effect.tap((health) =>
+        Effect.sync(() =>
+          acknowledgeLinkChecks(get, { organization: key.organization, app: key.app }, health),
+        ),
       ),
     ),
   ),
diff --git a/apps/hosted/web/src/contracts/app-accounts.ts b/apps/hosted/web/src/contracts/app-accounts.ts
index ca9b702a15..2caaeace9a 100644
--- a/apps/hosted/web/src/contracts/app-accounts.ts
+++ b/apps/hosted/web/src/contracts/app-accounts.ts
@@ -7,9 +7,17 @@ import { hydrated } from "@executor-js/ui/contracts/http";
 import { pollingQuery } from "@executor-js/ui/contracts/polling";
 import { revalidated } from "@executor-js/ui/contracts/refresh";
 import { acknowledge } from "@executor-js/ui/contracts/mutations";
+import { withCheckedApps } from "@executor-js/ui/contracts/dashboard";
 import { Data, Effect } from "effect";
 import { Atom } from "effect/reactivity";
-import type { AccountId, AccountScope, App, AppId, VersionId } from "@executor-js/sdk";
+import type {
+  AccountHealth,
+  AccountId,
+  AccountScope,
+  App,
+  AppId,
+  VersionId,
+} from "@executor-js/sdk";
 import type { OrganizationReference } from "@executor-js/hosted-server/organization";
 import { HostedClient } from "./api.ts";
 import { protectedQuery } from "./protected-query.ts";
@@ -125,6 +133,17 @@ export const refreshAppLinks = (
     );
 };
 
+/** Show a check's results in the app's links as soon as it finishes, then read them again. */
+export const acknowledgeLinkChecks = (
+  get: Atom.FnContext,
+  key: { readonly organization: OrganizationReference; readonly app: AppId },
+  health: AccountHealth,
+) => {
+  const app = new AppKey(key);
+  for (const list of [appLinks(app), userLinks(app)])
+    acknowledge(get, list, (rows) => rows.map((row) => withCheckedApps(row, health)));
+};
+
 const sameLink = (row: AppAccountLink, key: LinkKey) =>
   row.requirement === key.requirement && row.account.id === key.account;
 
diff --git a/apps/hosted/web/src/contracts/app-ui.ts b/apps/hosted/web/src/contracts/app-ui.ts
index 296e544f49..b28a7b2347 100644
--- a/apps/hosted/web/src/contracts/app-ui.ts
+++ b/apps/hosted/web/src/contracts/app-ui.ts
@@ -103,6 +103,7 @@ const message = Match.type<AppUiError>().pipe(
     AppNotDeployed: () => "Deploy this app before opening its page.",
     VersionNotFound: () => "This app’s version is no longer available. Reload the app.",
     StorageError: () => "Executor could not read this app. Try again.",
+    RequestInvalid: () => "This page sent a request Executor could not accept. Reload the page.",
     AppUiUnavailable: () =>
       "The app page is unavailable. Check its version and the server’s app URL settings.",
     Unauthorized: () => "Your session ended. Sign in again.",
diff --git a/apps/hosted/web/src/contracts/apps.ts b/apps/hosted/web/src/contracts/apps.ts
index 49ca6929f1..4dccf74912 100644
--- a/apps/hosted/web/src/contracts/apps.ts
+++ b/apps/hosted/web/src/contracts/apps.ts
@@ -15,6 +15,7 @@ import {
   type AccountScope,
   type ProviderId,
   HttpUrl,
+  OAuthClientId,
   type App,
   type Account,
   type AccountId,
@@ -414,6 +415,8 @@ export const PendingOAuth = Schema.Struct({
   /** A reconnect keeps its account name, so completion does not ask for one. */
   reconnect: Schema.optionalKey(Schema.Boolean),
   manualClient: Schema.optionalKey(Schema.Boolean),
+  /** The client this attempt registered, which stays registered if sign-in fails. */
+  registeredClient: Schema.optionalKey(OAuthClientId),
   /** The page the sign-in started from when it is not the app's own: onboarding's account step. */
   returnTo: Schema.optionalKey(OAuthReturn),
 });
diff --git a/apps/hosted/web/src/contracts/errors.ts b/apps/hosted/web/src/contracts/errors.ts
index 19cfd03509..c13f47f07e 100644
--- a/apps/hosted/web/src/contracts/errors.ts
+++ b/apps/hosted/web/src/contracts/errors.ts
@@ -54,6 +54,7 @@ const errorMessage = Match.type<HostedError>().pipe(
       })[reason],
     RegistryError: registryErrorMessage,
     AppAccessDenied: () => "You do not have permission to change this app.",
+    FullListingNameRequired: (error) => `${error.description} ${error.recovery.action}`,
     AppSlugTaken: () => "Another app name produces this address. Choose a different name.",
     AppNameTaken: () => "An app already uses this name. Choose another name.",
     AppVersionChanged: () =>
diff --git a/apps/hosted/web/src/contracts/navigation.ts b/apps/hosted/web/src/contracts/navigation.ts
index d8873731ab..9c8ccca46c 100644
--- a/apps/hosted/web/src/contracts/navigation.ts
+++ b/apps/hosted/web/src/contracts/navigation.ts
@@ -1,27 +1,29 @@
-import { AccountConnectionId, AccountId } from "@executor-js/sdk";
+import { AccountConnectionId, AccountId, OAuthClientId } from "@executor-js/sdk";
 import { GrantId } from "@executor-js/mcp-auth/grants";
 import { AppView, AppViewFromUrl, AssistantId } from "@executor-js/ui/contracts/dashboard";
 import { Option, Schema } from "effect";
 import { OrganizationId } from "@executor-js/hosted-server/organization";
 import type { AgentBaseline } from "./mcp-connections.ts";
 
-/** A failed OAuth attempt can reopen its client fields without placing credentials in the URL. */
+/**
+ * A failed OAuth attempt can reopen its client fields without placing credentials in the URL:
+ * `change` enters new details, and a registered client's ID edits that client.
+ */
+export const ClientRecovery = Schema.Union([Schema.Literal("change"), OAuthClientId]);
 export const ConnectionSearch = Schema.Struct({
-  client: Schema.optionalKey(Schema.Literal("change")),
+  client: Schema.optionalKey(ClientRecovery),
 });
 
 /** Direct links and refreshes retain a connection dialog on its app page. */
 export function parseConnectionSearch(search: Record<string, unknown>): {
   readonly connection?: AccountConnectionId | undefined;
-  readonly client?: "change" | undefined;
+  readonly client?: typeof ClientRecovery.Type | undefined;
 } {
   return {
     connection: Option.getOrUndefined(
       Schema.decodeUnknownOption(AccountConnectionId)(search.connection),
     ),
-    client: Option.getOrUndefined(
-      Schema.decodeUnknownOption(Schema.Literal("change"))(search.client),
-    ),
+    client: Option.getOrUndefined(Schema.decodeUnknownOption(ClientRecovery)(search.client)),
   };
 }
 
@@ -146,16 +148,14 @@ export function hostedPageTitle(
   if (page === "organization") return "Settings";
   if (page === "approvals") return item ? "Review request" : "Approvals";
   if (page === "groups") return item ? "Group" : "Groups";
-  if (page === "connect") return "Connections";
+  if (page === "connect") return item ? "Connection" : "Connections";
   if (page === "webhooks") return "Webhook setup";
   if (page === "connections") return "Connect account";
   if (page === "apps")
     return action === "approve"
       ? "Review request"
       : item === "add"
-        ? action === "custom"
-          ? "Add custom app"
-          : "Add app"
+        ? "App catalog"
         : item
           ? "App"
           : "Apps";
diff --git a/apps/hosted/web/src/contracts/product-analytics.ts b/apps/hosted/web/src/contracts/product-analytics.ts
index 91093ac9de..5aeb695a3c 100644
--- a/apps/hosted/web/src/contracts/product-analytics.ts
+++ b/apps/hosted/web/src/contracts/product-analytics.ts
@@ -1,6 +1,6 @@
 /** Explicit browser actions carry only authored labels and outcomes, never form values or URLs. */
 import { Effect, Exit, Cause, Schema } from "effect";
-import { SetupOrder } from "@executor-js/hosted-server/setup";
+import { SetupOrder, SetupSkip } from "@executor-js/hosted-server/setup";
 import { AssistantId } from "@executor-js/ui/contracts/dashboard";
 
 const Label = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9_.-]{0,79}$/u));
@@ -12,6 +12,8 @@ export const BrowserUsage = Schema.Struct({
   outcome: Schema.Literals(["started", "success", "failure", "cancelled", "viewed"]),
   /** The setup order an onboarding step showed, set only for a team in the onboarding experiment. */
   onboarding_variant: Schema.optionalKey(SetupOrder),
+  /** Whether its steps could be skipped, set only for a member in the onboarding skip experiment. */
+  onboarding_skip_variant: Schema.optionalKey(SetupSkip),
   /** The assistant a setup step's guide is for, on the steps that follow picking one. */
   assistant: Schema.optionalKey(AssistantId),
 });
diff --git a/apps/hosted/web/src/implementation/components/add-app.tsx b/apps/hosted/web/src/implementation/components/add-app.tsx
new file mode 100644
index 0000000000..049af6a780
--- /dev/null
+++ b/apps/hosted/web/src/implementation/components/add-app.tsx
@@ -0,0 +1,64 @@
+import { Link, useNavigate } from "@tanstack/react-router";
+import type { DeployedApp } from "@executor-js/sdk";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { ArrowLeft02Icon } from "@hugeicons/core-free-icons";
+import {
+  MakeYourOwn as SharedMakeYourOwn,
+  AddAppMenu as SharedMenu,
+} from "@executor-js/ui/dashboard/add-app";
+import { useMcpOrigin } from "../resource-origin.ts";
+import { HostedFailure, useDashboardAtoms } from "./dashboard-bindings.tsx";
+import { useOrganizationRoute } from "./organization.tsx";
+
+/** Add app's way back to Apps, also shown while the page loads. */
+export function AddAppBack({ organizationSlug }: { readonly organizationSlug: string }) {
+  return (
+    <Link
+      to="/org/$organizationSlug/apps"
+      params={{ organizationSlug }}
+      className="back-link inline-flex gap-1.5 items-center text-[12px] text-muted-foreground mb-4.25 hover:text-foreground max-[740px]:min-h-11 max-[740px]:inline-flex max-[740px]:items-center max-[740px]:-mt-2 max-[740px]:mb-3"
+    >
+      <HugeiconsIcon icon={ArrowLeft02Icon} size={14} />
+      Apps
+    </Link>
+  );
+}
+
+/** Custom MCP imports install into the organization and open the new app. */
+function useAddAppDialogs() {
+  const mcpOrigin = useMcpOrigin();
+  const { slug: organizationSlug } = useOrganizationRoute();
+  const atoms = useDashboardAtoms();
+  const navigate = useNavigate();
+  return {
+    endpoint: `${mcpOrigin}/mcp`,
+    mutation: atoms.importCustom,
+    Failure: HostedFailure,
+    onInstalled: (app: DeployedApp) =>
+      navigate({
+        to: "/org/$organizationSlug/apps/$appId",
+        search: { view: Object.keys(app.requirements.accounts).length ? "accounts" : "overview" },
+        params: { organizationSlug, appId: app.id },
+      }),
+  };
+}
+
+/** Apps' Add app menu: make your own app or browse the catalog page. */
+export function AddAppMenu() {
+  const { slug: organizationSlug } = useOrganizationRoute();
+  return (
+    <SharedMenu
+      {...useAddAppDialogs()}
+      catalog={(content) => (
+        <Link to="/org/$organizationSlug/apps/add" params={{ organizationSlug }}>
+          {content}
+        </Link>
+      )}
+    />
+  );
+}
+
+/** The catalog page's button and link to making your own app. */
+export function MakeYourOwn({ appearance }: { readonly appearance?: "link" | "button" }) {
+  return <SharedMakeYourOwn appearance={appearance} {...useAddAppDialogs()} />;
+}
diff --git a/apps/hosted/web/src/implementation/components/auth.tsx b/apps/hosted/web/src/implementation/components/auth.tsx
index e2ce5d5172..66140ae76b 100644
--- a/apps/hosted/web/src/implementation/components/auth.tsx
+++ b/apps/hosted/web/src/implementation/components/auth.tsx
@@ -101,10 +101,13 @@ export function AuthBoundary({ children }: { readonly children: ReactNode }) {
 export function SessionMenu({
   signOutLabel,
   organization,
+  onSignOut,
 }: {
   readonly signOutLabel?: string;
   /** The organization the visitor is in, so account pages know where to return. */
   readonly organization?: string | undefined;
+  /** Called as the person chooses to sign out, before the session ends. */
+  readonly onSignOut?: (() => void) | undefined;
 } = {}) {
   const session = AsyncResult.value(useAtomValue(sessionAtom));
   const signOut = useAtomSet(signOutAtom, { mode: "promiseExit" });
@@ -127,6 +130,7 @@ export function SessionMenu({
   );
   const leave = async () => {
     setError(null);
+    onSignOut?.();
     const result = await signOut();
     if (Exit.isFailure(result)) {
       const failure = Cause.squash(result.cause);
diff --git a/apps/hosted/web/src/implementation/components/dashboard-frame.tsx b/apps/hosted/web/src/implementation/components/dashboard-frame.tsx
index 1b98d761d9..14d5456315 100644
--- a/apps/hosted/web/src/implementation/components/dashboard-frame.tsx
+++ b/apps/hosted/web/src/implementation/components/dashboard-frame.tsx
@@ -4,7 +4,7 @@ import {
   BoxesIcon,
   FingerPrintIcon,
   Key01Icon,
-  Plug01Icon,
+  ConnectIcon,
   Settings05Icon,
   Shield01Icon,
   UserCircleIcon,
@@ -21,7 +21,7 @@ import { useDocumentationUrl } from "../documentation.ts";
 
 const items = [
   { to: "/org/$organizationSlug/apps", label: "Apps", icon: BoxesIcon },
-  { to: "/org/$organizationSlug/connect", label: "Connections", icon: Plug01Icon },
+  { to: "/org/$organizationSlug/connect", label: "Connections", icon: ConnectIcon },
   { to: "/org/$organizationSlug/accounts", label: "Accounts", icon: UserCircleIcon },
   { to: "/org/$organizationSlug/approvals", label: "Approvals", icon: Shield01Icon },
   { to: "/org/$organizationSlug/groups", label: "Groups", icon: UserGroupIcon },
diff --git a/apps/hosted/web/src/implementation/components/page-pending.tsx b/apps/hosted/web/src/implementation/components/page-pending.tsx
index 970b0680fd..21da40e50f 100644
--- a/apps/hosted/web/src/implementation/components/page-pending.tsx
+++ b/apps/hosted/web/src/implementation/components/page-pending.tsx
@@ -3,6 +3,7 @@ import { AppId } from "@executor-js/sdk";
 import { Option, Schema } from "effect";
 import { useHydrated } from "@executor-js/ui/hooks/hydrated";
 import { OrganizationSettingsPending } from "./organization-settings-pending.tsx";
+import { AddAppBack } from "./add-app.tsx";
 import { Skeleton } from "@executor-js/ui/components/skeleton";
 import { AppDetailPending } from "@executor-js/ui/dashboard/app-loading";
 import { PageFrame, PageHeader } from "@executor-js/ui/dashboard/page";
@@ -11,6 +12,7 @@ import { Link, useLocation } from "@tanstack/react-router";
 import {
   ApprovalCardPending,
   ApprovalsPending,
+  CatalogPageSkeleton,
   InventoryPageSkeleton,
   PageSkeleton,
   WebhookSetupFrame,
@@ -199,7 +201,9 @@ export function PagePending({
         <WebhookSetupLoading />
       </WebhookSetupFrame>
     );
-  if (page === "apps" && item === "add") return <PageSkeleton title="Add app" />;
+  if (page === "apps" && item === "add" && action === undefined)
+    return <CatalogPageSkeleton back={<AddAppBack organizationSlug={organizationSlug} />} />;
+  if (page === "apps" && item === "add") return <PageSkeleton title="App catalog" />;
   if (page === "accounts") return <PageSkeleton title="Account" />;
   if (page === "apps") return <PageSkeleton title="App" />;
   if (page === "connect") return <PageSkeleton title="Connections" />;
diff --git a/apps/hosted/web/src/implementation/components/setup-page.tsx b/apps/hosted/web/src/implementation/components/setup-page.tsx
index e8e68e463d..fd81593e26 100644
--- a/apps/hosted/web/src/implementation/components/setup-page.tsx
+++ b/apps/hosted/web/src/implementation/components/setup-page.tsx
@@ -1,4 +1,4 @@
-import type { ComponentProps, ReactElement, ReactNode } from "react";
+import { type ComponentProps, type ReactElement, type ReactNode } from "react";
 import { ArrowRight02Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { Button } from "@executor-js/ui/components/button";
@@ -12,7 +12,17 @@ import { SessionMenu } from "./auth.tsx";
  * that grows or shrinks never moves what is above it. A step that keeps its own content scrolling,
  * such as a list, passes `h-dvh` so the column ends at the bottom of the screen.
  */
-export function SetupPage({ className, children }: ComponentProps<"main">) {
+export function SetupPage({
+  className,
+  children,
+  organization,
+  onSignOut,
+}: ComponentProps<"main"> & {
+  /** The team whose setup this is, so account settings know the way back to it. */
+  readonly organization?: string;
+  /** Reports leaving from a setup step, before the session ends. */
+  readonly onSignOut?: () => void;
+}) {
   return (
     <main
       className={cn(
@@ -21,7 +31,7 @@ export function SetupPage({ className, children }: ComponentProps<"main">) {
       )}
     >
       <div className="mb-6 w-[200px] max-w-full self-end bg-background lg:fixed lg:bottom-[max(12px,_env(safe-area-inset-bottom))] lg:left-[max(12px,_env(safe-area-inset-left))] lg:z-10 lg:mb-0 lg:max-w-[calc(100%-88px)]">
-        <SessionMenu />
+        <SessionMenu organization={organization} onSignOut={onSignOut} />
       </div>
       <div className="flex min-h-0 w-full max-w-[600px] flex-1 flex-col">
         <div className="mb-8 flex items-center gap-2 font-mono text-[15px] max-sm:mb-6">
@@ -76,7 +86,7 @@ export function SetupCard({ className, ...props }: ComponentProps<"div">) {
 export function SetupActions({ children }: { readonly children: ReactNode }) {
   return (
     <div className="z-20 shrink-0 bg-background max-sm:fixed max-sm:inset-x-0 max-sm:bottom-0 max-sm:border-t max-sm:pb-[env(safe-area-inset-bottom)] sm:sticky sm:bottom-0 sm:mt-3">
-      <div className="flex w-full items-center justify-end gap-3 py-3 max-sm:gap-2 max-sm:px-6">
+      <div className="flex w-full items-center justify-end gap-3 py-3 max-sm:flex-wrap max-sm:gap-x-2 max-sm:gap-y-1.5 max-sm:px-6">
         {children}
       </div>
     </div>
@@ -88,30 +98,45 @@ export function SetupActions({ children }: { readonly children: ReactNode }) {
  * done it is a quiet "Skip for now"; once `done`, the primary action named by `label`. Both labels
  * hold the button's box, so it keeps its size and place when it changes. `children` renders the
  * link or button for the current state around the content it is given.
+ *
+ * A `required` step cannot be skipped: until it is done the button is disabled and reads `hint`,
+ * saying what to do, in place of "Skip for now".
  */
 export function SetupNext({
   done,
   label,
+  required = false,
+  hint,
   children,
 }: {
   readonly done: boolean;
   readonly label: string;
+  readonly required?: boolean;
+  readonly hint: string;
   readonly children: (content: ReactNode) => ReactElement;
 }) {
-  return (
-    <Button
-      variant={done ? "default" : "secondary"}
-      // Only its colors fade; its size follows the screen at once, so a resize never animates it.
-      className="ml-auto transition-[color,background-color,box-shadow] max-sm:flex-1"
-      asChild
-    >
-      {children(
-        // Hidden labels keep their width and leave the accessible name to the one shown.
-        <span className="grid">
-          <ForwardLabel shown={!done}>Skip for now</ForwardLabel>
-          <ForwardLabel shown={done}>{label}</ForwardLabel>
-        </span>,
-      )}
+  // Hidden labels keep their width and leave the accessible name to the one shown.
+  const content = (
+    <span className="grid">
+      <ForwardLabel shown={!done}>{required ? hint : "Skip for now"}</ForwardLabel>
+      <ForwardLabel shown={done}>{label}</ForwardLabel>
+    </span>
+  );
+  // Only its colors fade; its size follows the screen at once, so a resize never animates it.
+  const forward = "ml-auto transition-[color,background-color,box-shadow,opacity] max-sm:flex-1";
+  if (!required)
+    return (
+      <Button variant={done ? "default" : "secondary"} className={forward} asChild>
+        {children(content)}
+      </Button>
+    );
+  return done ? (
+    <Button className={forward} asChild>
+      {children(content)}
+    </Button>
+  ) : (
+    <Button className={forward} disabled>
+      {content}
     </Button>
   );
 }
diff --git a/apps/hosted/web/src/implementation/components/setup-sequence.tsx b/apps/hosted/web/src/implementation/components/setup-sequence.tsx
index 7dec4c24ac..ee8e06a2fb 100644
--- a/apps/hosted/web/src/implementation/components/setup-sequence.tsx
+++ b/apps/hosted/web/src/implementation/components/setup-sequence.tsx
@@ -7,25 +7,27 @@ import {
   type ReactNode,
 } from "react";
 import { Link, useNavigate } from "@tanstack/react-router";
-import type { SetupOrder } from "@executor-js/hosted-server/setup";
+import type { SetupOrder, SetupSkip, SetupStep } from "@executor-js/hosted-server/setup";
 import type { AssistantId } from "@executor-js/ui/contracts/dashboard";
 import type { SetupHandoff } from "../../contracts/navigation.ts";
 import { reportBrowserUsage, type BrowserUsage } from "../../contracts/product-analytics.ts";
 import { useOrganizationRoute } from "./organization.tsx";
 
 /**
- * The order a team's setup steps run in, and whether the team is in Cloud's onboarding
- * experiment. Cloud reads it for the team before the first step renders; other hosts provide
- * none and show accounts first.
+ * The order a team's setup steps run in and whether they can be skipped, each with whether the
+ * member is in that Cloud onboarding experiment. Cloud reads it for the team before the first step
+ * renders; other hosts provide none and show skippable steps, accounts first.
  */
 export interface SetupSequence {
   readonly order: SetupOrder;
   readonly enrolled: boolean;
+  readonly skip: { readonly variant: SetupSkip; readonly enrolled: boolean };
 }
 
 const SetupSequenceContext = createContext<SetupSequence>({
   order: "accounts_first",
   enrolled: false,
+  skip: { variant: "skippable", enrolled: false },
 });
 
 export function SetupSequenceProvider({
@@ -38,8 +40,7 @@ export function SetupSequenceProvider({
   return <SetupSequenceContext value={value}>{children}</SetupSequenceContext>;
 }
 
-/** The two steps before the first prompt. */
-export type SetupStep = "accounts" | "assistant";
+export type { SetupStep };
 
 const steps: Record<SetupOrder, readonly [SetupStep, SetupStep]> = {
   accounts_first: ["accounts", "assistant"],
@@ -75,13 +76,19 @@ const destination = (
 /**
  * The team's setup order as destinations: the first step, and the one after each step, given
  * the assistant handoff known there. A step's one forward action leads to `after` whether it
- * skips or continues; skipping the assistant just carries no handoff. Steps report their onboarding events through `report`,
- * which adds the experiment variant for an enrolled team and the assistant a step is for.
+ * skips or continues; skipping the assistant just carries no handoff. Steps report their onboarding
+ * events through `report`, which adds each experiment's variant for an enrolled member and the
+ * assistant a step is for.
  */
 export function useSetupSequence() {
   const sequence = use(SetupSequenceContext);
   const order = steps[sequence.order];
   return {
+    /**
+     * The member's steps cannot be skipped: each forward button waits until its step is done, and
+     * the server keeps the dashboard closed until both are.
+     */
+    required: sequence.skip.variant === "required",
     first: destination(order[0], undefined),
     /** The step after `step`; none after the last one, which leads to the first prompt. */
     ahead: (step: SetupStep): SetupStep | undefined => order[order.indexOf(step) + 1],
@@ -93,6 +100,7 @@ export function useSetupSequence() {
         action,
         outcome,
         ...(sequence.enrolled ? { onboarding_variant: sequence.order } : {}),
+        ...(sequence.skip.enrolled ? { onboarding_skip_variant: sequence.skip.variant } : {}),
         ...(assistant === undefined ? {} : { assistant }),
       }),
   };
diff --git a/apps/hosted/web/src/implementation/pages/accounts-setup.tsx b/apps/hosted/web/src/implementation/pages/accounts-setup.tsx
index c520dad6fd..077aab6456 100644
--- a/apps/hosted/web/src/implementation/pages/accounts-setup.tsx
+++ b/apps/hosted/web/src/implementation/pages/accounts-setup.tsx
@@ -40,20 +40,24 @@ import {
 } from "./account-actions.tsx";
 
 /**
- * The apps offered first, by catalog ID, when the catalog lists them. Google signs in to every
- * Google service at once; each service is also offered alone, with narrower access.
+ * The apps offered first, by catalog ID, when the catalog lists them: the ones most teams connect
+ * an account to, in v2 and in v1, that sign in without an OAuth app of the member's own. Google
+ * signs in with Executor for Google, to every Google service at once or to each alone, with
+ * narrower access. Slack is left out: its sign-in needs the member's own Slack app.
  */
 const featured: readonly { readonly id: string; readonly detail?: string }[] = [
   { id: "google", detail: "Gmail, Calendar, Drive, Docs and Sheets in one sign-in" },
   { id: "gmail" },
   { id: "google-calendar" },
-  { id: "google-drive" },
   { id: "github" },
-  { id: "slack" },
+  { id: "google-drive" },
   { id: "linear" },
   { id: "notion" },
-  { id: "vercel" },
-  { id: "stripe" },
+  { id: "cloudflare" },
+  { id: "posthog" },
+  { id: "sentry" },
+  { id: "google-sheets" },
+  { id: "google-docs" },
 ];
 
 /** Rows load in pages as the list scrolls. */
@@ -112,7 +116,7 @@ const searchRank = (item: SetupApp, term: string) => {
  * one height and one button width, so connecting never moves the list.
  */
 export function AccountsSetupPage() {
-  const { organization } = useOrganizationRoute();
+  const { organization, slug } = useOrganizationRoute();
   // When the assistant connected first, its handoff rides in the URL to the first prompt.
   const handoff = setupHandoff(parseAccountsSetupSearch(useLocation().search));
   const sequence = useSetupSequence();
@@ -132,7 +136,11 @@ export function AccountsSetupPage() {
   const count = Math.max(connected.size, 1);
   return (
     <OAuthReturnContext value={{ page: "setup", ...(handoff === undefined ? {} : { handoff }) }}>
-      <SetupPage className="h-dvh">
+      <SetupPage
+        className="h-dvh"
+        organization={slug}
+        onSignOut={() => sequence.report("leave_setup", "started")}
+      >
         {/*
           Wider screens give the list one height, shrunk only to fit the screen, so the actions
           keep their place whether the list is loading, short or long. Phones fill the screen.
@@ -165,7 +173,12 @@ export function AccountsSetupPage() {
           </SetupCard>
         </section>
         <SetupActions>
-          <SetupNext done={done} label={`Continue with ${count} account${count === 1 ? "" : "s"}`}>
+          <SetupNext
+            done={done}
+            required={sequence.required}
+            hint="Connect an account to continue"
+            label={`Continue with ${count} account${count === 1 ? "" : "s"}`}
+          >
             {(content) => (
               <SetupLink
                 to={sequence.after("accounts", handoff)}
diff --git a/apps/hosted/web/src/implementation/pages/accounts.tsx b/apps/hosted/web/src/implementation/pages/accounts.tsx
index 2a3ff584af..538b7913e3 100644
--- a/apps/hosted/web/src/implementation/pages/accounts.tsx
+++ b/apps/hosted/web/src/implementation/pages/accounts.tsx
@@ -10,11 +10,22 @@ import { AccountsPage as SharedPage } from "@executor-js/ui/dashboard/accounts";
 import { EmptyState } from "@executor-js/ui/dashboard/empty-state";
 import { Button } from "@executor-js/ui/components/button";
 import { Link } from "@tanstack/react-router";
-import { useQuery } from "@executor-js/ui/dashboard/context";
+import { usePreload, useQuery } from "@executor-js/ui/dashboard/context";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
-import { useOrganizationDetails, useOrganizationRoute } from "../components/organization.tsx";
+import {
+  type OrganizationPageReads,
+  useOrganizationDetails,
+  useOrganizationRoute,
+} from "../components/organization.tsx";
 import { OAuthClientsDialog } from "./oauth-clients.tsx";
 import { resourceDirectoryAtom, resourceInventoryAtom } from "../../contracts/resource-access.ts";
+
+/** Each account's access and the account list, keyed by the URL. */
+export const accountsPageReads: OrganizationPageReads = (organization) => [
+  resourceDirectoryAtom(organization),
+  resourceInventoryAtom(organization),
+];
+
 /**
  * Personal and shared credentials use one list. Administrators also manage the organization's
  * OAuth clients from here, since those clients only exist to connect accounts.
@@ -27,6 +38,7 @@ export function AccountsPage({
   readonly oauthClients: { readonly open: boolean; readonly onOpenChange: (open: boolean) => void };
 }) {
   const { organization, slug: organizationSlug } = useOrganizationRoute();
+  usePreload(...accountsPageReads(organization, {}));
   const directory = useQuery(resourceDirectoryAtom(organization));
   const [dialog, setDialog] = useState<{ account: AccountId; kind: AccountDialogKind }>();
   const role = useOrganizationDetails()?.role;
diff --git a/apps/hosted/web/src/implementation/pages/add-app.tsx b/apps/hosted/web/src/implementation/pages/add-app.tsx
index f676f99749..414f239f57 100644
--- a/apps/hosted/web/src/implementation/pages/add-app.tsx
+++ b/apps/hosted/web/src/implementation/pages/add-app.tsx
@@ -3,15 +3,13 @@ import { appManagement } from "../../contracts/app-management.ts";
 import { useAtomMount } from "@effect/atom-react";
 import { HostedFailure, useDashboardAtoms } from "../components/dashboard-bindings.tsx";
 import { Link, useNavigate } from "@tanstack/react-router";
-import { Button } from "@executor-js/ui/components/button";
 import { CatalogPage as Catalog } from "@executor-js/ui/dashboard/catalog";
 import { InstallPublication } from "@executor-js/ui/dashboard/install-publication";
 import { type AppAcknowledgement } from "@executor-js/ui/contracts/app-management";
 import type { App, Publication } from "@executor-js/sdk";
 import { useState } from "react";
-import { HugeiconsIcon } from "@hugeicons/react";
-import { ArrowLeft02Icon } from "@hugeicons/core-free-icons";
 import { useOrganizationRoute } from "../components/organization.tsx";
+import { MakeYourOwn, AddAppBack } from "../components/add-app.tsx";
 import { acknowledgeApp } from "../../contracts/apps.ts";
 
 /** Published apps and catalog apps install into the same organization-owned app records. */
@@ -66,30 +64,9 @@ export function AddAppPage() {
           Open
         </Link>
       )}
-      back={
-        <Link
-          to="/org/$organizationSlug/apps"
-          params={{ organizationSlug }}
-          className="back-link inline-flex gap-1.5 items-center text-[12px] text-muted-foreground mb-4.25 hover:text-foreground max-[740px]:min-h-11 max-[740px]:inline-flex max-[740px]:items-center max-[740px]:-mt-2 max-[740px]:mb-3"
-        >
-          <HugeiconsIcon icon={ArrowLeft02Icon} size={14} />
-          Apps
-        </Link>
-      }
-      action={
-        <div className="flex gap-2">
-          <Button variant="outline" asChild>
-            <Link
-              data-product-area="apps"
-              data-product-action="custom_service"
-              to="/org/$organizationSlug/apps/add/custom"
-              params={{ organizationSlug }}
-            >
-              Connect a service
-            </Link>
-          </Button>
-        </div>
-      }
+      back={<AddAppBack organizationSlug={organizationSlug} />}
+      action={<MakeYourOwn appearance="button" />}
+      create={<MakeYourOwn />}
     />
   );
 }
diff --git a/apps/hosted/web/src/implementation/pages/agent-setup.tsx b/apps/hosted/web/src/implementation/pages/agent-setup.tsx
index d8e8130977..3ec529cf91 100644
--- a/apps/hosted/web/src/implementation/pages/agent-setup.tsx
+++ b/apps/hosted/web/src/implementation/pages/agent-setup.tsx
@@ -37,6 +37,7 @@ import {
   AgentConnectionAttempt,
   agentBaselineAtom,
   confirmedMcpAgentAtom,
+  mcpAgentsAtom,
   newMcpAgentAtom,
 } from "../../contracts/mcp-connections.ts";
 import { parseAgentSetupSearch } from "../../contracts/navigation.ts";
@@ -97,8 +98,10 @@ export function AgentSetupPage() {
         ? `prompt:${search.assistant}:${search.agent}`
         : `guide:${search.assistant}`;
   const capture = useBaselineCapture(screen);
+  const sequence = useSetupSequence();
+  const { slug } = useOrganizationRoute();
   return (
-    <SetupPage>
+    <SetupPage organization={slug} onSignOut={() => sequence.report("leave_setup", "started")}>
       <section className="@container w-full" aria-labelledby="agent-setup-title">
         {/* Keyed so a new screen mounts its own elements rather than moving the last screen's. */}
         {search.assistant === undefined ? (
@@ -153,7 +156,9 @@ interface ScreenBaseline {
  */
 function ChooseStep({ endpoint, ...baseline }: { readonly endpoint: string } & ScreenBaseline) {
   const navigate = useNavigate();
-  const [agent, setAgent] = useState<ConnectedAgent>();
+  const [found, setAgent] = useState<ConnectedAgent>();
+  const before = useAgentConnectedBefore();
+  const agent = found ?? before;
   useSetupViewed("setup_assistant");
   const name = "your assistant";
   return (
@@ -211,7 +216,9 @@ function GuideStep({
   useSetupViewed("setup_guide", assistant);
   const guide = useAssistantGuide(endpoint, assistant);
   const name = assistantName(assistant);
-  const [agent, setAgent] = useState<ConnectedAgent>();
+  const [found, setAgent] = useState<ConnectedAgent>();
+  const before = useAgentConnectedBefore();
+  const agent = found ?? before;
   return (
     <>
       <SetupTitle id="agent-setup-title" ref={focusHeading}>
@@ -250,9 +257,9 @@ function GuideStep({
 
 /**
  * Until an agent connects, skips the assistant for the step after this one, or for the dashboard
- * when this is the last, since the first prompt is written for an assistant. Once one connects,
- * it carries the assistant and its agent on to the next step and its first prompt. The choices
- * screen has no assistant picked, so its skip reports none.
+ * when this is the last, since the first prompt is written for an assistant; a required step waits
+ * instead. Once one connects, it carries the assistant and its agent on to the next step and its
+ * first prompt. The choices screen has no assistant picked, so its skip reports none.
  */
 function AssistantNext({
   assistant,
@@ -267,6 +274,8 @@ function AssistantNext({
   return (
     <SetupNext
       done={agent !== undefined}
+      required={sequence.required}
+      hint="Connect your assistant to continue"
       label={
         sequence.ahead("assistant") === "accounts" ? "Next: connect accounts" : "Next: first prompt"
       }
@@ -292,6 +301,21 @@ function AssistantNext({
   );
 }
 
+/**
+ * In a required setup, an assistant the member already connected to this team over MCP, the most
+ * recently active. The step is done, as the server's gate counts it, so a screen opened after
+ * connecting, such as in a new tab, moves on with that agent instead of waiting for another.
+ * Skippable steps wait for a new one.
+ */
+function useAgentConnectedBefore(): ConnectedAgent | undefined {
+  const { required } = useSetupSequence();
+  const { organization } = useOrganizationRoute();
+  const agents = useAtomValue(mcpAgentsAtom(organization));
+  if (!required || !AsyncResult.isSuccess(agents)) return undefined;
+  // Agents are listed most recently active first.
+  return agents.value.find((agent) => agent.access.kind !== "api");
+}
+
 interface AgentFound {
   /** The new agent once found; it is kept, which stops the checks. */
   readonly agent: ConnectedAgent | undefined;
diff --git a/apps/hosted/web/src/implementation/pages/app-accounts.tsx b/apps/hosted/web/src/implementation/pages/app-accounts.tsx
index 47488a28b7..be8e9c5fd6 100644
--- a/apps/hosted/web/src/implementation/pages/app-accounts.tsx
+++ b/apps/hosted/web/src/implementation/pages/app-accounts.tsx
@@ -356,6 +356,7 @@ function AppConnectionFields({
             redirectUri: value.redirectUri,
             ...(account ? { reconnect: true } : {}),
             manualClient: value.manualClient,
+            ...(value.registeredClient ? { registeredClient: value.registeredClient } : {}),
             ...(returnTo === undefined ? {} : { returnTo }),
           },
           value.authorizationUrl,
diff --git a/apps/hosted/web/src/implementation/pages/approvals.tsx b/apps/hosted/web/src/implementation/pages/approvals.tsx
index d64bcafa41..b579c7be14 100644
--- a/apps/hosted/web/src/implementation/pages/approvals.tsx
+++ b/apps/hosted/web/src/implementation/pages/approvals.tsx
@@ -5,8 +5,14 @@ import { ApprovalsPage as SharedApprovalsPage } from "@executor-js/ui/dashboard/
 import { BrowserApprovalCard } from "@executor-js/ui/dashboard/browser-approval";
 import { pendingApprovalsAtom, scheduledReviewAtoms } from "../../contracts/schedules.ts";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
-import { useOrganizationRoute } from "../components/organization.tsx";
+import { type OrganizationPageReads, useOrganizationRoute } from "../components/organization.tsx";
 import { AppApprovalFrame, ScheduledApprovalFrame } from "../components/page-pending.tsx";
+
+/** The pending runs, keyed by the URL. */
+export const approvalsPageReads: OrganizationPageReads = (organization) => [
+  pendingApprovalsAtom(organization),
+];
+
 /** Pending runs are reviewed by a signed-in human through the product's normal auth boundary. */
 export function ApprovalsPage() {
   const { organization, slug: organizationSlug } = useOrganizationRoute();
diff --git a/apps/hosted/web/src/implementation/pages/apps.tsx b/apps/hosted/web/src/implementation/pages/apps.tsx
index 6011737716..a7da3a4ba6 100644
--- a/apps/hosted/web/src/implementation/pages/apps.tsx
+++ b/apps/hosted/web/src/implementation/pages/apps.tsx
@@ -22,6 +22,7 @@ import { type OrganizationPageReads, useOrganizationRoute } from "../components/
 import { createAppListAtoms, resourceInventoryAtom } from "../../contracts/resource-access.ts";
 import { groupsAtom } from "../../contracts/groups.ts";
 import { usePreload } from "@executor-js/ui/dashboard/context";
+import { AddAppMenu } from "../components/add-app.tsx";
 
 /** The groups and the unfiltered list the page opens with. */
 export const appsPageReads: OrganizationPageReads = (organization) => [
@@ -74,11 +75,7 @@ export function AppsPage() {
                 Clear filters
               </Button>
             ) : (
-              <Button asChild>
-                <Link to="/org/$organizationSlug/apps/add" params={{ organizationSlug }}>
-                  Add app
-                </Link>
-              </Button>
+              <AddAppMenu />
             )
           }
         >
@@ -87,13 +84,7 @@ export function AppsPage() {
             : "Add an app or ask a teammate to share one with you."}
         </EmptyState>
       }
-      action={
-        <Button asChild>
-          <Link to="/org/$organizationSlug/apps/add" params={{ organizationSlug }}>
-            Add app
-          </Link>
-        </Button>
-      }
+      action={<AddAppMenu />}
       filters={
         <Popover>
           <PopoverTrigger asChild>
diff --git a/apps/hosted/web/src/implementation/pages/connect-account.tsx b/apps/hosted/web/src/implementation/pages/connect-account.tsx
index 4009d391a3..257f77247f 100644
--- a/apps/hosted/web/src/implementation/pages/connect-account.tsx
+++ b/apps/hosted/web/src/implementation/pages/connect-account.tsx
@@ -3,10 +3,13 @@ import type { AccountSubmission, OAuthSubmission } from "@executor-js/ui/contrac
 import { RegistryContext, useAtomSet } from "@effect/atom-react";
 import {
   OAuthClientInput,
+  OAuthClientNotFound,
   oauthClientEntryReasons,
   type Account,
   type AppId,
   type HttpUrl,
+  type OAuthClientId,
+  type OAuthClientSelection,
   type Provider,
 } from "@executor-js/sdk";
 import type {
@@ -15,8 +18,9 @@ import type {
   HostedOAuthStartResult,
 } from "@executor-js/hosted-server";
 import { Link } from "@tanstack/react-router";
-import { createContext, useContext, useState } from "react";
-import { Cause, Match, Option, Exit, Schema } from "effect";
+import { createContext, useContext, useRef } from "react";
+import { AtomRegistry } from "effect/reactivity";
+import { Cause, Effect, Match, Option, Exit, Schema } from "effect";
 import { Button } from "@executor-js/ui/components/button";
 import { OAuthFields, OAuthSetup } from "@executor-js/ui/dashboard/oauth-fields";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
@@ -30,7 +34,11 @@ import {
   type OAuthReturn,
 } from "../../contracts/apps.ts";
 import { useOrganizationDetails, useOrganizationRoute } from "../components/organization.tsx";
-import { RegisterServiceClient } from "./oauth-clients.tsx";
+import {
+  oauthClientsAtom,
+  registerOAuthClientAtom,
+  updateOAuthClientAtom,
+} from "../../contracts/oauth-clients.ts";
 
 /**
  * A page other than the app's own that starts account sign-ins, such as onboarding, provides where
@@ -50,12 +58,14 @@ export function ConnectionFields({
   onSaved,
   initialMethod,
   manualClient,
+  editClient,
   onPendingChange,
 }: {
   readonly connection: HostedAccountConnection;
   readonly onSaved: (account: Account) => void;
   readonly initialMethod?: string | undefined;
   readonly manualClient?: boolean | undefined;
+  readonly editClient?: OAuthClientId | undefined;
   readonly onPendingChange?: (pending: boolean) => void;
 }) {
   const { organization, slug: organizationSlug } = useOrganizationRoute();
@@ -89,6 +99,7 @@ export function ConnectionFields({
       redirectUri={connection.redirectUri}
       initialMethod={initialMethod}
       manualClient={manualClient}
+      editClient={editClient}
       submit={submit}
       start={startOAuth}
       onSaved={onSaved}
@@ -103,6 +114,7 @@ export function ConnectionFields({
             redirectUri: value.redirectUri,
             ...(connection.reconnectAccount ? { reconnect: true } : {}),
             manualClient: value.manualClient,
+            ...(value.registeredClient ? { registeredClient: value.registeredClient } : {}),
           },
           value.authorizationUrl,
         )
@@ -118,6 +130,7 @@ export function HostedAccountForm<A extends HostedOAuthSignIn>({
   redirectUri,
   initialMethod,
   manualClient,
+  editClient,
   submit,
   start,
   onSaved,
@@ -132,14 +145,19 @@ export function HostedAccountForm<A extends HostedOAuthSignIn>({
   readonly redirectUri: string;
   readonly initialMethod?: string | undefined;
   readonly manualClient?: boolean | undefined;
+  /** A registered client whose details reopen to be corrected before signing in again. */
+  readonly editClient?: OAuthClientId | undefined;
   readonly submit: (input: AccountSubmission) => Promise<Exit.Exit<Account, HostedError>>;
-  readonly start: (
-    input: OAuthSubmission & { readonly method: string },
-  ) => Promise<
+  readonly start: (input: {
+    readonly method: string;
+    readonly client?: OAuthClientSelection;
+  }) => Promise<
     Exit.Exit<A | Extract<HostedOAuthStartResult, { status: "completed" }>, HostedError>
   >;
   readonly onSaved: (account: Account) => void;
-  readonly onAuthorized: (value: A & { readonly manualClient: boolean }) => void;
+  readonly onAuthorized: (
+    value: A & { readonly manualClient: boolean; readonly registeredClient?: OAuthClientId },
+  ) => void;
   readonly onPendingChange?: (pending: boolean) => void;
 }) {
   const { organization } = useOrganizationRoute();
@@ -149,39 +167,76 @@ export function HostedAccountForm<A extends HostedOAuthSignIn>({
   const role = useOrganizationDetails()?.role;
   const admin = role !== undefined && role !== "member";
   const registry = useContext(RegistryContext);
-  // Registering replaces the account form, since it is a form itself, then returns to the method.
-  const [registering, setRegistering] = useState<{
-    readonly method: string;
-    readonly issuer: typeof HttpUrl.Type;
-  }>();
-  const [method, setMethod] = useState(initialMethod);
+  const register = useAtomSet(registerOAuthClientAtom(organization), { mode: "promiseExit" });
+  // A client registered before sign-in failed to start is updated on retry, not registered again.
+  const registered = useRef<{
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly id: OAuthClientId;
+  }>(undefined);
   // Reconnects keep their name; a new account is named once saved.
   const saved = (value: Account) => {
     if (!account)
       requestName({ organization, account: value.id, saved: { account: value, provider } });
     onSaved(value);
   };
-  if (registering !== undefined)
-    return (
-      <RegisterServiceClient
-        service={{
-          issuer: registering.issuer,
-          providers: [{ id: provider.id, name: provider.definition.name }],
-        }}
-        onDone={() => {
-          registry.refresh(
-            oauthSetupAtom({ organization, provider: provider.id, method: registering.method }),
+  /**
+   * An administrator's entered client is registered, or a registered one updated, before sign-in
+   * starts, so a failed or cancelled sign-in keeps it. A failure here stays in the form.
+   */
+  const savedClient = (
+    input: OAuthSubmission,
+    issuer: typeof HttpUrl.Type | undefined,
+  ): Promise<Exit.Exit<OAuthClientId | undefined, HostedError>> => {
+    const entered = input.client;
+    if (entered === undefined || !Schema.is(OAuthClientInput)(entered))
+      return Promise.resolve(Exit.succeed(undefined));
+    const { update } = input;
+    if (update !== undefined)
+      return Effect.runPromiseExit(
+        Effect.gen(function* () {
+          const directory = yield* AtomRegistry.getResult(
+            registry,
+            oauthClientsAtom(organization),
+            { suspendOnWaiting: true },
           );
-          setMethod(registering.method);
-          setRegistering(undefined);
-        }}
-      />
+          const current = directory.clients.find((entry) => entry.client.id === update);
+          if (current === undefined) return yield* new OAuthClientNotFound({ client: update });
+          const mutation = updateOAuthClientAtom({ organization, client: update });
+          registry.set(mutation, {
+            ...(entered.clientId === current.client.clientId ? {} : { clientId: entered.clientId }),
+            ...(entered.clientSecret ? { clientSecret: entered.clientSecret } : {}),
+            audience: current.access.audience,
+            revision: current.access.revision,
+          });
+          const saved = yield* AtomRegistry.getResult(registry, mutation, {
+            suspendOnWaiting: true,
+          });
+          return saved.client.id;
+        }),
+      );
+    if (input.register !== true || issuer === undefined)
+      return Promise.resolve(Exit.succeed(undefined));
+    const retried = registered.current;
+    if (retried?.issuer === issuer && retried.clientId === entered.clientId)
+      return savedClient({ ...input, register: false, update: retried.id }, issuer);
+    return register({
+      issuer,
+      clientId: entered.clientId,
+      ...(entered.clientSecret ? { clientSecret: entered.clientSecret } : {}),
+      audience: { kind: "everyone" },
+    }).then((exit) =>
+      Exit.map(exit, (saved) => {
+        registered.current = { issuer, clientId: entered.clientId, id: saved.client.id };
+        return saved.client.id;
+      }),
     );
+  };
   return (
     <AccountForm
       provider={provider}
       {...(account ? { account } : {})}
-      initialMethod={method}
+      initialMethod={initialMethod}
       Failure={HostedFailure}
       submitLabel={account ? "Save credentials" : "Connect account"}
       submit={submit}
@@ -204,22 +259,11 @@ export function HostedAccountForm<A extends HostedOAuthSignIn>({
               access={access}
               disabled={disabled}
               manualClient={manualClient}
+              editClient={admin ? editClient : undefined}
+              registerClient={admin}
               {...(account ? { account } : {})}
               redirectUri={redirectUri}
               onPendingChange={onPendingChange}
-              {...(admin && setup !== "unresolved" && setup.grant === "authorization_code"
-                ? {
-                    missingClient: (
-                      <Button
-                        type="button"
-                        className="w-full"
-                        onClick={() => setRegistering({ method, issuer: setup.issuer })}
-                      >
-                        Register OAuth client
-                      </Button>
-                    ),
-                  }
-                : {})}
               requiresClient={(cause) => {
                 const required = Option.exists(Cause.findErrorOption(cause), (error) =>
                   Match.value(error).pipe(
@@ -233,16 +277,34 @@ export function HostedAccountForm<A extends HostedOAuthSignIn>({
                 if (required) refresh();
                 return required;
               }}
-              start={(input: OAuthSubmission) =>
-                start({ method, ...input }).then((exit) =>
-                  Exit.map(exit, (value) => ({
-                    ...value,
-                    // Entered details reopen after a failed return; chosen clients do not.
-                    manualClient:
-                      input.client !== undefined && Schema.is(OAuthClientInput)(input.client),
-                  })),
-                )
-              }
+              start={async (input: OAuthSubmission) => {
+                const saved = await savedClient(
+                  input,
+                  setup !== "unresolved" && setup.grant === "authorization_code"
+                    ? setup.issuer
+                    : undefined,
+                );
+                if (Exit.isFailure(saved)) return Exit.failCause(saved.cause);
+                const registeredClient = saved.value;
+                if (registeredClient !== undefined) refresh();
+                const exit = await start({
+                  method,
+                  ...(registeredClient !== undefined
+                    ? { client: { id: registeredClient } }
+                    : input.client !== undefined
+                      ? { client: input.client }
+                      : {}),
+                });
+                return Exit.map(exit, (value) => ({
+                  ...value,
+                  // Entered details reopen after a failed return; chosen clients do not.
+                  manualClient:
+                    registeredClient === undefined &&
+                    input.client !== undefined &&
+                    Schema.is(OAuthClientInput)(input.client),
+                  ...(registeredClient !== undefined ? { registeredClient } : {}),
+                }));
+              }}
               onAuthorized={(value) => {
                 refresh();
                 if (value.status !== "completed") {
diff --git a/apps/hosted/web/src/implementation/pages/connect.tsx b/apps/hosted/web/src/implementation/pages/connect.tsx
index 2bba4b07d6..0376727b4b 100644
--- a/apps/hosted/web/src/implementation/pages/connect.tsx
+++ b/apps/hosted/web/src/implementation/pages/connect.tsx
@@ -1,11 +1,16 @@
-import { Link } from "@tanstack/react-router";
+import { Link, useNavigate } from "@tanstack/react-router";
 import { Button } from "@executor-js/ui/components/button";
 import { Code } from "@executor-js/ui/dashboard/code";
 import { McpInstallInstructions } from "@executor-js/ui/dashboard/connect";
-import { ScopedConnectionsPage } from "@executor-js/ui/dashboard/scoped-connections";
+import {
+  ScopedConnectionPage,
+  ScopedConnectionsPage,
+  type ConnectionLinkProps,
+  type ConnectTarget,
+} from "@executor-js/ui/dashboard/scoped-connections";
 import { ConnectedAgents } from "@executor-js/ui/dashboard/connected-agents";
 import { ConnectionToolPicker } from "@executor-js/ui/dashboard/connection-tool-picker";
-import { useOrganizationRoute } from "../components/organization.tsx";
+import { type OrganizationPageReads, useOrganizationRoute } from "../components/organization.tsx";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
 import { resourceInventoryAtom } from "../../contracts/resource-access.ts";
 import { connectionToolListAtom } from "../../contracts/apps.ts";
@@ -22,6 +27,18 @@ import {
 import { useDocumentationUrl } from "../documentation.ts";
 import { useResourceOrigins } from "../resource-origin.ts";
 
+/** The inventory and the member's connections, keyed by the URL. */
+export const connectionPageReads: OrganizationPageReads = (organization) => [
+  resourceInventoryAtom(organization),
+  mcpConnectionsAtom(organization),
+];
+
+/** The connection page's reads and the agents connected through them. */
+export const connectPageReads: OrganizationPageReads = (organization, params) => [
+  ...connectionPageReads(organization, params),
+  mcpAgentsAtom(organization),
+];
+
 /** Headless setup: a personal access token against this organization's own addresses. */
 function PersonalTokenSetup({
   apiOrigin,
@@ -68,26 +85,67 @@ function PersonalTokenSetup({
   );
 }
 
-/** The member's full-access URL, scoped connections and connected agents for this organization. */
-export function ConnectPage() {
+function ConnectionLink({ connection, className, children }: ConnectionLinkProps) {
+  const { slug: organizationSlug } = useOrganizationRoute();
+  return connection === undefined ? (
+    <Link to="/org/$organizationSlug/connect" params={{ organizationSlug }} className={className}>
+      {children}
+    </Link>
+  ) : (
+    <Link
+      to="/org/$organizationSlug/connect/$connectionId"
+      params={{ organizationSlug, connectionId: connection }}
+      className={className}
+    >
+      {children}
+    </Link>
+  );
+}
+
+/** The bindings both connection pages share in this organization. */
+function useConnectionBindings() {
   const origins = useResourceOrigins();
-  const mcpOrigin = origins.mcp[0];
   const { organization } = useOrganizationRoute();
   const docs = useDocumentationUrl();
+  return {
+    query: resourceInventoryAtom(organization),
+    connections: mcpConnectionsAtom(organization),
+    save: saveMcpConnectionAtom(organization),
+    revoke: revokeMcpConnectionAtom(organization),
+    mintKey: mintMcpConnectionKeyAtom(organization),
+    keys: {
+      list: mcpConnectionKeysAtom(organization),
+      revoke: revokeMcpConnectionKeyAtom(organization),
+    },
+    Failure: HostedFailure,
+    ConnectionLink,
+    renderInstallation: (target: ConnectTarget) =>
+      target.apps === undefined ? (
+        <McpInstallInstructions
+          endpoint={target.url}
+          docs={docs}
+          token={<PersonalTokenSetup apiOrigin={origins.api[0]} mcpOrigin={origins.mcp[0]} />}
+        />
+      ) : (
+        <McpInstallInstructions
+          endpoint={target.url}
+          docs={docs}
+          next="show me which apps and tools this connection can use"
+        />
+      ),
+  };
+}
+
+/** The member's full-access URL, scoped connections and connected agents for this organization. */
+export function ConnectPage() {
+  const bindings = useConnectionBindings();
+  const { organization } = useOrganizationRoute();
+  const origins = useResourceOrigins();
   return (
     <ScopedConnectionsPage
       key={organization}
-      query={resourceInventoryAtom(organization)}
-      connections={mcpConnectionsAtom(organization)}
-      save={saveMcpConnectionAtom(organization)}
-      revoke={revokeMcpConnectionAtom(organization)}
-      mintKey={mintMcpConnectionKeyAtom(organization)}
-      keys={{
-        list: mcpConnectionKeysAtom(organization),
-        revoke: revokeMcpConnectionKeyAtom(organization),
-      }}
-      Failure={HostedFailure}
-      docs={docs}
+      {...bindings}
+      endpoint={`${origins.mcp[0]}/mcp`}
       agents={
         <ConnectedAgents
           query={mcpAgentsAtom(organization)}
@@ -95,13 +153,40 @@ export function ConnectPage() {
           Failure={HostedFailure}
         />
       }
-      installation={
-        <McpInstallInstructions
-          endpoint={`${mcpOrigin}/mcp`}
-          docs={docs}
-          token={<PersonalTokenSetup apiOrigin={origins.api[0]} mcpOrigin={mcpOrigin} />}
-        />
+    />
+  );
+}
+
+/** One of the member's scoped connections, or `new` to create one. */
+export function ConnectionPage({ connectionId }: { readonly connectionId: string }) {
+  const bindings = useConnectionBindings();
+  const { organization, slug: organizationSlug } = useOrganizationRoute();
+  const navigate = useNavigate();
+  return (
+    <ScopedConnectionPage
+      key={organization}
+      {...bindings}
+      connectionId={connectionId}
+      onCreated={(connection) =>
+        void navigate({
+          to: "/org/$organizationSlug/connect/$connectionId",
+          params: { organizationSlug, connectionId: connection },
+        })
       }
+      onRevoked={() =>
+        void navigate({ to: "/org/$organizationSlug/connect", params: { organizationSlug } })
+      }
+      renderConnectAccount={(app) => (
+        <Button type="button" variant="ghost" size="sm" className="text-xs" asChild>
+          <Link
+            to="/org/$organizationSlug/apps/$appId"
+            params={{ organizationSlug, appId: app.id }}
+            search={{ view: "accounts" }}
+          >
+            Connect account
+          </Link>
+        </Button>
+      )}
       renderTools={({ app, names, onChange }) => (
         <ConnectionToolPicker
           query={connectionToolListAtom({
diff --git a/apps/hosted/web/src/implementation/pages/connection-dialog.tsx b/apps/hosted/web/src/implementation/pages/connection-dialog.tsx
index 9ec81368d1..1ef3c92917 100644
--- a/apps/hosted/web/src/implementation/pages/connection-dialog.tsx
+++ b/apps/hosted/web/src/implementation/pages/connection-dialog.tsx
@@ -13,6 +13,7 @@ import { providerDisplayUrl } from "@executor-js/ui/contracts/dashboard";
 import { DetailSkeleton } from "@executor-js/ui/dashboard/loading";
 import { QueryResult, useQuery } from "@executor-js/ui/dashboard/context";
 import { connectionAtom } from "../../contracts/apps.ts";
+import type { ClientRecovery } from "../../contracts/navigation.ts";
 import { useOrganizationRoute } from "../components/organization.tsx";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
 import { ConnectionFields } from "./connect-account.tsx";
@@ -75,7 +76,7 @@ export function AccountConnectionDialog({
   onClose,
 }: {
   readonly connectionId?: AccountConnectionId | undefined;
-  readonly client?: "change" | undefined;
+  readonly client?: typeof ClientRecovery.Type | undefined;
   readonly onClose: () => void;
 }) {
   return connectionId === undefined ? null : (
@@ -94,7 +95,7 @@ function ResumedConnectionDialog({
   onClose,
 }: {
   readonly connectionId: AccountConnectionId;
-  readonly client?: "change" | undefined;
+  readonly client?: typeof ClientRecovery.Type | undefined;
   readonly onClose: () => void;
 }) {
   const { organization, slug: organizationSlug } = useOrganizationRoute();
@@ -125,6 +126,7 @@ function ResumedConnectionDialog({
           <ConnectionFields
             connection={connection}
             manualClient={client === "change"}
+            editClient={client === "change" ? undefined : client}
             onPendingChange={setBusy}
             onSaved={() => {
               void navigate({
@@ -147,7 +149,7 @@ export function ConnectionEntry({
   client,
 }: {
   readonly connectionId: AccountConnectionId;
-  readonly client?: "change" | undefined;
+  readonly client?: typeof ClientRecovery.Type | undefined;
 }) {
   const { organization, slug: organizationSlug } = useOrganizationRoute();
   const navigate = useNavigate();
diff --git a/apps/hosted/web/src/implementation/pages/custom-app.tsx b/apps/hosted/web/src/implementation/pages/custom-app.tsx
deleted file mode 100644
index c070acf66f..0000000000
--- a/apps/hosted/web/src/implementation/pages/custom-app.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-import { useMcpOrigin } from "../resource-origin.ts";
-import { Link, useNavigate } from "@tanstack/react-router";
-import { HugeiconsIcon } from "@hugeicons/react";
-import { ArrowLeft02Icon } from "@hugeicons/core-free-icons";
-import { CustomAppForm } from "@executor-js/ui/dashboard/custom-app";
-import { HostedFailure, useDashboardAtoms } from "../components/dashboard-bindings.tsx";
-import { useOrganizationRoute } from "../components/organization.tsx";
-
-/** Member-owned MCP imports use organization-bound mutations on both hosted products. */
-export function CustomAppPage() {
-  const mcpOrigin = useMcpOrigin();
-  const { organization, slug: organizationSlug } = useOrganizationRoute();
-  const atoms = useDashboardAtoms();
-  const navigate = useNavigate();
-  return (
-    <div className="page setup-page w-full shrink-0 [padding:24px_24px_48px] my-0 mx-auto max-[1000px]:[padding:20px_20px_40px] max-w-212.5 max-[740px]:[padding:18px_max(16px,_env(safe-area-inset-right))_max(32px,_env(safe-area-inset-bottom))_max(16px,_env(safe-area-inset-left))]">
-      <Link
-        to="/org/$organizationSlug/apps/add"
-        params={{ organizationSlug }}
-        className="back-link inline-flex gap-1.5 items-center text-[12px] text-muted-foreground mb-4.25 hover:text-foreground max-[740px]:min-h-11 max-[740px]:inline-flex max-[740px]:items-center max-[740px]:-mt-2 max-[740px]:mb-3"
-      >
-        <HugeiconsIcon icon={ArrowLeft02Icon} strokeWidth={2} aria-hidden size={14} />
-        All apps
-      </Link>
-      <div className="page-heading gap-4 flex justify-between items-center min-h-12 mb-4.5 [&_p]:text-muted-foreground [&_p]:text-[13px] [&_p]:mt-1.25 [&_>_div]:min-w-0 [&_>_div]:wrap-anywhere max-[740px]:items-start max-[740px]:mb-4.5 max-[740px]:[&_p]:leading-[1.6] max-[740px]:[&_>_[data-slot='button']]:mt-0.25 max-[740px]:[.setup-page_&]:min-h-0">
-        <h1 className="text-[22px] font-semibold tracking-[-0.035em] leading-[1.35] [&>span]:text-muted-foreground [&>span]:text-[13px] [&>span]:font-mono [&>span]:font-normal [&>span]:ml-[8px] [&>span]:align-middle">
-          Connect a service
-        </h1>
-      </div>
-      <CustomAppForm
-        key={organization}
-        endpoint={`${mcpOrigin}/mcp`}
-        mutation={atoms.importCustom}
-        Failure={HostedFailure}
-        onInstalled={(app) =>
-          navigate({
-            to: "/org/$organizationSlug/apps/$appId",
-            search: {
-              view: Object.keys(app.requirements.accounts).length ? "accounts" : "overview",
-            },
-            params: { organizationSlug, appId: app.id },
-          })
-        }
-      />
-    </div>
-  );
-}
diff --git a/apps/hosted/web/src/implementation/pages/groups.tsx b/apps/hosted/web/src/implementation/pages/groups.tsx
index bba415babf..b569c8ed31 100644
--- a/apps/hosted/web/src/implementation/pages/groups.tsx
+++ b/apps/hosted/web/src/implementation/pages/groups.tsx
@@ -1,6 +1,6 @@
 import { EmptyState } from "@executor-js/ui/dashboard/empty-state";
 import { resourceDirectoryAtom } from "../../contracts/resource-access.ts";
-import { QueryView } from "@executor-js/ui/dashboard/context";
+import { QueryView, usePreload } from "@executor-js/ui/dashboard/context";
 import { useAtomRefresh, useAtomSet, useAtomValue } from "@effect/atom-react";
 import { AsyncResult } from "effect/reactivity";
 import { Cause, Exit, Option } from "effect";
@@ -26,7 +26,7 @@ import {
 } from "@executor-js/ui/components/dialog";
 import { productTitle, useDocumentTitle } from "@executor-js/ui/hooks/document-title";
 import type { Group, GroupMember, GroupsView } from "@executor-js/hosted-server/groups";
-import { useOrganizationRoute } from "../components/organization.tsx";
+import { type OrganizationPageReads, useOrganizationRoute } from "../components/organization.tsx";
 import { GroupsFrame, GroupsLoading, groupsTitle } from "../components/page-pending.tsx";
 import { HostedFailure } from "../components/dashboard-bindings.tsx";
 import { groupsAtom, saveGroupAtom, removeGroupAtom } from "../../contracts/groups.ts";
@@ -34,9 +34,16 @@ import { appError, type HostedError } from "../../contracts/errors.ts";
 import { GroupConflict } from "@executor-js/hosted-server/groups";
 import { Alert, AlertTitle, AlertDescription } from "@executor-js/ui/components/alert";
 
+/** The groups, keyed by the URL; a group's page also lists the apps shared with it. */
+export const groupsPageReads: OrganizationPageReads = (organization, params) => [
+  groupsAtom(organization),
+  ...(typeof params.groupId === "string" ? [resourceDirectoryAtom(organization)] : []),
+];
+
 /** Shared hosted groups page. A reload reads persisted membership, never fixture data. */
 export function GroupsPage({ id }: { readonly id?: string }) {
   const { organization } = useOrganizationRoute();
+  usePreload(...groupsPageReads(organization, { groupId: id }));
   const result = useAtomValue(groupsAtom(organization));
   const refresh = useAtomRefresh(groupsAtom(organization));
   const data = AsyncResult.value(result);
diff --git a/apps/hosted/web/src/implementation/pages/oauth-callback.tsx b/apps/hosted/web/src/implementation/pages/oauth-callback.tsx
index 1c4dd3bb25..c77ff4f0bd 100644
--- a/apps/hosted/web/src/implementation/pages/oauth-callback.tsx
+++ b/apps/hosted/web/src/implementation/pages/oauth-callback.tsx
@@ -136,11 +136,13 @@ export function OAuthCallbackPage() {
       const organization = organizationSlug;
       // Only the tab that started this connection knows the page it started from.
       const started = Option.filter(stored, (value) => value.connection === connection);
+      const registeredClient = Option.flatMapNullishOr(started, (value) => value.registeredClient);
       const returnTo = Option.getOrUndefined(started)?.returnTo;
       const context = {
         ...resolved.value,
         organization,
         manualClient: Option.exists(started, (value) => value.manualClient === true),
+        ...(Option.isSome(registeredClient) ? { registeredClient: registeredClient.value } : {}),
         ...(returnTo === undefined ? {} : { returnTo }),
       };
       setPending(Option.some(context));
@@ -208,15 +210,20 @@ function OAuthRecoveryActions({
       </Button>
     );
   const context = pending.value;
-  // Entered clients are saved only after a successful sign-in, so a retry reopens their fields.
+  // A client registered for this attempt stays registered, so a retry signs in with it and its
+  // details reopen only to be edited. Other entered clients are account-only, so a retry reopens
+  // their fields.
+  const registered = context.registeredClient;
   const retry =
     recovery === "restart" || recovery === "client"
       ? {
           label: recovery === "client" ? "Update client details" : "Try again",
           search:
-            recovery === "client" || context.manualClient === true
-              ? { client: "change" as const }
-              : {},
+            recovery === "client"
+              ? { client: registered ?? ("change" as const) }
+              : context.manualClient === true
+                ? { client: "change" as const }
+                : {},
         }
       : undefined;
   const primary = retry === undefined && fixPrompt === undefined;
@@ -265,6 +272,20 @@ function OAuthRecoveryActions({
           </Link>
         )}
       </Button>
+      {registered !== undefined && recovery !== "client" && (
+        <Button variant="link" size="sm" className="text-muted-foreground" asChild>
+          <Link
+            to="/org/$organizationSlug/connections/$connectionId"
+            params={{
+              organizationSlug: context.organizationSlug,
+              connectionId: context.connection,
+            }}
+            search={{ client: registered }}
+          >
+            Edit client details
+          </Link>
+        </Button>
+      )}
     </>
   );
 }
diff --git a/apps/hosted/web/src/implementation/pages/oauth-clients.tsx b/apps/hosted/web/src/implementation/pages/oauth-clients.tsx
index d61d3938fe..53233c1a6e 100644
--- a/apps/hosted/web/src/implementation/pages/oauth-clients.tsx
+++ b/apps/hosted/web/src/implementation/pages/oauth-clients.tsx
@@ -320,35 +320,6 @@ const editConflict = (cause: Cause.Cause<HostedError>) =>
     onNone: () => undefined,
   });
 
-/** Connecting without a client swaps to registering one for that sign-in's server, then returns. */
-export function RegisterServiceClient({
-  service,
-  onDone,
-}: {
-  readonly service: OAuthClientService;
-  readonly onDone: () => void;
-}) {
-  const organization = useOrganization();
-  return (
-    <QueryView
-      query={oauthClientsAtom(organization.organization)}
-      Failure={HostedFailure}
-      pending={<DetailSkeleton label="Loading OAuth clients" />}
-    >
-      {(directory) => (
-        <RegisterOAuthClient
-          services={[
-            directory.services.find((known) => known.issuer === service.issuer) ?? service,
-          ]}
-          redirectUri={directory.redirectUri}
-          className=""
-          onDone={onDone}
-        />
-      )}
-    </QueryView>
-  );
-}
-
 function RegisterOAuthClient({
   services,
   redirectUri,
diff --git a/apps/hosted/web/src/implementation/pages/resource-settings.tsx b/apps/hosted/web/src/implementation/pages/resource-settings.tsx
index deff1ba03f..25452d1514 100644
--- a/apps/hosted/web/src/implementation/pages/resource-settings.tsx
+++ b/apps/hosted/web/src/implementation/pages/resource-settings.tsx
@@ -3,7 +3,7 @@ import { useAtomSet, useAtomValue } from "@effect/atom-react";
 import { AsyncResult } from "effect/reactivity";
 import { Option } from "effect";
 import type { AppId, AccountId } from "@executor-js/sdk";
-import { QueryView } from "@executor-js/ui/dashboard/context";
+import { QueryView, usePreload } from "@executor-js/ui/dashboard/context";
 import { DetailSkeleton } from "@executor-js/ui/dashboard/loading";
 import {
   appAccessAtom,
@@ -20,6 +20,8 @@ import { SharingEditor } from "../components/sharing.tsx";
 export function AppAccessSettings({ app }: { readonly app: AppId }) {
   const { organization } = useOrganizationRoute();
   const save = useAtomSet(shareAppAtom({ organization, app }), { mode: "promiseExit" });
+  // The editor always needs the groups, so they load alongside the access rather than after it.
+  usePreload(appAccessAtom({ organization, app }), groupsAtom(organization));
   const session = AsyncResult.value(useAtomValue(sessionAtom));
   const user = Option.isSome(session) ? session.value?.user.id : undefined;
   return (
diff --git a/apps/local/desktop/README.md b/apps/local/desktop/README.md
index 26618a50e2..4262ad1cab 100644
--- a/apps/local/desktop/README.md
+++ b/apps/local/desktop/README.md
@@ -1,13 +1,15 @@
 # Executor desktop
 
-Electron owns a sandboxed window and a separate local server process. The window
-uses the same dashboard, HTTP API, pairing exchange, and account model as the
-browser app. No Node API or persistent API key is exposed to the renderer.
+Electron owns a sandboxed window onto the background Executor server that the CLI
+uses. The desktop starts that server, or joins the one already running for the
+CLI's data directory, and shows its dashboard. The window uses the same dashboard,
+HTTP API, pairing exchange, and account model as the browser app. No Node API or
+persistent API key is exposed to the renderer.
 
 Release installers include the official Node distribution matching the CLI build
 toolchain. The builder verifies its upstream checksum and retains its license
-notices. The packaged backend runs with that executable; development continues
-to use Electron in Node mode.
+notices. The packaged app runs the background server with that executable;
+development runs the CLI from source with the Node on `PATH`.
 
 ## Run
 
@@ -22,9 +24,12 @@ bun run desktop:dev
 ```
 
 This builds the Electron main entry, creates a locally signed macOS development
-bundle, and launches the app with Vite hot reload. Electron supplies the backend's
-Node runtime. After changes to Electron or server source, rerun
-`bun run desktop:dev` to rebuild and restart.
+bundle, and launches the app. A background server it starts serves the dashboard
+through Vite with hot reload. The background server outlives the app, so after
+changes to server source run `bun run executor service stop`, then
+`bun run desktop:dev` again. A server that `bun run executor` started serves the
+built dashboard; stop it first to get hot reload. After changes to Electron
+source, rerun `bun run desktop:dev`.
 
 On macOS, reopen `.local/desktop-runtime/Executor Dev.app` from Finder. Its launcher
 loads the same `scripts/local-dev.ts` defaults each time. The bundle remains attached to this
@@ -37,88 +42,191 @@ To use the built dashboard instead of Vite:
 bun run desktop:start
 ```
 
-Quit the current instance before switching modes. A second launch focuses the
-existing app. Closing the last macOS window keeps the server running; reopening
-from the Dock restores the dashboard. **Quit Executor** stops both the app and
-its server. Ctrl+C also stops a terminal launch.
+A second launch focuses the existing app. Closing the last macOS window keeps the
+app running; reopening from the Dock restores the dashboard. **Quit Executor**
+and Ctrl+C in a terminal launch stop the app only: the background server keeps
+running for the CLI and MCP clients until `executor service stop`.
 
-Use **File → Open in browser** to connect your system browser to this desktop's
-server. It opens an authenticated dashboard with a one-use link. No CLI is needed;
+Use **File → Open in browser** to connect your system browser to the same server.
+It opens an authenticated dashboard with a one-use link. No CLI is needed;
 MCP clients can then use that browser for local consent.
 
 ## Runtime
 
-- `.local/dev/desktop/` holds the desktop database and retained builds. Set
-  `EXECUTOR_DESKTOP_DATA_DIR` to choose another directory. Do not point two running
-  hosts at the same data directory.
-- `.local/desktop-shell/` holds Chromium's application profile. Browser session
-  cookies use an in-memory partition and are replaced by a new pairing on launch.
-- The backend uses port 4312 unless **File → Server port…** saved another port in
-  `desktop.json` in the data directory, or `EXECUTOR_PORT` is set. `EXECUTOR_PORT` wins and locks
-  the form. Its URL, also the MCP base URL, is printed after readiness. It uses the existing explicitly configured API and
-  encryption keys; startup does not generate persistent keys.
-- Private fd3 carries a one-use bootstrap token. Stdout carries only readiness.
-  Electron waits for the parsed ready message before loading its window.
-- Private fd4 returns OAuth callbacks from the system browser. The parent accepts
-  only the currently pending state and loads the callback in the original window,
-  retaining its session and return intent. The server still validates the OAuth
-  attempt and credentials. Closing that window during consent requires retrying.
+- The desktop shares the CLI's data directory and its one background server:
+  `~/.executor/v2/cli` when packaged, and `bun run executor`'s `.local/dev/local`
+  in development. `EXECUTOR_DESKTOP_DATA_DIR` chooses another directory.
+- Desktops before the background service kept their own data in
+  `<user data>/data` (`.local/dev/desktop` in development). The first launch
+  moves it into the shared directory once, before any server uses it. The port
+  follows the desktop's data: its saved port, or 4312 when it saved none. The
+  CLI's other `service.json` settings are carried over, except the `env`
+  variables tied to the CLI's own data (`EXECUTOR_PORT`, `EXECUTOR_KEY_STORAGE`,
+  `EXECUTOR_API_KEY` and `EXECUTOR_ENCRYPTION_KEY`) and `disabled`: the desktop
+  always runs the background server, which `executor` would otherwise find
+  holding the data. They are read just before the copy moves into place, so a
+  move resumed on a later launch uses the settings the CLI has then. Whatever
+  was in the shared directory moves to `backups/cli-data-<time>` beside it, with
+  its original `service.json`. When that held the CLI's data, or the move
+  changed the CLI's port or left settings out, a notice names the folder and
+  those settings once the window first shows the dashboard or the recovery page. The shared
+  directory ends with mode `0700`, whatever the old directory's was. Until it has
+  been answered, the notice is kept with the move's record in `migration.json`,
+  so a launch that ends first shows it next time. Only an old
+  directory with a database moves; one without, as after a first start that
+  failed, is left where it is and the shared directory is not touched. Both
+  directories stay locked, as a server locks them, from before the copy until
+  the renames are done, so no server starts in either meanwhile. Each lock
+  records the desktop as its owner, so servers treat it as held while the
+  desktop runs and take it over at once if the desktop crashed. A lock lost
+  before its directory moved stops the copy, no rename runs without its lock,
+  and the move rolls back as after any failure. The window opens
+  first and says the data is moving while it does; its menu then has none of the
+  app's own actions, which need the data. Quitting meanwhile, or closing the
+  window, ends the app once the move is done.
+  A directory chosen with `EXECUTOR_DESKTOP_DATA_DIR` only takes over an old one
+  chosen with `EXECUTOR_DESKTOP_LEGACY_DATA_DIR`. If the move fails, nothing is
+  deleted, no server starts and the recovery page explains what to fix.
+- The Electron user-data directory (`.local/desktop-shell/` in development) holds
+  Chromium's profile and, when packaged, `runtime/<version>-<build>/`: the bundled
+  server runtime copied out of the app once per build. The server runs from that
+  copy, so it keeps running while an installer replaces the app or an AppImage
+  unmounts. A copy is used only once `.staged.json`, written last, names its
+  build; a copy without it, as after an interrupted removal, is staged again. On
+  Windows, renames and removals that a virus scanner briefly blocks are retried
+  for a few seconds. Copies other versions no longer use are removed after the
+  desktop's own version runs. Browser session cookies use an in-memory partition
+  and are replaced by a new pairing on launch.
+- On launch the desktop replaces a background server of another version with its
+  own, as an interactive `executor` does. It then pairs the window: `POST
+/auth/pair` with the server's registered password as the bearer, and loads the
+  one-use link. A dashboard load that fails, or has not finished after 30
+  seconds, is tried again with a fresh link two seconds later; after three
+  attempts in a row the window shows its own recovery page with the failure. The
+  server still runs, so that page offers no reset: **Restart** joins the server
+  and loads the dashboard again. A load that another navigation of the window
+  replaced, such as an OAuth return, is left to it, also while a retry waits.
+- The desktop checks every second that the registered server still answers. When
+  another client replaces it, the desktop joins the new one and pairs the window
+  again. A server that stops answering while it is still registered, as after a
+  crash, counts as lost: the desktop joins whichever server runs then, starting
+  one if none does, and three losses within a minute show the recovery page
+  instead. A server stopped on purpose, as by `executor service stop` or
+  `executor service set …`, says it is stopping until it exits and removes its
+  registration, however long that takes, and is not counted or started again:
+  the window says **The background Executor was stopped**, and
+  the desktop joins the next server that registers and answers, as after
+  `executor` or `executor service restart`. **Start** there starts one.
+- The background server runs with the desktop's environment, without Electron's
+  own `ELECTRON_*` variables. It keeps the rest, such as Windows's `SystemRoot`,
+  which Windows programs need. In an AppImage it also drops `APPDIR`, `APPIMAGE`,
+  `ARGV0` and `OWD` and every entry inside the AppImage's mount from `PATH`,
+  `LD_LIBRARY_PATH`, `XDG_DATA_DIRS`, `GSETTINGS_SCHEMA_DIR` and any other
+  variable: the mount is removed once the app quits, while the server keeps
+  running, and another local user could then create that path.
+- The desktop starts or joins the server from the server starter, a short-lived
+  Electron utility process that runs the CLI's start logic, reports the server and
+  exits. The server outlives the app, so it must not keep the app's streams or
+  files open. Electron's main process keeps its standard streams inheritable, and
+  on Windows a child inherits every inheritable handle, so a server started there
+  would keep the app's stdout and stderr open after it quits: whatever waits for
+  them to close, such as a terminal or a launcher, would wait until the server
+  stopped. Chromium starts the utility process with only the handles it names, and
+  Node there makes its standard streams non-inheritable. One handle is still
+  inherited on Windows: the starter's end of its channel to the app, which
+  Chromium creates inheritable, so a server holds it for as long as it runs. That
+  keeps none of the app's streams or files open, and Electron still notices the
+  starter exiting, even when it is ended from outside. A starter that hangs
+  instead never reports, so the desktop gives the starter three minutes, beyond
+  the CLI's two-minute start deadline, before it fails the start and shows the
+  recovery page. On Linux the starter still holds descriptors Chromium gave it
+  without close-on-exec, such as Electron's V8 snapshot, which is inside an
+  AppImage's mount, so the server starts through Bash, which closes every
+  descriptor above stderr first. Without `/bin/bash` the server starts directly
+  and keeps them, so an AppImage's mount stays in use while it runs. The starter's
+  channel to the app is close-on-exec on Linux, so a server never holds it there.
+  macOS starts each child with only the descriptors it names. The starter reports
+  each start attempt it begins and when that attempt exits. If the starter does
+  not exit when told to, the desktop first ends its attempts that still run,
+  except the registered server, as the CLI's start logic would, and then kills it.
+  It ends them only while the starter itself still runs, hung or stopped: once the
+  starter has exited, even before the system has reaped it, an attempt's process
+  ID may name another process, so the attempts of a starter that is gone are left
+  to finish.
+- The server listens on `EXECUTOR_PORT`, else the `port` in the data directory's
+  `service.json`, else 4312. **File → Server port…** edits `service.json`; an
+  `EXECUTOR_PORT` locks it.
+- OAuth consent opens in the system browser. Before it opens, the desktop tells the
+  server to expect the authorization's `state`. The server keeps the provider's
+  callback for an expected state, shows the browser a page asking to return to
+  Executor, and hands the callback to the desktop, which waits for it with an
+  authenticated long poll. The desktop loads it in the original window, keeping
+  its session and return intent. At most 16 states and callbacks are kept, for 15
+  minutes each. Callbacks for other states, including every OAuth a browser
+  starts, complete in that browser.
 - External HTTP(S) links open in the system browser. Other schemes and embedded
   Node access are disabled. App-origin launch links also open in the browser.
 - Desktop warms the entry graph and keeps the renderer unthrottled during startup.
   HMR uses a separate ephemeral loopback listener and Vite cache, so it can
   run alongside the browser development server.
-- A supervisor restarts the backend after an unexpected exit, waiting 500 ms and
-  doubling to at most 10 s; readiness resets the delay. Each run gets a fresh one-use
-  fd3 token and the window reloads with its new pairing link. Three unexpected exits
-  within 60 seconds stop restarts and show the recovery page.
-- Start, readiness and key-setup failures show the same script-free recovery page.
-  Its buttons navigate to `executor-recovery:restart|logs|reset|quit`, which the
-  main process intercepts; there is still no preload or IPC. Actions depend on the
-  failure. Reset is never offered when the OS credential store is unavailable or
-  denies access, when `EXECUTOR_KEY_STORAGE` or supplied keys do not match the
-  data, or when the data is locked by another process. A denied store offers
+- Start and key-setup failures show the same script-free recovery page, with what
+  the server said. A server whose key setup refuses to start writes its reason as
+  one line on stderr before its message; the desktop reads it from the start
+  failure and chooses the page's actions from it. Its buttons navigate to
+  `executor-recovery:start|restart|logs|reset|quit`, which the main process
+  intercepts; there is still no preload or IPC. Reset is never offered when the OS
+  credential store is unavailable or denies access, when `EXECUTOR_KEY_STORAGE` or
+  supplied keys do not match the data, or when the data is locked by a process
+  that is not its background server, including an Executor from before the
+  background service that its `server.json` names. A denied store offers
   **Restart**, which prompts again.
 - A crashed renderer reloads up to three times per minute. After that the app
   says the window kept crashing, names the diagnostics folder and quits. The native
   error box is otherwise used only when the window itself fails.
-- Shutdown is scoped and force-kills an unresponsive backend after four seconds.
 
 ## Reset with backup
 
 **Help → Reset Executor data…** and the recovery page's **Reset data…** ask for
-confirmation (Cancel is the default). Reset then stops the backend, waits for its
-telemetry collector to exit and takes the data directory's bootstrap lock. It
-renames the whole data directory to `backups/data-<time>-<random>` beside it
-(`<userData>/backups/` for installed apps) and writes `executor-backup.json` there:
-app version, time, source path, installation ID, key source and, for the OS
-credential store, its service/account. It never contains a key. Executor restarts with fresh data and
+confirmation (Cancel is the default). Reset then stops the background server, waits
+for its telemetry collector to exit and takes the data directory's server and
+bootstrap locks, so no other client starts a server meanwhile. It takes the
+server lock as a server does, so a lock left by a server that crashed or was
+killed is taken over, and records the desktop as its owner, so servers treat it
+as held while the desktop runs. It refuses, moving nothing, while an Executor from before
+the background service uses the data: that server holds no lock and the desktop
+cannot stop it; key rotation refuses then too.
+It renames the whole data directory, which the CLI shares, to
+`backups/data-<time>-<random>` beside it (`~/.executor/v2/backups/` when packaged);
+on Windows, where a server that was just stopped or killed keeps its files open
+for a moment, the rename is retried for a few seconds. It then writes `executor-backup.json` there: app version, time, source path,
+installation ID, key source and, for the OS credential store, its service/account.
+It never contains a key. Executor starts the server again with fresh data and
 names the backup, with **Show in folder**.
 
 Nothing is deleted. The old OS credential entry stays where it is, still paired
 with the backup through its installation ID; a `keys.json` moves with the backup. To restore, quit Executor and move the
 backup directory back to the data path. There is no restore UI or automatic cleanup.
 If the rename fails, for example because another program holds a file open on
-Windows, the data stays in place and Executor restarts on it. No restart can begin
-while a reset holds the stopped backend. The desktop log continues in a new
-`executor-desktop.jsonl` under the fresh data directory.
+Windows, the data stays in place and Executor starts the server on it again. The
+desktop log continues in a new `executor-desktop.jsonl` under the fresh data
+directory.
 
 **Help → Show diagnostics folder** opens the directory holding the desktop,
-backend and collector logs.
+server and collector logs.
 
 ## Recovery scenarios
 
-`e2e/tests/desktop-recovery.spec.ts` stops and kills the real backend to check
-exit classification, restart delays, crash-loop recovery and **Restart**. It starts
-from a missing key file to check the configuration recovery page, a failed move
-that leaves data in place, and reset with its backup manifest, including reset of a
-running server whose `keys.json` moves with the backup. It checks that a locked data
-directory, supplied keys or `EXECUTOR_KEY_STORAGE` that do not match the data, and an
-unusable OS credential store never offer reset. The store is made absent on Linux and
-refuses access on macOS; Windows has no such case. It uses synthetic supplied keys, a
-key file or an unusable store, so it never touches a real OS credential. The
-release workflow runs it against each packaged desktop. Locally, build the entry
-and run it; set `EXECUTOR_E2E_DESKTOP_EXECUTABLE` to test a packaged app:
+`e2e/tests/desktop-recovery.spec.ts` drives the desktop against real background
+servers: sharing one with the CLI, staying stopped after `executor service stop`
+and joining the server the CLI starts next, replacing a crashed one, the recovery
+page, reset and the data migration. Each scenario uses its own temporary data
+directory and port, runs the CLI on the same directory, and stops every server it
+left. A failed scenario keeps a screenshot of each desktop window and the
+desktop's and its servers' logs in a `failed-<time>-<pid>` folder under
+`EXECUTOR_E2E_DESKTOP_SCREENSHOTS` (`.local/desktop-recovery` by default). The
+release workflow runs it against each packaged desktop, whose CLI is the
+runtime it staged. Locally, build the entry and run it, under `xvfb-run -a` on
+Linux; set `EXECUTOR_E2E_DESKTOP_EXECUTABLE` to test a packaged app:
 
 ```sh
 bun run apps:build && bun run e2e:apps && bun run telemetry:build && bun run web:build
@@ -131,16 +239,17 @@ bunx vitest run --config e2e/desktop-recovery.config.ts
 **File → Server port…** opens a script-free form in its own sandboxed window. Submitting it is a
 navigation to `executor-settings:` that the parent intercepts; there is still no preload or IPC
 bridge. The parent accepts ports 1024 to 65535, refuses one another program is listening on,
-writes `desktop.json` (mode `0600`) and relaunches. A bind can still race another process after
-the check. An unreadable `desktop.json` stops startup rather than silently using the default.
-
-**File → Rotate local API key…** confirms, stops the server, then runs the backend entry with
-`--rotate-api-key` and relaunches. That process replaces the API key where the data directory keeps
-it (OS credential store or `keys.json`) and retains the encryption key, so saved accounts and MCP
-sign-ins still work. Browser sessions are unaffected; scripts and clients that send the old key
-must be updated. Outstanding account-connection links are signed with the old key and stop working.
-Supplied `EXECUTOR_API_KEY`/`EXECUTOR_ENCRYPTION_KEY` are never stored, so the menu explains that
-they must be changed where they are set. The CLI equivalent is `executor rotate-key`.
+saves it as `port` in `service.json`, keeping its other settings, and restarts the background
+server. A bind can still race another process after the check. An invalid `service.json` locks
+the form and names the file.
+
+**File → Rotate local API key…** confirms, stops the background server, runs `executor
+rotate-key` with the same runtime and starts the server again. That replaces the API key where the
+data directory keeps it (OS credential store or `keys.json`) and retains the encryption key, so
+saved accounts and MCP sign-ins still work. Browser sessions are unaffected; scripts and clients
+that send the old key must be updated. Outstanding account-connection links are signed with the
+old key and stop working. Supplied `EXECUTOR_API_KEY`/`EXECUTOR_ENCRYPTION_KEY` are never stored,
+so the menu explains that they must be changed where they are set.
 
 **Help → Export diagnostics…** writes `executor-diagnostics-<UTC stamp>.zip` to Downloads and
 reveals it. It contains a manifest (versions, platform, origin, port source, data directory) and
@@ -150,15 +259,15 @@ retained builds, the browser profile and Motel's trace store are never read. Log
 redacted at the source; the export additionally masks bearer values, `pair`/`token`/`code`/`state`
 URL parameters, 64-digit hex runs and credential-named JSON fields.
 
-## T3 Code reference
+## References
+
+The background service follows OpenCode's desktop (`packages/desktop/src/main/service/`,
+MIT): stage the bundled CLI outside the app, then start or join the service with the
+bundled version winning on launch.
 
 Reviewed `pingdotgg/t3code` at `93e04160` (2026-09-18). The ignored checkout is
 `.reference/t3code-desktop/`. The main references are:
 
-- `apps/desktop/src/backend/DesktopBackendManager.ts`: scoped backend process,
-  private bootstrap pipe, readiness, and bounded shutdown.
-- `apps/desktop/src/backend/DesktopBackendConfiguration.ts`: run Electron's binary
-  in Node mode for the server.
 - `apps/desktop/src/window/DesktopWindow.ts`: sandboxed window and native lifecycle.
 - `apps/desktop/vite.config.ts`: bundled CommonJS main entry with Electron external.
 - `apps/web/vite.config.ts` and `apps/web/vite/tailwind.ts`: bundled development,
@@ -174,12 +283,10 @@ from this workspace launcher. Windows and Linux have not been verified.
 
 ## Persistent diagnostics
 
-Startup builds and copies the Motel collector bundle into `dist/motel`.
-The backend serves it with the bundled workerd and persists traces/logs under its data directory's
-`diagnostics/`. The Electron parent records startup, exits and renderer messages in
-`executor-desktop.jsonl`. Each backend's last 256 KB of stderr is written there only
-when that run fails; stdout and private callback
-pipes remain protocol-only. See [telemetry](../../../notes/telemetry.md#frontend-lifetime-and-local-diagnostics)
+The background server runs the Motel collector and persists traces and logs under the
+data directory's `diagnostics/`. The Electron parent records startup, connections,
+recovery and renderer messages in `executor-desktop.jsonl` beside them. See
+[telemetry](../../../notes/telemetry.md#frontend-lifetime-and-local-diagnostics)
 for retention, query URLs, and the JSONL files an agent can inspect.
 
 ## Packaged preview
@@ -190,18 +297,20 @@ application for inspection. Output lives in `.local/releases/`.
 
 The preview is named **Executor Preview**, with a separate app ID and persistent
 Electron user-data directory. It contains the server, dashboard, framework,
-compiler, Git, SDK dependencies and collector. It does not load `.env` files, call 1Password,
-require a workspace or use the original Executor updater. The parent still owns
-private bootstrap/callback pipes and waits for backend shutdown before updating.
+compiler, Git, SDK dependencies and collector, and `desktop-runtime.json`, which
+names the build so each rebuild is staged again. It does not load `.env` files,
+call 1Password, require a workspace or use the original Executor updater. Installing
+an update quits the app only; the next launch replaces the running server with the
+new version.
 
-The backend uses the local server's default port, 4312, or an explicit `EXECUTOR_PORT`.
-It keeps the same MCP URL after a restart. Use another fixed port when running a
-second installation. Development and tests can explicitly request port 0.
+The server uses `EXECUTOR_PORT`, the `service.json` port or 4312, so MCP clients keep
+the same URL across restarts. Use another fixed port when running a second data
+directory.
 
 Windows and Linux builds, and signed macOS builds, include the channel feed in
 `app-update.yml`. Unsigned macOS builds have none, and their **Updates** menu
 points to the download page. See [desktop update channels](../../../RELEASING.md#desktop-update-channels).
 
-For now start the executable with explicitly supplied API/encryption keys in its
-environment. That works independently of the repository, but a complete Finder
-first-run setup is still needed. See [the pending first-launch decision](../../../notes/installable-releases.md#first-launch-storage-decision-pending).
+On first launch the background server creates its keys in the OS credential store,
+or `keys.json` where there is none. See
+[first launch](../../../notes/installable-releases.md#first-launch-os-credential-store-then-key-file).
diff --git a/apps/local/desktop/scripts/build.mjs b/apps/local/desktop/scripts/build.mjs
index 6d6664b0e1..e167b93970 100644
--- a/apps/local/desktop/scripts/build.mjs
+++ b/apps/local/desktop/scripts/build.mjs
@@ -1,13 +1,19 @@
-/** Bundle the native entry while keeping Electron's runtime API external, as T3 Code does. */
+/**
+ * Bundle the native entry, and the server starter it runs in a utility process, while keeping
+ * Electron's runtime API external, as T3 Code does.
+ */
 import { fileURLToPath } from "node:url";
-import { cp } from "node:fs/promises";
 import { build } from "esbuild";
 
 export async function buildDesktop() {
   const desktop = fileURLToPath(new URL("..", import.meta.url));
   await build({
-    entryPoints: [`${desktop}/src/main.ts`],
-    outfile: `${desktop}/dist/main.cjs`,
+    entryPoints: {
+      main: `${desktop}/src/main.ts`,
+      starter: `${desktop}/src/starter.ts`,
+    },
+    outdir: `${desktop}/dist`,
+    outExtension: { ".js": ".cjs" },
     bundle: true,
     platform: "node",
     format: "cjs",
@@ -15,10 +21,6 @@ export async function buildDesktop() {
     external: ["electron"],
     sourcemap: true,
   });
-  await cp(`${desktop}/../../../packages/telemetry/dist/motel`, `${desktop}/dist/motel`, {
-    recursive: true,
-    force: true,
-  });
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await buildDesktop();
diff --git a/apps/local/desktop/scripts/launcher.mjs b/apps/local/desktop/scripts/launcher.mjs
index 481ee0c452..92a9f97c03 100644
--- a/apps/local/desktop/scripts/launcher.mjs
+++ b/apps/local/desktop/scripts/launcher.mjs
@@ -18,7 +18,7 @@ export async function resolveLauncher() {
   const electronMetadata = JSON.parse(
     await readFile(new URL("../node_modules/electron/package.json", import.meta.url), "utf8"),
   );
-  const revision = `${electronMetadata.version}:3:${root}`;
+  const revision = `${electronMetadata.version}:4:${root}`;
   let previous;
   try {
     previous = await readFile(join(runtime, "revision"), "utf8");
@@ -43,7 +43,7 @@ export async function resolveLauncher() {
       execFileSync("/usr/bin/plutil", ["-replace", key, "-string", value, plist]);
     }
     const preload = `--import="${join(root, "scripts/local-dev.ts")}"`;
-    const script = `#!/bin/sh\nset -eu\nunset ELECTRON_RUN_AS_NODE\ncd ${quote(root)}\nexport PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"\nexport NODE_OPTIONS=${quote(preload)}\nexec ${quote(executable)} ${quote(join(root, "apps/local/desktop"))} --dev "$@" >> ${quote(join(root, ".local/desktop.log"))} 2>&1\n`;
+    const script = `#!/bin/sh\nset -eu\nunset ELECTRON_RUN_AS_NODE\ncd ${quote(root)}\nexport PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"\nexport NODE_OPTIONS=${quote(preload)}\nexport EXECUTOR_DESKTOP_DEV=1\nexec ${quote(executable)} ${quote(join(root, "apps/local/desktop"))} --dev "$@" >> ${quote(join(root, ".local/desktop.log"))} 2>&1\n`;
     await writeFile(launcher, script, { mode: 0o755 });
     execFileSync(
       "/usr/bin/codesign",
diff --git a/apps/local/desktop/scripts/start.mjs b/apps/local/desktop/scripts/start.mjs
index 7ef1cdde23..28ccc20357 100644
--- a/apps/local/desktop/scripts/start.mjs
+++ b/apps/local/desktop/scripts/start.mjs
@@ -12,6 +12,8 @@ await buildDesktop();
 const { executable } = await resolveLauncher();
 const env = { ...process.env };
 delete env.ELECTRON_RUN_AS_NODE;
+// A background server this desktop starts serves the dashboard through Vite with hot reload.
+if (process.argv.includes("--dev")) env.EXECUTOR_DESKTOP_DEV = "1";
 const child = spawn(executable, [desktop, ...process.argv.slice(2)], {
   cwd: root,
   env,
diff --git a/apps/local/desktop/src/contracts/desktop.ts b/apps/local/desktop/src/contracts/desktop.ts
index de1600fd6c..d67f1299ee 100644
--- a/apps/local/desktop/src/contracts/desktop.ts
+++ b/apps/local/desktop/src/contracts/desktop.ts
@@ -1,7 +1,8 @@
 import { Schema } from "effect";
 import { LocalConfigurationReason } from "@executor-js/local-server/auth";
+import { ServiceFailed, ServiceSettingInvalid } from "../../../server/src/contracts/service.ts";
 
-/** Only the child server's exact loopback HTTP origin can host the dashboard. */
+/** Only the background server's exact loopback HTTP origin can host the dashboard. */
 export const LocalOrigin = Schema.String.check(
   Schema.makeFilter((value) => {
     try {
@@ -18,59 +19,32 @@ export const LocalOrigin = Schema.String.check(
   }),
 );
 
-/** Safe desktop failures never include process output, bootstrap tokens or callback URLs. */
+/** Safe desktop failures never include process output, passwords or callback URLs. */
 export class DesktopFailed extends Schema.TaggedError<DesktopFailed>()("DesktopFailed", {
-  stage: Schema.Literals([
-    "configuration",
-    "start",
-    "ready",
-    "server-exit",
-    "window",
-    "renderer",
-    "oauth",
-  ]),
+  stage: Schema.Literals(["configuration", "runtime", "pairing", "window", "renderer", "oauth"]),
 }) {}
 
-/** Private fd4 message; OAuth response parameters must never be copied to a log. */
-export const DesktopCallback = Schema.Struct({
-  version: Schema.Literal(1),
-  url: Schema.RedactedFromValue(
-    Schema.String.check(
-      Schema.makeFilter((value) => {
-        try {
-          const url = new URL(value);
-          return (
-            url.protocol === "http:" &&
-            url.hostname === "127.0.0.1" &&
-            !url.username &&
-            !url.password
-          );
-        } catch {
-          return false;
-        }
-      }),
-    ),
-  ),
-});
-
-/** Private fd4 message sent before the backend exits because its key setup refused to start. */
-export const DesktopConfigurationFailed = Schema.Struct({
-  version: Schema.Literal(1),
-  configuration: LocalConfigurationReason,
-});
-/** Every fd4 line is one of these. The pipe never carries free-form output. */
-export const DesktopBackendMessage = Schema.Union([DesktopCallback, DesktopConfigurationFailed]);
-
 /**
- * Why the window shows the recovery screen instead of the dashboard. A configuration failure keeps
- * the backend's reason; its message stays in diagnostics.
+ * Why the window shows the recovery screen instead of the dashboard. `detail` is what the
+ * background server or the data migration said, shown under the explanation.
  */
 export type DesktopRecovery =
-  | { readonly stage: "start" | "ready" | "crash-loop" }
-  | { readonly stage: "configuration"; readonly reason: LocalConfigurationReason };
+  | { readonly stage: "start"; readonly detail: string }
+  | {
+      readonly stage: "configuration";
+      readonly reason: LocalConfigurationReason;
+      readonly detail: string;
+    }
+  | { readonly stage: "runtime" }
+  | { readonly stage: "crash-loop" }
+  | { readonly stage: "migration"; readonly detail: string }
+  /** The background server runs, but the window could not load its dashboard. */
+  | { readonly stage: "dashboard"; readonly detail: string }
+  /** The background server was stopped on purpose, and none runs yet. */
+  | { readonly stage: "stopped" };
 
 /** Buttons on the script-free recovery page navigate to `executor-recovery:<action>`. */
-export const RecoveryAction = Schema.Literals(["restart", "logs", "reset", "quit"]);
+export const RecoveryAction = Schema.Literals(["start", "restart", "logs", "reset", "quit"]);
 export type RecoveryAction = typeof RecoveryAction.Type;
 
 /**
@@ -126,16 +100,17 @@ export const DesktopPort = Schema.Number.check(
   Schema.isBetween({ minimum: 1024, maximum: 65535 }),
 );
 
-/** `desktop.json` in the desktop data directory. An absent file means the server's default port. */
-export const DesktopSettings = Schema.Struct({
+/**
+ * `desktop.json` in the data directory desktops before the background service used. Only the
+ * one-off migration reads it, to carry its port over to the background service's settings.
+ */
+export const LegacyDesktopSettings = Schema.Struct({
   version: Schema.Literal(1),
   port: DesktopPort,
 });
 
-/** Settings failures never expose the file contents. */
-export class SettingsFailed extends Schema.TaggedError<SettingsFailed>()("SettingsFailed", {
-  reason: Schema.Literals(["invalid", "unavailable", "write"]),
-}) {}
+/** Saving a setting failed. It never exposes the file contents. */
+export class SettingsFailed extends Schema.TaggedError<SettingsFailed>()("SettingsFailed", {}) {}
 
 /** Diagnostics export failures never include the files being collected. */
 export class DiagnosticsFailed extends Schema.TaggedError<DiagnosticsFailed>()(
@@ -143,9 +118,71 @@ export class DiagnosticsFailed extends Schema.TaggedError<DiagnosticsFailed>()(
   {},
 ) {}
 
-/** The rotation child's one stdout line. `message` is sanitized configuration text, never a key. */
-export const RotationResult = Schema.Struct({
-  version: Schema.Literal(1),
-  rotated: Schema.Boolean,
-  message: Schema.String,
+/**
+ * `desktop-runtime.json` beside the server runtime a desktop build bundles. Each build has its own
+ * `build`, so a rebuilt runtime is staged again even when the version did not change.
+ */
+export const DesktopRuntimeBuild = Schema.Struct({
+  version: Schema.String,
+  build: Schema.String.check(Schema.isPattern(/^[a-f0-9]{12}$/u)),
+});
+export type DesktopRuntimeBuild = typeof DesktopRuntimeBuild.Type;
+/** The file name of `DesktopRuntimeBuild` in a bundled or staged runtime. */
+export const desktopRuntimeBuildFile = "desktop-runtime.json";
+
+/** The server starter could not create or read the data directory. */
+export class StarterDirectoryFailed extends Schema.TaggedError<StarterDirectoryFailed>()(
+  "StarterDirectoryFailed",
+  {},
+) {}
+
+/**
+ * What the desktop sends its server starter, an Electron utility process, over that process's
+ * parent port. `Start` starts or joins the background server for `directory` with `program`, as
+ * the CLI's `ensure` does; `version` decides whether a server of another version is replaced. It
+ * is never passed on the command line, since `program.env` may hold keys. `Stop` ends the starter:
+ * one still starting first asks the start attempts it began to exit, as an interrupted `ensure`
+ * does.
+ */
+export const StarterCommand = Schema.TaggedUnion({
+  Start: {
+    directory: Schema.String,
+    version: Schema.Literals(["replace", "ignore"]),
+    program: Schema.Struct({
+      command: Schema.Array(Schema.String),
+      version: Schema.String,
+      env: Schema.Record(Schema.String, Schema.String),
+    }),
+  },
+  Stop: {},
+});
+export type StarterCommand = typeof StarterCommand.Type;
+
+/**
+ * What the server starter reports: `Starting` when it starts a server, replacing one of version
+ * `previous` if given, then one outcome. `Ready` is the server that answered as the registered
+ * one; its password works as the local API key. `Failed` says why no server started or answered.
+ */
+export const StarterReport = Schema.TaggedUnion({
+  Starting: { version: Schema.String, previous: Schema.optionalKey(Schema.String) },
+  Ready: {
+    url: Schema.String,
+    version: Schema.String,
+    pid: Schema.Number,
+    password: Schema.RedactedFromValue(Schema.String),
+    browserOrigin: Schema.optional(Schema.String),
+  },
+  Failed: { error: Schema.Union([ServiceFailed, ServiceSettingInvalid, StarterDirectoryFailed]) },
+});
+export type StarterReport = typeof StarterReport.Type;
+
+/**
+ * Besides its report, the server starter says when it begins a start attempt, with the attempt's
+ * process ID, and when that attempt has exited. The desktop ends the attempts still running if it
+ * has to kill the starter, which then never asks them to exit (see `ensureServer`).
+ */
+export const StarterAttempt = Schema.TaggedUnion({
+  AttemptStarted: { pid: Schema.Number },
+  AttemptExited: { pid: Schema.Number },
 });
+export type StarterAttempt = typeof StarterAttempt.Type;
diff --git a/apps/local/desktop/src/implementation/backend.ts b/apps/local/desktop/src/implementation/backend.ts
deleted file mode 100644
index 6a80647ba4..0000000000
--- a/apps/local/desktop/src/implementation/backend.ts
+++ /dev/null
@@ -1,243 +0,0 @@
-import {
-  Deferred,
-  Effect,
-  Fiber,
-  Option,
-  type PlatformError,
-  Queue,
-  Redacted,
-  Ref,
-  Schema,
-  Stream,
-} from "effect";
-import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import {
-  DesktopBootstrap,
-  ServerReady,
-  type LocalConfigurationReason,
-} from "@executor-js/local-server/auth";
-import {
-  DesktopBackendMessage,
-  DesktopCallback,
-  DesktopConfigurationFailed,
-  DesktopFailed,
-  LocalOrigin,
-} from "../contracts/desktop.ts";
-
-/** Stderr kept for one run. It reaches diagnostics only when that run fails. */
-const stderrTailBytes = 256 * 1024;
-/** Output readers finish at pipe EOF; a leaked descriptor must not delay exit handling. */
-const drainTimeout = "1 second";
-
-/** How one backend process ended. */
-export interface BackendExit {
-  readonly code: number | null;
-  readonly signal: string | null;
-  /** The parent asked this process to stop (quit, reset or a supervised restart). */
-  readonly stoppedByUs: boolean;
-  /** The process reported readiness before it exited. */
-  readonly ready: boolean;
-  /** Key setup refused to start; see the private fd4 message. */
-  readonly configuration: Option.Option<LocalConfigurationReason>;
-  /** The last output written to stderr, bounded by `stderrTailBytes`. */
-  readonly stderr: string;
-}
-
-/** Signals and POSIX 128+N exit codes that mean "stop", as opposed to "you are broken". */
-const shutdownSignals: ReadonlySet<string> = new Set(["SIGINT", "SIGTERM", "SIGHUP"]);
-const shutdownCodes: ReadonlySet<number> = new Set([129, 130, 143]);
-
-/**
- * Ported from the original desktop's sidecar classifier. A managed stop needs no recovery. An
- * external shutdown (for example a group SIGINT) is not a crash, but the server is still gone.
- */
-export type BackendExitKind =
-  | { readonly kind: "managed-stop" }
-  | { readonly kind: "external-shutdown"; readonly reason: string }
-  | { readonly kind: "crash" };
-
-export const classifyBackendExit = (
-  exit: Pick<BackendExit, "code" | "signal" | "stoppedByUs">,
-  appQuitting: boolean,
-): BackendExitKind => {
-  if (exit.stoppedByUs || appQuitting) return { kind: "managed-stop" };
-  if (exit.signal !== null && shutdownSignals.has(exit.signal))
-    return { kind: "external-shutdown", reason: exit.signal };
-  if (exit.code !== null && shutdownCodes.has(exit.code))
-    return { kind: "external-shutdown", reason: `code ${exit.code}` };
-  return { kind: "crash" };
-};
-
-/** Keep the newest bytes, dropping whole chunks first and trimming the oldest retained one. */
-const appendTail = (chunks: ReadonlyArray<Uint8Array>, chunk: Uint8Array) => {
-  const next = [
-    ...chunks,
-    chunk.byteLength > stderrTailBytes ? chunk.slice(-stderrTailBytes) : chunk,
-  ];
-  let size = next.reduce((total, current) => total + current.byteLength, 0);
-  while (size > stderrTailBytes) {
-    const first = next[0]!;
-    const excess = size - stderrTailBytes;
-    if (first.byteLength <= excess) {
-      next.shift();
-      size -= first.byteLength;
-    } else {
-      next[0] = first.slice(excess);
-      size -= excess;
-    }
-  }
-  return next;
-};
-
-/** The Node spawner reports a signal exit as a failure whose cause names the signal. */
-const signalOf = (error: PlatformError.PlatformError) => {
-  const cause = error.reason.cause;
-  return cause instanceof Error ? (/signal: '([A-Z0-9]+)'/.exec(cause.message)?.[1] ?? null) : null;
-};
-
-/**
- * Start one scoped backend process. fd3 carries its one-use bootstrap token, stdout readiness and
- * fd4 OAuth callbacks or a configuration failure. Closing the scope stops the process.
- */
-export const startBackend = (options: {
-  readonly executable: string;
-  readonly entry: string;
-  readonly cwd: string;
-  readonly directory: string;
-  readonly collectorBundle: string;
-  readonly development: boolean;
-  /** The saved desktop port. Undefined keeps an inherited EXECUTOR_PORT or the server default. */
-  readonly port: number | undefined;
-  readonly token: (typeof DesktopBootstrap.Type)["token"];
-}) =>
-  Effect.gen(function* () {
-    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    const bootstrap = yield* Schema.encodeEffect(Schema.fromJsonString(DesktopBootstrap))({
-      version: 1,
-      token: options.token,
-    }).pipe(Effect.mapError(() => new DesktopFailed({ stage: "start" })));
-    const child = yield* spawner
-      .spawn(
-        ChildProcess.make(options.executable, [options.entry], {
-          cwd: options.cwd,
-          env: {
-            ELECTRON_RUN_AS_NODE: "1",
-            EXECUTOR_DATA_DIR: options.directory,
-            EXECUTOR_MOTEL_BUNDLE: options.collectorBundle,
-            EXECUTOR_DESKTOP_DEV: options.development ? "1" : "0",
-            ...(options.port === undefined ? {} : { EXECUTOR_PORT: String(options.port) }),
-            // A desktop callback must return to its owned loopback listener.
-            EXECUTOR_BROWSER_ORIGIN: undefined,
-          },
-          extendEnv: true,
-          stdin: "ignore",
-          stdout: "pipe",
-          stderr: "pipe",
-          additionalFds: {
-            fd3: { type: "input", stream: Stream.make(bootstrap).pipe(Stream.encodeText) },
-            fd4: { type: "output" },
-          },
-          killSignal: "SIGTERM",
-          forceKillAfter: 4_000,
-        }),
-      )
-      .pipe(
-        Effect.tapCause((cause) => Effect.logError("Desktop backend could not start", cause)),
-        Effect.mapError(() => new DesktopFailed({ stage: "start" })),
-      );
-    yield* Effect.logInfo("Desktop backend started").pipe(Effect.annotateLogs({ pid: child.pid }));
-
-    // stderr is diagnostic output; stdout and private descriptors remain protocol-only.
-    const stderr = yield* Ref.make<ReadonlyArray<Uint8Array>>([]);
-    const stderrReader = yield* child.stderr.pipe(
-      Stream.runForEach((chunk) => Ref.update(stderr, (chunks) => appendTail(chunks, chunk))),
-      Effect.ignore,
-      Effect.forkScoped,
-    );
-
-    const configuration = yield* Ref.make(Option.none<LocalConfigurationReason>());
-    const callbacks = yield* Queue.unbounded<typeof DesktopCallback.Type>();
-    const messageReader = yield* child.getOutputFd(4).pipe(
-      Stream.decodeText,
-      Stream.splitLines,
-      Stream.runForEach((line) =>
-        Schema.decodeUnknownEffect(Schema.fromJsonString(DesktopBackendMessage))(line).pipe(
-          Effect.flatMap((message) =>
-            Schema.is(DesktopConfigurationFailed)(message)
-              ? Ref.set(configuration, Option.some(message.configuration))
-              : Queue.offer(callbacks, message),
-          ),
-          Effect.catch(() => Effect.logWarning("Desktop backend sent an invalid private message")),
-        ),
-      ),
-      Effect.ignore,
-      Effect.forkScoped,
-    );
-
-    const ready = yield* Deferred.make<string, DesktopFailed>();
-    const reported = yield* Ref.make(false);
-    yield* child.stdout.pipe(
-      Stream.decodeText,
-      Stream.splitLines,
-      Stream.runForEach((line) =>
-        Schema.decodeUnknownEffect(Schema.fromJsonString(ServerReady))(line).pipe(
-          Effect.flatMap((message) => Schema.decodeUnknownEffect(LocalOrigin)(message.url)),
-          Effect.mapError(() => new DesktopFailed({ stage: "ready" })),
-          Effect.matchEffect({
-            onFailure: (error) => Deferred.fail(ready, error),
-            onSuccess: (origin) =>
-              Ref.set(reported, true).pipe(Effect.andThen(Deferred.succeed(ready, origin))),
-          }),
-        ),
-      ),
-      Effect.catch(() => Deferred.fail(ready, new DesktopFailed({ stage: "ready" }))),
-      Effect.forkScoped,
-    );
-
-    const stoppedByUs = yield* Ref.make(false);
-    const exited = yield* Deferred.make<BackendExit>();
-    yield* child.exitCode.pipe(
-      Effect.match({
-        onSuccess: (code) => ({ code: Number(code), signal: null }),
-        onFailure: (error) => ({ code: null, signal: signalOf(error) }),
-      }),
-      Effect.flatMap(({ code, signal }) =>
-        Effect.gen(function* () {
-          yield* Effect.all([Fiber.await(stderrReader), Fiber.await(messageReader)], {
-            concurrency: 2,
-            discard: true,
-          }).pipe(Effect.timeoutOption(drainTimeout));
-          const tail = yield* Ref.get(stderr);
-          const exit: BackendExit = {
-            code,
-            signal,
-            stoppedByUs: yield* Ref.get(stoppedByUs),
-            ready: yield* Ref.get(reported),
-            configuration: yield* Ref.get(configuration),
-            stderr: new TextDecoder().decode(Buffer.concat(tail)),
-          };
-          yield* Deferred.succeed(exited, exit);
-        }),
-      ),
-      Effect.forkScoped,
-    );
-
-    return {
-      pid: Number(child.pid),
-      /** Resolves with the parsed loopback origin; fails on a bad readiness line. */
-      ready: Deferred.await(ready),
-      /** Resolves once the process has exited and its output has drained. */
-      exited: Deferred.await(exited),
-      /** OAuth callbacks for this run only. */
-      callbacks: Stream.fromQueue(callbacks),
-      pairingUrl: (origin: string) => `${origin}/#pair=${Redacted.value(options.token)}`,
-      /** Ask the process to stop and wait for its exit; forced after four seconds. */
-      stop: Ref.set(stoppedByUs, true).pipe(
-        Effect.andThen(child.kill({ killSignal: "SIGTERM", forceKillAfter: 4_000 })),
-        Effect.ignore,
-        Effect.andThen(Deferred.await(exited)),
-      ),
-    };
-  });
-
-export type BackendRun = Effect.Success<ReturnType<typeof startBackend>>;
diff --git a/apps/local/desktop/src/implementation/connection.ts b/apps/local/desktop/src/implementation/connection.ts
new file mode 100644
index 0000000000..f4b19dfb60
--- /dev/null
+++ b/apps/local/desktop/src/implementation/connection.ts
@@ -0,0 +1,353 @@
+/**
+ * The background Executor this desktop uses. It starts or joins the server for its data directory,
+ * pairs the window with it and follows it. When the server stops answering, because it crashed or
+ * another client replaced it, the desktop joins whichever server runs then, starting one if none
+ * does. A server stopped on purpose, which says it is stopping until it removes its registration,
+ * is not started again: the desktop says it was stopped and joins the next server that registers,
+ * starting one only when asked. Quitting the desktop leaves the server running.
+ */
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import {
+  Clock,
+  Duration,
+  Effect,
+  Fiber,
+  FileSystem,
+  Option,
+  Path,
+  PlatformError,
+  Redacted,
+  Ref,
+  Result,
+  Schema,
+  Semaphore,
+} from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { HttpApiClient } from "effect/http-api";
+import type { ChildProcessSpawner } from "effect/process";
+import { LocalAuthApi } from "@executor-js/local-server/auth";
+import { DesktopReturnApi } from "../../../server/src/contracts/desktop-return.ts";
+import { ServiceFailed, ServiceSettingInvalid } from "../../../server/src/contracts/service.ts";
+import {
+  discover,
+  registered,
+  stop,
+  type RunningService,
+} from "../../../server/src/implementation/service-client.ts";
+import {
+  readRegistration,
+  refuseEarlierServer,
+} from "../../../server/src/implementation/service-files.ts";
+import {
+  DesktopFailed,
+  LocalOrigin,
+  StarterDirectoryFailed,
+  type DesktopRecovery,
+} from "../contracts/desktop.ts";
+import { ensureServer, type ServiceRuntime } from "./runtime.ts";
+
+/**
+ * Losing the server unexpectedly this many times within the window stops reconnecting and shows
+ * recovery. A server that was stopped or replaced on purpose is not counted.
+ */
+const lossLimit = 3;
+const lossWindow = Duration.seconds(60);
+const reconnectDelay = Duration.millis(500);
+/** How often the desktop checks that its server still answers as the registered one. */
+const checkInterval = Duration.seconds(1);
+/** A registered server that misses this many checks in a row is gone. */
+const missedChecks = 3;
+/** One wait for OAuth returns; the server answers within 20 seconds. */
+const returnsTimeout = Duration.seconds(30);
+
+/** The server, its window origin, and the one-use link that pairs the window with it. */
+export interface Connected {
+  readonly service: RunningService;
+  readonly origin: string;
+  readonly pairing: string;
+}
+
+const sameService = (left: RunningService, right: RunningService) =>
+  left.pid === right.pid &&
+  left.url === right.url &&
+  left.version === right.version &&
+  Redacted.value(left.password) === Redacted.value(right.password);
+
+/** Recovery for a failure to start or join the server; undefined for one worth retrying. */
+const recoveryFor = (error: unknown): DesktopRecovery | undefined => {
+  if (Schema.is(ServiceFailed)(error)) {
+    // An Executor this desktop cannot stop uses the data, so it must not be reset away.
+    if (error.reason === "directory-in-use")
+      return { stage: "configuration", reason: "locked", detail: error.message };
+    return error.configuration === undefined
+      ? { stage: "start", detail: error.message }
+      : { stage: "configuration", reason: error.configuration, detail: error.detail };
+  }
+  if (Schema.is(ServiceSettingInvalid)(error)) return { stage: "start", detail: error.message };
+  if (Schema.is(StarterDirectoryFailed)(error))
+    return {
+      stage: "start",
+      detail:
+        "Executor could not create its data directory. Check its permissions and free disk space.",
+    };
+  if (Schema.is(DesktopFailed)(error) && error.stage === "runtime") return { stage: "runtime" };
+  return undefined;
+};
+
+/** Programmatic requests send the server's password as the bearer, and no Origin. */
+const asService = (service: RunningService) => ({
+  baseUrl: service.url,
+  transformClient: (client: HttpClient.HttpClient) =>
+    client.pipe(HttpClient.mapRequest(HttpClientRequest.bearerToken(service.password))),
+});
+
+/** A one-use link that pairs a browser session with `service`. */
+const pair = (service: RunningService) =>
+  Effect.gen(function* () {
+    const client = yield* HttpApiClient.make(LocalAuthApi, asService(service));
+    return yield* client.auth.pair().pipe(Effect.timeout(Duration.seconds(10)));
+  }).pipe(
+    Effect.provide(NodeHttpClient.layerNodeHttp),
+    Effect.mapError(() => new DesktopFailed({ stage: "pairing" })),
+  );
+
+/**
+ * A one-use link that pairs the window with `service`, on `origin`: the window always loads the
+ * loopback origin, even where the server names a proxy.
+ */
+const windowPairing = (service: RunningService, origin: string) =>
+  Effect.map(pair(service), (link) => `${origin}/${new URL(Redacted.value(link.url)).hash}`);
+
+const desktopReturns = (service: RunningService) =>
+  HttpApiClient.make(DesktopReturnApi, asService(service));
+
+export const makeConnection = (options: {
+  readonly directory: string;
+  readonly runtime: ServiceRuntime;
+  /** A connection attempt began; show the startup page. */
+  readonly onStarting: Effect.Effect<void>;
+  /**
+   * The server was stopped on purpose; show that until another server registers, which the
+   * desktop then joins, or `start` runs.
+   */
+  readonly onStopped: Effect.Effect<void>;
+  readonly onReady: (connected: Connected) => Effect.Effect<void>;
+  /** A provider callback the server kept for this desktop. It holds an authorization code. */
+  readonly onReturn: (url: Redacted.Redacted<string>) => Effect.Effect<void>;
+  /** Reconnecting stopped; show the recovery page. */
+  readonly onRecovery: (recovery: DesktopRecovery) => Effect.Effect<void>;
+}) =>
+  Effect.gen(function* () {
+    const scope = yield* Effect.scope;
+    const services = yield* Effect.context<
+      FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+    >();
+    const { directory } = options;
+    const lock = yield* Semaphore.make(1);
+    const following = yield* Ref.make(Option.none<Fiber.Fiber<void>>());
+    const current = yield* Ref.make(Option.none<RunningService>());
+    /** The first connection replaces a server of another version; later ones join any. */
+    const replaced = yield* Ref.make(false);
+
+    /**
+     * Completes once `service` is gone. `stopped`: it says it is stopping, or no server is
+     * registered, as when it was stopped on purpose. `replaced`: another server is registered.
+     * `unanswered`: it is still registered but missed `missedChecks` checks in a row, as when it
+     * crashed or hung; one slow answer does not reload the window.
+     */
+    const lost = (service: RunningService) =>
+      Effect.gen(function* () {
+        let missed = 0;
+        while (missed < missedChecks) {
+          yield* Effect.sleep(checkInterval);
+          const found = yield* registered(directory);
+          if (Option.isSome(found) && sameService(found.value, service)) {
+            // A server asked to stop can take seconds to exit, and is not lost meanwhile.
+            if (found.value.status === "stopping") return "stopped" as const;
+            if (found.value.status === "ready") {
+              missed = 0;
+              continue;
+            }
+          } else {
+            const current = yield* readRegistration(directory);
+            if (Option.isNone(current)) return "stopped" as const;
+            if (
+              !sameService(
+                { ...current.value, password: Redacted.make(current.value.password) },
+                service,
+              )
+            )
+              return "replaced" as const;
+          }
+          missed += 1;
+        }
+        return "unanswered" as const;
+      });
+
+    /** Wait for OAuth returns for as long as the server runs; `lost` decides when it is gone. */
+    const returns = (service: RunningService) =>
+      Effect.gen(function* () {
+        const client = yield* desktopReturns(service);
+        return yield* client.desktopReturns.next().pipe(
+          Effect.timeout(returnsTimeout),
+          Effect.flatMap(({ returns }) =>
+            Effect.forEach(returns, ({ url }) => options.onReturn(url), { discard: true }),
+          ),
+          Effect.catch(() => Effect.sleep(checkInterval)),
+          Effect.forever,
+        );
+      }).pipe(Effect.provide(NodeHttpClient.layerNodeHttp));
+
+    /** Join the registered server, or start one if none runs. */
+    const started = Effect.gen(function* () {
+      yield* options.onStarting;
+      const version = (yield* Ref.getAndSet(replaced, true)) ? "ignore" : "replace";
+      const program = yield* options.runtime.program;
+      yield* Effect.logInfo("Connecting to the background Executor").pipe(
+        Effect.annotateLogs({ version }),
+      );
+      const service = yield* ensureServer(directory, {
+        version,
+        program,
+        onStart: (start) =>
+          Effect.logInfo("Starting the background Executor").pipe(
+            Effect.annotateLogs({ version: start.version, previous: start.previous }),
+          ),
+      });
+      // The server now runs this version, so other staged versions are no longer in use.
+      if (version === "replace")
+        yield* Effect.forkIn(options.runtime.clean(service.version), scope);
+      return service;
+    });
+
+    /**
+     * After a stop on purpose, wait until another server registers and answers ready, as when
+     * `executor` or `executor service restart` starts one, and join it. None is started here.
+     */
+    const rejoined = Effect.gen(function* () {
+      yield* options.onStopped;
+      yield* Effect.logInfo("Waiting for the background Executor to start again");
+      while (true) {
+        yield* Effect.sleep(checkInterval);
+        const found = yield* discover(directory);
+        if (Option.isSome(found)) {
+          yield* options.onStarting;
+          return found.value;
+        }
+      }
+    });
+
+    const connect = <E, R>(join: Effect.Effect<RunningService, E, R>) =>
+      Effect.gen(function* () {
+        const service = yield* join;
+        yield* Effect.logInfo("Background Executor ready").pipe(
+          Effect.annotateLogs({ url: service.url, pid: service.pid, version: service.version }),
+        );
+        const origin = yield* Schema.decodeUnknownEffect(LocalOrigin)(service.url).pipe(
+          Effect.mapError(() => new ServiceFailed({ reason: "unreachable", detail: service.url })),
+        );
+        const pairing = yield* windowPairing(service, origin);
+        yield* Ref.set(current, Option.some(service));
+        yield* options.onReady({ service, origin, pairing });
+        const loss = yield* Effect.raceFirst(lost(service), returns(service)).pipe(
+          Effect.ensuring(Ref.set(current, Option.none())),
+        );
+        yield* Effect.logWarning("Background Executor stopped answering").pipe(
+          Effect.annotateLogs({ url: service.url, pid: service.pid, loss }),
+        );
+        return loss;
+      });
+
+    const follow = Effect.gen(function* () {
+      let losses: ReadonlyArray<number> = [];
+      while (true) {
+        let outcome = yield* connect(started).pipe(Effect.result);
+        // A server stopped on purpose is not started again: the next one that registers is joined.
+        while (Result.isSuccess(outcome) && outcome.success === "stopped")
+          outcome = yield* connect(rejoined).pipe(Effect.result);
+        if (Result.isSuccess(outcome) && outcome.success === "replaced") {
+          yield* Effect.sleep(reconnectDelay);
+          continue;
+        }
+        if (Result.isFailure(outcome)) {
+          const recovery = recoveryFor(outcome.failure);
+          if (recovery !== undefined) {
+            yield* Effect.logError("Background Executor could not start").pipe(
+              Effect.annotateLogs({
+                stage: recovery.stage,
+                ...("reason" in recovery ? { configuration: recovery.reason } : {}),
+                ...("detail" in recovery ? { detail: recovery.detail } : {}),
+              }),
+            );
+            return yield* options.onRecovery(recovery);
+          }
+          yield* Effect.logWarning("Could not pair with the background Executor", outcome.failure);
+        }
+        const now = yield* Clock.currentTimeMillis;
+        losses = [...losses.filter((at) => now - at < Duration.toMillis(lossWindow)), now];
+        if (losses.length >= lossLimit) return yield* options.onRecovery({ stage: "crash-loop" });
+        yield* Effect.sleep(reconnectDelay);
+      }
+    }).pipe(Effect.provideContext(services));
+
+    const halt = Effect.gen(function* () {
+      const fiber = yield* Ref.getAndSet(following, Option.none());
+      if (Option.isSome(fiber)) yield* Fiber.interrupt(fiber.value);
+    });
+    const begin = Effect.gen(function* () {
+      yield* halt;
+      yield* Ref.set(following, Option.some(yield* Effect.forkIn(follow, scope)));
+    });
+
+    return {
+      /** Start or join the server and follow it, first stopping any current attempt or wait. */
+      start: lock.withPermit(begin),
+      /** The server the window uses now, if any. */
+      current: Ref.get(current),
+      /**
+       * A fresh one-use link that pairs the window with the server it uses now, as when the
+       * window could not load the dashboard with the link it was given.
+       */
+      pairWindow: Effect.gen(function* () {
+        const service = yield* Ref.get(current);
+        if (Option.isNone(service)) return yield* new DesktopFailed({ stage: "pairing" });
+        const origin = yield* Schema.decodeUnknownEffect(LocalOrigin)(service.value.url).pipe(
+          Effect.mapError(() => new DesktopFailed({ stage: "pairing" })),
+        );
+        return yield* windowPairing(service.value, origin);
+      }),
+      /**
+       * Stop the background server, run `effect` and start it again. No connection attempt runs in
+       * between, so this desktop never starts a server while `effect` works on its data. While an
+       * Executor from before the background service uses the data, which holds no lock and cannot
+       * be stopped from here, `effect` does not run and this fails with `directory-in-use`.
+       */
+      whileStopped: <A, E, R>(
+        effect: Effect.Effect<A, E, R>,
+      ): Effect.Effect<A, E | ServiceFailed | PlatformError.PlatformError, R> =>
+        lock.withPermit(
+          halt.pipe(
+            Effect.andThen(options.onStarting),
+            Effect.andThen(stop(directory).pipe(Effect.provideContext(services))),
+            Effect.andThen(refuseEarlierServer(directory).pipe(Effect.provideContext(services))),
+            Effect.andThen(effect),
+            Effect.ensuring(begin),
+          ),
+        ),
+      /** Ask the server to keep the callback for `state` for this desktop. */
+      expectReturn: (state: string) =>
+        Effect.gen(function* () {
+          const service = yield* Ref.get(current);
+          if (Option.isNone(service)) return yield* new DesktopFailed({ stage: "oauth" });
+          const client = yield* desktopReturns(service.value);
+          yield* client.desktopReturns
+            .expect({ payload: { state } })
+            .pipe(Effect.timeout(Duration.seconds(5)));
+        }).pipe(
+          Effect.provide(NodeHttpClient.layerNodeHttp),
+          Effect.mapError(() => new DesktopFailed({ stage: "oauth" })),
+        ),
+    };
+  });
+
+export type Connection = Effect.Success<ReturnType<typeof makeConnection>>;
diff --git a/apps/local/desktop/src/implementation/diagnostics.ts b/apps/local/desktop/src/implementation/diagnostics.ts
index a218bbfd3a..d3b31aa9bc 100644
--- a/apps/local/desktop/src/implementation/diagnostics.ts
+++ b/apps/local/desktop/src/implementation/diagnostics.ts
@@ -40,9 +40,9 @@ const stamp = (iso: string) => iso.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
 /** Make the "Export diagnostics…" action. Failures show a native dialog without file contents. */
 export const makeExportDiagnosticsAction = (options: {
   readonly directory: string;
-  /** The running backend's origin, if one is running. */
+  /** The background server's origin, if the window is connected to one. */
   readonly origin: () => string | undefined;
-  readonly source: PortSource;
+  readonly portSource: Effect.Effect<PortSource>;
 }) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -77,7 +77,7 @@ export const makeExportDiagnosticsAction = (options: {
           node: process.versions.node,
         },
         uptimeSeconds: Math.round(process.uptime()),
-        server: { origin: options.origin() ?? null, portSource: options.source.kind },
+        server: { origin: options.origin() ?? null, portSource: (yield* options.portSource).kind },
         dataDirectory: options.directory,
         files: included,
         // Keys stay in the OS credential store or keys.json; they are never part of an export.
diff --git a/apps/local/desktop/src/implementation/migration.ts b/apps/local/desktop/src/implementation/migration.ts
new file mode 100644
index 0000000000..9a60b6c991
--- /dev/null
+++ b/apps/local/desktop/src/implementation/migration.ts
@@ -0,0 +1,1005 @@
+/**
+ * One-off move of the desktop app's own data directory into the data directory the CLI uses, so
+ * the desktop and the CLI share one background Executor. It runs before the desktop starts or
+ * joins the background service.
+ *
+ * Invariants:
+ * - Progress is recorded in `migration.json` beside the legacy directory, written atomically
+ *   before each step that changes files. An interrupted run continues on the next launch; once the
+ *   record says `done`, later launches change no data. The record then only notes when the notice
+ *   naming the CLI data or settings a move set aside has been shown, so a launch that ends first,
+ *   as when it is quit while the data moves, does not lose it.
+ * - Only a legacy directory with a database moves. One without, such as a desktop that failed
+ *   before its first start finished, is recorded as done and the shared directory is left alone.
+ * - Nothing is merged and no user data is deleted. Whole directories are only renamed into the
+ *   backups folder. The things ever removed are this migration's own copy, named in its record
+ *   before it was made, when it is unfinished or rolled back before it was verified; its own lock
+ *   directories; and a shared directory or archive that holds nothing else. The one file written
+ *   into the copy is `service.json`: the CLI's settings with the desktop's port (see
+ *   `sharedSettings`), written again before each attempt to rename the copy into place; the CLI's
+ *   own stays in its archive.
+ * - The copy's root is 0700, as the CLI creates a data directory, and so is the shared directory
+ *   once the copy is in place.
+ * - Keys are never generated, rewritten or stored. `installation.json` is copied byte for byte, so
+ *   the OS credential entry keyed by its installation ID, or the copied `keys.json`, still holds the
+ *   keys for the moved data.
+ * - The copy is complete before anything moves: every entry's relative path, type and size, and the
+ *   bytes of `installation.json` and `keys.json`, match the source, and every file is synced.
+ * - Nothing is copied or moved while a server, its key setup or its telemetry collector uses either
+ *   directory. The shared directory is created first if needed, so it is always locked, and both
+ *   directories' locks are held from before the copy until after the renames. A lock is a
+ *   directory and holds no handle, so the renames work while it is held, also on Windows. Once a
+ *   directory has moved, its locks no longer touch its old path, and the lock directories that
+ *   moved with it are removed from where it went. A lock lost before its directory moved, as to a
+ *   process that took it over, stops the copy at once, and no rename runs without its lock: the
+ *   move fails and rolls back as any failure does.
+ *
+ * No file under a data directory needs rewriting for its new location. Storage, builds, workerd
+ * state and repositories are found relative to the directory at each start; PGlite records only
+ * its own virtual path, `/pglite/data`; the workerd configuration naming absolute paths is passed
+ * to workerd at each start, never saved; the repositories are bare and record no paths.
+ * `diagnostics/collector.json` names the old absolute path until the next server start rewrites
+ * it, and old log lines keep naming it, which is history rather than configuration.
+ */
+import * as nodeFs from "node:fs";
+import { lock, type LockOptions } from "proper-lockfile";
+import {
+  DateTime,
+  Effect,
+  FileSystem,
+  Option,
+  Path,
+  type PlatformError,
+  Predicate,
+  Schedule,
+  Schema,
+  Stream,
+} from "effect";
+import {
+  defaultPort,
+  ServiceFailed,
+  serviceLockFile,
+  serviceRegistrationFile,
+  type ServiceSettings,
+  serviceSettingsFile,
+} from "../../../server/src/contracts/service.ts";
+import { writeAtomically } from "../../../server/src/implementation/atomic-file.ts";
+import { stop } from "../../../server/src/implementation/service-client.ts";
+import {
+  lockDataDirectory,
+  readRegistration,
+  readSettings,
+  writeSettings,
+} from "../../../server/src/implementation/service-files.ts";
+import { whileHeld } from "./runtime.ts";
+
+/** The migration did not finish. `message` says why, and what was and was not changed. */
+export class DesktopMigrationFailed extends Schema.TaggedError<DesktopMigrationFailed>()(
+  "DesktopMigrationFailed",
+  {
+    reason: Schema.Literals([
+      /** A server or another program uses either directory. */
+      "in-use",
+      /** The CLI's background server did not stop. */
+      "stop-failed",
+      /** The copy could not be written. */
+      "copy-failed",
+      /** The copy did not match the desktop data. */
+      "verify-failed",
+      /** The CLI's data is on another volume than the backups folder. */
+      "cross-volume",
+      /** A rename failed for another reason. */
+      "move-failed",
+      /** The migration record could not be read or saved. */
+      "record-failed",
+      /** An unfinished migration was recorded for other directories. */
+      "unfinished",
+      /** The directories contain one another. */
+      "overlapping",
+    ]),
+    message: Schema.String,
+  },
+) {}
+
+const Port = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65535 }));
+
+/**
+ * The CLI's `service.json` settings that the shared directory's no longer has as they were. Its
+ * port follows the desktop's data: `port` is the CLI's, `from`, and the desktop's, `to`, when they
+ * differ. `variables` are the `env` names that belong to the CLI's data, its port and keys, so they
+ * stay only in the archived `service.json`. Names only, since a value may be a key. `removed` are
+ * the settings the move turned off: `disabled`, since the desktop always runs the background
+ * server, which a disabled service's commands would find holding the data. Every other setting is
+ * carried over.
+ */
+const SettingsChanges = Schema.Struct({
+  port: Schema.optionalKey(Schema.Struct({ from: Port, to: Port })),
+  variables: Schema.optionalKey(Schema.Array(Schema.String)),
+  removed: Schema.optionalKey(Schema.Array(Schema.Literal("disabled"))),
+});
+type SettingsChanges = typeof SettingsChanges.Type;
+
+/**
+ * What the migration did. `moved`: the shared directory held no data. `replaced`: it held the
+ * CLI's data, now in `archived`. `backup` is the legacy directory's new place; absent when it had
+ * to stay in place because the backups folder is on another volume. `settings`: what changed of
+ * the CLI's settings, which `archived` keeps as they were.
+ */
+export const DesktopMigration = Schema.Struct({
+  kind: Schema.Literals(["none", "moved", "replaced"]),
+  archived: Schema.optionalKey(Schema.String),
+  backup: Schema.optionalKey(Schema.String),
+  settings: Schema.optionalKey(SettingsChanges),
+});
+export type DesktopMigration = typeof DesktopMigration.Type;
+
+/** `migration.json`. Paths are absolute and chosen once, so a resumed run finds its own work. */
+const MigrationRecord = Schema.Struct({
+  version: Schema.Literal(1),
+  /** `copying`: the copy may be partial. `copied`: it was verified. `done`: nothing is left. */
+  state: Schema.Literals(["copying", "copied", "done"]),
+  legacy: Schema.String,
+  shared: Schema.String,
+  /** This migration's copy, beside the shared directory until it is renamed into place. */
+  temporary: Schema.String,
+  /** Where the legacy directory is renamed to. */
+  backup: Schema.String,
+  /** Each place the shared directory was renamed to, recorded before its rename. */
+  archives: Schema.Array(Schema.String),
+  /** The legacy directory could not be renamed into the backups folder, so it stays in place. */
+  kept: Schema.Boolean,
+  /** The desktop's port, saved in the copy's `service.json`. */
+  port: Schema.optionalKey(Port),
+  /**
+   * How the copy's `service.json` differs from the CLI's, recorded each time it is written, just
+   * before the copy is renamed into place, since the CLI's directory may have moved aside by the
+   * time the move is done.
+   */
+  settings: Schema.optionalKey(SettingsChanges),
+  result: Schema.optionalKey(DesktopMigration),
+  /**
+   * Whether the notice naming where a move put the CLI's data, or its changed settings, has been
+   * shown; `pending` from when the move is done until the desktop has shown it.
+   */
+  notice: Schema.optionalKey(Schema.Literals(["pending", "shown"])),
+});
+type MigrationRecord = typeof MigrationRecord.Type;
+const RecordJson = Schema.fromJsonString(MigrationRecord);
+
+const recordFile = "migration.json";
+/** Key setup's lock, as `bootstrap.ts` takes it with proper-lockfile's defaults. */
+const bootstrapLockFile = ".bootstrap.lock";
+/** Held while copying, by this migration; never copied or compared. */
+const lockEntries = new Set([serviceLockFile, `${serviceLockFile}.takeover`, bootstrapLockFile]);
+
+const Pid = Schema.Int.check(Schema.isGreaterThan(0));
+const RecordedPid = Schema.fromJsonString(Schema.Struct({ pid: Pid }));
+const CollectorStatus = Schema.fromJsonString(
+  Schema.Struct({
+    state: Schema.Literals(["starting", "running", "restarting", "stopped"]),
+    pid: Schema.optional(Pid),
+  }),
+);
+
+/** Whether a Node system error, as a PlatformError's or Effect.try's cause, has one of `codes`. */
+const hasCode = (...codes: [string, ...Array<string>]) =>
+  Schema.is(Schema.Struct({ cause: Schema.Struct({ code: Schema.Literals(codes) }) }));
+
+/** Signal 0 checks that a process exists; EPERM means it exists under another user. */
+const alive = (pid: number) =>
+  Effect.try(() => process.kill(pid, 0)).pipe(
+    Effect.as(true),
+    Effect.catch((error) => Effect.succeed(hasCode("EPERM")(error))),
+  );
+
+const failure = (reason: DesktopMigrationFailed["reason"], message: string) =>
+  new DesktopMigrationFailed({ reason, message });
+
+const inUse = (directory: string) =>
+  failure(
+    "in-use",
+    `Another Executor server is using ${directory}. Quit it (for the CLI, run \`executor service stop\` or stop it in its terminal), then start Executor again.`,
+  );
+
+/** A sortable UTC time and a random suffix, as reset backups are named. */
+const stamp = Effect.gen(function* () {
+  const now = yield* DateTime.now;
+  const random = Array.from(crypto.getRandomValues(new Uint8Array(3)), (byte) =>
+    byte.toString(16).padStart(2, "0"),
+  ).join("");
+  return `${DateTime.formatIso(now)
+    .replace(/[-:]/g, "")
+    .replace(/\.\d+Z$/, "Z")}-${random}`;
+});
+
+/** The names in `directory`; none when it does not exist. */
+const namesIn = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* fs.readDirectory(directory).pipe(
+      Effect.catchIf(
+        (error) => Predicate.isTagged(error.reason, "NotFound"),
+        () => Effect.succeed<Array<string>>([]),
+      ),
+    );
+  });
+
+const isDatabase = (name: string) => name.endsWith(".pglite");
+
+/**
+ * `env` variables that belong to the data they were set for: its port, and how its keys are kept or
+ * supplied. A server would refuse the desktop's data with the CLI's key settings.
+ */
+const dataVariables = new Set([
+  "EXECUTOR_PORT",
+  "EXECUTOR_KEY_STORAGE",
+  "EXECUTOR_API_KEY",
+  "EXECUTOR_ENCRYPTION_KEY",
+]);
+
+/**
+ * The shared directory's settings once the desktop's data is in it: the CLI's, with the desktop's
+ * port, or none for the default, without the `env` variables of the CLI's data, and with the
+ * service on. `changes` says what that changed, if anything.
+ */
+const sharedSettings = (cli: ServiceSettings, port: number | undefined) => {
+  const { port: cliPort, env, disabled, ...others } = cli;
+  const entries = Object.entries(env ?? {});
+  const kept = entries.filter(([name]) => !dataVariables.has(name));
+  const variables = entries.flatMap(([name]) => (dataVariables.has(name) ? [name] : []));
+  const [from, to] = [cliPort ?? defaultPort, port ?? defaultPort];
+  const settings: ServiceSettings = {
+    ...others,
+    ...(kept.length === 0 ? {} : { env: Object.fromEntries(kept) }),
+    ...(port === undefined ? {} : { port }),
+  };
+  const changes: SettingsChanges | undefined =
+    from === to && variables.length === 0 && disabled !== true
+      ? undefined
+      : {
+          ...(from === to ? {} : { port: { from, to } }),
+          ...(variables.length === 0 ? {} : { variables }),
+          ...(disabled === true ? { removed: ["disabled" as const] } : {}),
+        };
+  return { settings, changes };
+};
+
+/** A data directory holds data once it has an installation record or a database. */
+const hasData = (directory: string) =>
+  Effect.map(namesIn(directory), (names) =>
+    names.some((name) => name === "installation.json" || isDatabase(name)),
+  );
+
+type Entry =
+  | { readonly kind: "directory"; readonly path: string; readonly mode: number }
+  | { readonly kind: "file"; readonly path: string; readonly mode: number; readonly size: bigint }
+  | { readonly kind: "link"; readonly path: string; readonly target: string };
+
+/**
+ * Every entry under `root` in a stable order, parents before children, except the root-level
+ * names `skip` excludes. Symbolic links are listed, never followed. Sockets, FIFOs and devices
+ * hold no data and are left out.
+ */
+const listTree = (root: string, skip: (name: string) => boolean) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const entries: Array<Entry> = [];
+    const visit = (relative: string): Effect.Effect<void, PlatformError.PlatformError> =>
+      Effect.gen(function* () {
+        const names = (yield* fs.readDirectory(path.join(root, relative))).toSorted();
+        for (const name of names) {
+          if (relative === "" && skip(name)) continue;
+          const child = relative === "" ? name : path.join(relative, name);
+          const absolute = path.join(root, child);
+          const target = yield* fs.readLink(absolute).pipe(Effect.option);
+          if (Option.isSome(target)) {
+            entries.push({ kind: "link", path: child, target: target.value });
+            continue;
+          }
+          const info = yield* fs.stat(absolute);
+          if (info.type === "Directory") {
+            entries.push({ kind: "directory", path: child, mode: info.mode });
+            yield* visit(child);
+          } else if (info.type === "File")
+            entries.push({ kind: "file", path: child, mode: info.mode, size: info.size });
+        }
+      });
+    yield* visit("");
+    return entries;
+  });
+
+const sameEntries = (left: ReadonlyArray<Entry>, right: ReadonlyArray<Entry>) =>
+  left.length === right.length &&
+  left.every((entry, index) => {
+    const other = right[index];
+    if (other === undefined || other.kind !== entry.kind || other.path !== entry.path) return false;
+    if (entry.kind === "file" && other.kind === "file") return entry.size === other.size;
+    if (entry.kind === "link" && other.kind === "link") return entry.target === other.target;
+    return true;
+  });
+
+/** Both files are missing, or both hold the same bytes. */
+const sameBytes = (left: string, right: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const [hasLeft, hasRight] = [yield* fs.exists(left), yield* fs.exists(right)];
+    if (!hasLeft || !hasRight) return hasLeft === hasRight;
+    const [a, b] = [yield* fs.readFile(left), yield* fs.readFile(right)];
+    return a.length === b.length && a.every((byte, index) => byte === b[index]);
+  });
+
+const syncDirectory = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    yield* Effect.scoped(Effect.flatMap(fs.open(directory), (handle) => handle.sync));
+  });
+
+/** Write a new file with `from`'s bytes and sync it, so a crash never leaves a short copy. */
+const copyFile = (from: string, to: string) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const file = yield* fs.open(to, { flag: "wx", mode: 0o600 });
+      yield* fs
+        .stream(from, { chunkSize: 1024 * 1024 })
+        .pipe(Stream.runForEach((chunk) => file.writeAll(chunk)));
+      yield* file.sync;
+    }),
+  );
+
+/**
+ * Copy `from` to the new directory `to`, leaving out lock directories, with the same modes below
+ * the root. The root is 0700, as the CLI creates a data directory: old desktops created theirs with
+ * the default mode, often 0755, and only the root keeps other users out of what it holds.
+ */
+const copyTree = (platform: string, from: string, to: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const entries = yield* listTree(from, (name) => lockEntries.has(name));
+    yield* fs.makeDirectory(path.dirname(to), { recursive: true, mode: 0o700 });
+    yield* fs.makeDirectory(to, { mode: 0o700 });
+    for (const entry of entries) {
+      const target = path.join(to, entry.path);
+      if (entry.kind === "directory") yield* fs.makeDirectory(target, { mode: 0o700 });
+      else if (entry.kind === "link") yield* fs.symlink(entry.target, target);
+      else yield* copyFile(path.join(from, entry.path), target);
+    }
+    // Deepest first, so a read-only directory is set only once its contents are written.
+    const all: ReadonlyArray<Entry> = [{ kind: "directory", path: "", mode: 0o700 }, ...entries];
+    for (const entry of all.toReversed()) {
+      if (entry.kind === "link") continue;
+      const target = path.join(to, entry.path);
+      yield* fs.chmod(target, entry.mode & 0o777);
+      // Windows does not allow opening directories as ordinary file handles.
+      if (entry.kind === "directory" && platform !== "win32") yield* syncDirectory(target);
+    }
+    if (platform !== "win32") yield* syncDirectory(path.dirname(to));
+  });
+
+/**
+ * Whether `copy` matches `source`: the same entries, file sizes and link targets, and the same
+ * `installation.json` and `keys.json` bytes. `service.json` is left out; the copy's holds the shared settings.
+ */
+const verify = (source: string, copy: string) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const skip = (name: string) => lockEntries.has(name) || name === serviceSettingsFile;
+    const expected = yield* listTree(source, skip);
+    const actual = yield* listTree(copy, skip);
+    if (!sameEntries(expected, actual)) return false;
+    for (const name of ["installation.json", "keys.json"])
+      if (!(yield* sameBytes(path.join(source, name), path.join(copy, name)))) return false;
+    return true;
+  });
+
+/**
+ * The file system proper-lockfile uses for the locks held in one directory. Once `moved` runs, as
+ * that directory has been renamed, releasing those locks removes nothing: their old paths then
+ * belong to the directory renamed into place, which another server may already have locked.
+ */
+const lockFileSystem = () => {
+  let moved = false;
+  return {
+    fs: {
+      ...nodeFs,
+      rmdir: (target: nodeFs.PathLike, done: nodeFs.NoParamCallback) =>
+        moved ? done(null) : nodeFs.rmdir(target, done),
+      rmdirSync: (target: nodeFs.PathLike) => {
+        if (!moved) nodeFs.rmdirSync(target);
+      },
+    },
+    moved: Effect.sync(() => {
+      moved = true;
+    }),
+  };
+};
+
+/** Hold one lock for the current scope; another holder means the directory is in use. */
+const hold = (file: string, options: LockOptions, directory: string) =>
+  Effect.acquireRelease(
+    Effect.tryPromise({
+      // A lock this migration holds may move with its directory; its refresh then fails quietly.
+      try: () => lock(file, { retries: 0, onCompromised: () => {}, ...options }),
+      catch: () => inUse(directory),
+    }),
+    (release) => Effect.promise(() => release().catch(() => undefined)),
+  );
+
+/** A directory's locks, as `holdDirectory` holds them. */
+interface Held {
+  /** Run once the directory has been renamed: its locks then stay where it went. */
+  readonly moved: Effect.Effect<void>;
+  /** Fails unless its server lock is still held, as after another process took it over. */
+  readonly intact: Effect.Effect<void, DesktopMigrationFailed>;
+  /** Fails once its server lock is lost. */
+  readonly lost: Effect.Effect<never, DesktopMigrationFailed>;
+}
+
+/** A directory a resumed run already renamed, so it holds none of its locks. */
+const alreadyMoved: Held = { moved: Effect.void, intact: Effect.void, lost: Effect.never };
+
+/**
+ * Hold `directory`'s server lock and key setup lock for the current scope, as a server takes them,
+ * so no server opens it while it is copied or renamed. The server lock is taken with the servers'
+ * own `lockDataDirectory`, recording this process as its owner, so a lock a crashed or killed
+ * server left is taken over, and a live server's never is, however long ago it was refreshed; the
+ * same rule keeps this one held. Its loss, which only matters until the directory has moved, as
+ * its lock then stays where it went, stops the move.
+ */
+const holdDirectory = (directory: string) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const locks = lockFileSystem();
+    const server = yield* lockDataDirectory(directory, { fs: locks.fs }).pipe(
+      Effect.catchTag("ServiceFailed", () => Effect.fail(inUse(directory))),
+    );
+    yield* hold(
+      directory,
+      { lockfilePath: path.join(directory, bootstrapLockFile), fs: locks.fs },
+      directory,
+    );
+    const lost = failure(
+      "in-use",
+      `Another Executor process took over ${directory} while Executor moved its data, so Executor stopped.`,
+    );
+    return {
+      moved: locks.moved,
+      intact: Effect.flatMap(server.held, (ours) => (ours ? Effect.void : Effect.fail(lost))),
+      lost: server.lost.pipe(Effect.andThen(Effect.fail(lost))),
+    } satisfies Held;
+  });
+
+/** Remove the lock directories this migration held in `directory` before it was renamed. */
+const removeLocks = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    for (const name of lockEntries)
+      yield* fs.remove(path.join(directory, name), { recursive: true, force: true });
+  });
+
+/**
+ * Refuse while a process recorded in `directory` still runs: a server's `server.json`, including
+ * the format servers wrote before the background service, or a telemetry collector, which may
+ * outlive a server that was killed. A collector gets five seconds to stop, as a reset gives it.
+ */
+const noProcessRecorded = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const recordPath = path.join(directory, serviceRegistrationFile);
+    const server = yield* fs
+      .readFileString(recordPath)
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(RecordedPid)), Effect.option);
+    if (Option.isSome(server) && (yield* alive(server.value.pid)))
+      return yield* failure(
+        "in-use",
+        `An Executor server (process ${server.value.pid}) is using ${directory}. Quit it, then start Executor again. If no Executor server is running, remove ${recordPath} and start Executor again.`,
+      );
+    const collector = yield* fs
+      .readFileString(path.join(directory, "diagnostics", "collector.json"))
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(CollectorStatus)), Effect.option);
+    if (Option.isNone(collector) || collector.value.state === "stopped") return;
+    const pid = collector.value.pid;
+    if (pid === undefined) return;
+    const running = yield* alive(pid).pipe(
+      Effect.repeat({
+        while: (running) => running,
+        schedule: Schedule.spaced("100 millis").pipe(Schedule.upTo({ times: 50 })),
+      }),
+    );
+    if (running)
+      return yield* failure(
+        "in-use",
+        `An Executor process (${pid}) is still using ${directory}. Quit Executor everywhere, then start it again.`,
+      );
+  });
+
+/**
+ * Move the desktop's legacy data directory into the shared directory the CLI and the background
+ * service use, once. The desktop's data wins: CLI data already there is renamed into `backups`
+ * as `cli-data-<time>`, and the legacy directory is renamed into `backups` as
+ * `desktop-data-<time>` once its copy is in place. The port follows the desktop's data:
+ * `legacyPort`, the old `desktop.json` port, becomes the shared directory's `service.json` port,
+ * or the default when there is none. The CLI's other settings are carried over, except the `env`
+ * variables of its own data and `disabled`, and the result names what changed.
+ */
+export const migrateDesktopData = (input: {
+  readonly platform: string;
+  readonly legacyDirectory: string;
+  readonly sharedDirectory: string;
+  readonly backups: string;
+  readonly legacyPort: number | undefined;
+  /** Runs once, when there is data to move: stopping, copying and renaming can take a while. */
+  readonly onMoving: Effect.Effect<void>;
+}) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const legacy = path.resolve(input.legacyDirectory);
+    const shared = path.resolve(input.sharedDirectory);
+    const backups = path.resolve(input.backups);
+    const recordDirectory = path.dirname(legacy);
+    const recordPath = path.join(recordDirectory, recordFile);
+    const none: DesktopMigration = { kind: "none" };
+    // The desktop already uses the shared directory.
+    if (legacy === shared) return none;
+    const within = (child: string, parent: string) =>
+      child === parent || child.startsWith(`${parent}${path.sep}`);
+    const pairs = [
+      [legacy, shared],
+      [legacy, backups],
+      [shared, backups],
+    ] as const;
+    if (pairs.some(([a, b]) => within(a, b) || within(b, a)))
+      return yield* failure(
+        "overlapping",
+        `The desktop data directory ${legacy}, the CLI's data directory ${shared} and the backups folder ${backups} must not contain one another. Nothing was changed.`,
+      );
+
+    const saved = yield* Effect.gen(function* () {
+      if (!(yield* fs.exists(recordPath))) return Option.none<MigrationRecord>();
+      const text = yield* fs.readFileString(recordPath);
+      return Option.some(yield* Schema.decodeUnknownEffect(RecordJson)(text));
+    }).pipe(
+      Effect.mapError(() =>
+        failure(
+          "record-failed",
+          `Executor's migration record ${recordPath} is unreadable, so it cannot tell how far moving your desktop data got. Nothing was changed. Your data is in ${legacy}, ${shared} or ${backups}.`,
+        ),
+      ),
+    );
+    if (Option.isSome(saved) && saved.value.state === "done") return none;
+    if (Option.isSome(saved) && (saved.value.legacy !== legacy || saved.value.shared !== shared))
+      return yield* failure(
+        "unfinished",
+        `Executor started moving its desktop data from ${saved.value.legacy} to ${saved.value.shared}, and ${recordPath} records that move as unfinished. Start Executor with those folders again to finish it. Nothing was changed.`,
+      );
+    const legacyNames = Option.isSome(saved)
+      ? []
+      : yield* namesIn(legacy).pipe(
+          Effect.mapError(() =>
+            failure(
+              "copy-failed",
+              `Executor could not read its desktop data in ${legacy}. Check that folder's permissions. Nothing was changed.`,
+            ),
+          ),
+        );
+    if (Option.isNone(saved) && legacyNames.length === 0) return none;
+
+    let record: MigrationRecord = Option.isSome(saved)
+      ? saved.value
+      : yield* Effect.map(stamp, (id) => ({
+          version: 1 as const,
+          state: "copying" as const,
+          legacy,
+          shared,
+          temporary: path.join(path.dirname(shared), `.${path.basename(shared)}-migrating-${id}`),
+          backup: path.join(backups, `desktop-data-${id}`),
+          archives: [],
+          kept: false,
+          ...(input.legacyPort === undefined ? {} : { port: input.legacyPort }),
+        }));
+    const save = (next: MigrationRecord) =>
+      Schema.encodeEffect(RecordJson)(next).pipe(
+        Effect.flatMap((contents) =>
+          writeAtomically(input.platform, recordDirectory, recordPath, contents),
+        ),
+        Effect.mapError(() =>
+          failure(
+            "record-failed",
+            `Executor could not save its migration record in ${recordDirectory}. Check that folder's permissions and free disk space.`,
+          ),
+        ),
+        Effect.tap(() =>
+          Effect.sync(() => {
+            record = next;
+          }),
+        ),
+      );
+    // A desktop that never created its main database, as one whose first start failed, has
+    // nothing to move, and must not replace the CLI's data with its empty installation. Browser
+    // sessions alone, in browser-auth.pglite, are not worth replacing it for.
+    if (Option.isNone(saved) && !legacyNames.includes("executor.pglite")) {
+      yield* save({ ...record, state: "done", result: none });
+      yield* Effect.logInfo("The desktop's old data directory holds no database to move").pipe(
+        Effect.annotateLogs({ legacy }),
+      );
+      return none;
+    }
+    const renameFailed = (from: string) => (error: PlatformError.PlatformError) =>
+      hasCode("EBUSY")(error) || (input.platform === "win32" && hasCode("EPERM", "EACCES")(error))
+        ? failure(
+            "in-use",
+            `A program is using files in ${from}, so Executor could not move it. Close any program using that folder, then start Executor again.`,
+          )
+        : failure(
+            "move-failed",
+            `Executor could not move ${from}. Check that it can write to ${path.dirname(from)} and ${backups}.`,
+          );
+    const copyFailed = failure(
+      "copy-failed",
+      `Executor could not copy your desktop data from ${legacy} to ${shared}. Check that the drive has enough free space and that Executor can write to ${path.dirname(shared)}.`,
+    );
+    const existing = (paths: ReadonlyArray<string>) => Effect.filter(paths, (at) => fs.exists(at));
+    /** The copy is in place: renamed before an interruption recorded it. */
+    const placed = (source: string) =>
+      Effect.gen(function* () {
+        if ((yield* fs.exists(record.temporary)) || !(yield* fs.exists(shared))) return false;
+        if (yield* fs.exists(path.join(source, "installation.json")))
+          return yield* sameBytes(
+            path.join(source, "installation.json"),
+            path.join(shared, "installation.json"),
+          );
+        return yield* verify(source, shared);
+      });
+
+    /** Copy the desktop data beside the shared directory and verify it, unless that is done. */
+    const prepare = Effect.gen(function* () {
+      const source = (yield* fs.exists(legacy)) ? legacy : record.backup;
+      // A copy recorded as verified is checked again: its source may have changed since.
+      if (record.state === "copied") {
+        if (yield* fs.exists(record.temporary)) {
+          if (yield* verify(source, record.temporary)) return;
+        } else if (yield* placed(source)) return;
+      }
+      // Renaming the shared directory, which holds its locks, into the backups folder must not
+      // fail after a long copy.
+      yield* fs.makeDirectory(backups, { recursive: true, mode: 0o700 });
+      if ((yield* fs.stat(shared)).dev !== (yield* fs.stat(backups)).dev)
+        return yield* failure(
+          "cross-volume",
+          `The CLI's data directory ${shared} is on another drive than the backups folder ${backups}, so Executor cannot move it aside. Move or rename ${shared} yourself, then start Executor again.`,
+        );
+      yield* save({ ...record, state: "copying" });
+      // Only this migration's own unfinished copy, named in its record, is ever removed.
+      yield* fs.remove(record.temporary, { recursive: true, force: true });
+      yield* copyTree(input.platform, source, record.temporary);
+      if (!(yield* verify(source, record.temporary)))
+        return yield* failure(
+          "verify-failed",
+          `Your desktop data in ${source} changed while Executor copied it, or the copy is incomplete. Quit any program using files in it, then start Executor again.`,
+        );
+      yield* save({ ...record, state: "copied" });
+    }).pipe(Effect.catchTag("PlatformError", () => Effect.fail(copyFailed)));
+
+    /**
+     * Write the shared settings into the copy and record what they changed, before each attempt
+     * to rename it into place, from the CLI's settings as they are then: where its directory is
+     * now, in place or in the archive an interrupted swap already renamed it to. A copy an earlier
+     * launch kept may be older than settings the CLI saved since. Its `service.json` is never
+     * verified, so the copy stays verified.
+     */
+    const configure = Effect.gen(function* () {
+      if (!(yield* fs.exists(record.temporary))) return;
+      const { settings, changes } = sharedSettings(
+        yield* readSettings((yield* existing(record.archives))[0] ?? shared),
+        record.port,
+      );
+      yield* writeSettings(input.platform, record.temporary, settings);
+      const { settings: _previous, ...rest } = record;
+      yield* save({ ...rest, ...(changes === undefined ? {} : { settings: changes }) });
+    }).pipe(
+      Effect.catchTags({
+        PlatformError: () => Effect.fail(copyFailed),
+        SchemaError: () => Effect.fail(copyFailed),
+        ServiceSettingInvalid: (error) => Effect.fail(failure("copy-failed", error.message)),
+      }),
+    );
+
+    /**
+     * Rename the legacy directory into the backups folder, while its locks are still held; on
+     * another volume it stays. `held.moved` leaves those locks where it went.
+     */
+    const backUp = (held: Held) =>
+      Effect.gen(function* () {
+        if (record.kept || !(yield* fs.exists(legacy))) return;
+        yield* fs.makeDirectory(backups, { recursive: true, mode: 0o700 });
+        yield* held.intact;
+        yield* whileHeld(fs.rename(legacy, record.backup)).pipe(
+          Effect.andThen(held.moved),
+          // The copy is verified, so the move succeeds without the legacy directory's backup.
+          Effect.catchIf(hasCode("EXDEV"), () => save({ ...record, kept: true })),
+          Effect.catchTag("PlatformError", (error) => Effect.fail(renameFailed(legacy)(error))),
+        );
+      }).pipe(
+        Effect.catchTag("PlatformError", (error) => Effect.fail(renameFailed(legacy)(error))),
+      );
+
+    /**
+     * Move the shared directory, with what it holds and its locks, while they are still held, into
+     * the backups folder and put the copy there. `held.moved` leaves those locks where it went.
+     */
+    const swap = (held: Held) =>
+      Effect.gen(function* () {
+        if (!(yield* fs.exists(record.temporary))) return;
+        if (yield* fs.exists(shared)) {
+          const archive = path.join(backups, `cli-data-${yield* stamp}`);
+          yield* held.intact;
+          yield* save({ ...record, archives: [...record.archives, archive] });
+          yield* whileHeld(fs.rename(shared, archive)).pipe(
+            Effect.andThen(held.moved),
+            Effect.catchIf(hasCode("EXDEV"), () =>
+              Effect.fail(
+                failure(
+                  "cross-volume",
+                  `The CLI's data directory ${shared} is on another drive than the backups folder ${backups}, so Executor cannot move it aside. Move or rename ${shared} yourself, then start Executor again.`,
+                ),
+              ),
+            ),
+            Effect.catchTag("PlatformError", (error) => Effect.fail(renameFailed(shared)(error))),
+          );
+        }
+        yield* whileHeld(fs.rename(record.temporary, shared)).pipe(
+          Effect.catchIf(hasCode("ENOTEMPTY", "EEXIST"), () => Effect.fail(inUse(shared))),
+          Effect.catchTag("PlatformError", (error) =>
+            Effect.fail(renameFailed(record.temporary)(error)),
+          ),
+        );
+      }).pipe(
+        Effect.catchTag("PlatformError", (error) => Effect.fail(renameFailed(shared)(error))),
+      );
+
+    /**
+     * Remove the lock directories that moved into the backups folder, and each archive that held
+     * nothing else, as when the shared directory was created only to be locked.
+     */
+    const tidy = Effect.gen(function* () {
+      for (const archive of yield* existing(record.archives)) {
+        yield* removeLocks(archive);
+        if ((yield* namesIn(archive)).length === 0)
+          yield* Effect.tryPromise(() => nodeFs.promises.rmdir(archive));
+      }
+      if (!record.kept && (yield* fs.exists(record.backup))) yield* removeLocks(record.backup);
+    }).pipe(
+      Effect.catchCause((cause) =>
+        Effect.logWarning("Could not remove the migration's locks from the backups", cause),
+      ),
+    );
+
+    /**
+     * Undo this migration's renames, newest first, and remove its copy and record, but only when
+     * that restores the start and the copy was not verified: otherwise the record stays and the
+     * next launch continues, from a verified copy without copying again. Its locks, released by
+     * now, are removed from a directory before it moves back.
+     */
+    const rollback = Effect.gen(function* () {
+      for (const archive of record.archives.toReversed())
+        if ((yield* fs.exists(archive)) && !(yield* fs.exists(shared))) {
+          yield* removeLocks(archive);
+          yield* whileHeld(fs.rename(archive, shared));
+        }
+      if (!record.kept && !(yield* fs.exists(legacy)) && (yield* fs.exists(record.backup))) {
+        yield* removeLocks(record.backup);
+        yield* whileHeld(fs.rename(record.backup, legacy));
+      }
+      if ((yield* existing(record.archives)).length > 0 || !(yield* fs.exists(legacy))) return;
+      // A rename can fail for longer than the retries, as while a scanner reads the new copy.
+      if (record.state === "copied") return;
+      yield* fs.remove(record.temporary, { recursive: true, force: true });
+      yield* fs.remove(recordPath, { force: true });
+    }).pipe(Effect.ignore);
+
+    /** Where the data is now, for a failure's message. */
+    const whereabouts = (stopped: boolean) =>
+      Effect.gen(function* () {
+        const service = stopped
+          ? " Executor stopped the CLI's background server; the next `executor` command starts it again."
+          : "";
+        if (!(yield* fs.exists(recordPath)))
+          return `Nothing was changed. Your desktop data is still in ${legacy}${(yield* hasData(shared)) ? `, and the CLI's data in ${shared}` : ""}.${service}`;
+        const desktop = (yield* fs.exists(legacy))
+          ? legacy
+          : (yield* fs.exists(record.backup))
+            ? record.backup
+            : record.temporary;
+        const archives = yield* existing(record.archives);
+        return (
+          [
+            "Nothing was deleted, and Executor continues moving your data the next time it starts.",
+            `Your desktop data is in ${desktop}.`,
+            ...(archives.length === 0
+              ? []
+              : [`The CLI's previous data is in ${archives.join(" and ")}.`]),
+          ].join(" ") + service
+        );
+      }).pipe(Effect.orElseSucceed(() => ""));
+
+    // Rollback applies once this run has started changing files, until the copy is in place.
+    let undo = false;
+    /** This run created the shared directory, so a failure leaves none if it still holds nothing. */
+    let created = false;
+    const registered = yield* readRegistration(shared);
+    return yield* Effect.gen(function* () {
+      yield* input.onMoving;
+      yield* stop(shared).pipe(
+        Effect.mapError((error) =>
+          failure(
+            "stop-failed",
+            `${Schema.is(ServiceFailed)(error) ? error.message : `The CLI's background Executor for ${shared} did not stop.`} Stop it with \`executor service stop\`, then start Executor again.`,
+          ),
+        ),
+      );
+      // The locks are held until the renames are done, and released before anything is tidied.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          // A resumed run may already have renamed the legacy directory.
+          const legacyHeld = (yield* fs.exists(legacy))
+            ? yield* noProcessRecorded(legacy).pipe(Effect.andThen(holdDirectory(legacy)))
+            : alreadyMoved;
+          // A server can start in a directory that does not exist yet, so the shared directory is
+          // created to be locked.
+          yield* fs.makeDirectory(path.dirname(shared), { recursive: true, mode: 0o700 });
+          created = yield* fs.makeDirectory(shared, { mode: 0o700 }).pipe(
+            Effect.as(true),
+            Effect.catchIf(
+              (error) => Predicate.isTagged(error.reason, "AlreadyExists"),
+              () => Effect.succeed(false),
+            ),
+          );
+          yield* noProcessRecorded(shared);
+          const sharedHeld = yield* holdDirectory(shared);
+          undo = true;
+          // The copy stops once either lock is lost; each rename checks its own lock first.
+          yield* Effect.raceFirst(prepare, Effect.raceFirst(legacyHeld.lost, sharedHeld.lost));
+          yield* backUp(legacyHeld);
+          yield* configure;
+          yield* swap(sharedHeld);
+          undo = false;
+        }),
+      ).pipe(Effect.catchTag("PlatformError", () => Effect.fail(copyFailed)));
+      yield* tidy;
+      // Private, as the CLI creates it, whatever the desktop's mode was. This also covers a copy
+      // an earlier launch swapped into place.
+      yield* fs.chmod(shared, 0o700);
+      const archives = yield* existing(record.archives);
+      const holding = yield* Effect.filter(archives, hasData);
+      const archived = holding[0] ?? archives[0];
+      const result: DesktopMigration = {
+        kind: holding.length > 0 ? "replaced" : "moved",
+        ...(archived === undefined ? {} : { archived }),
+        ...(record.kept ? {} : { backup: record.backup }),
+        // Settings change only for a CLI that left something behind; otherwise it had none.
+        ...(archived === undefined || record.settings === undefined
+          ? {}
+          : { settings: record.settings }),
+      };
+      yield* save({
+        ...record,
+        state: "done",
+        result,
+        ...(result.kind === "replaced" || result.settings !== undefined
+          ? { notice: "pending" as const }
+          : {}),
+      });
+      yield* Effect.logInfo("Moved desktop data to the shared data directory").pipe(
+        Effect.annotateLogs({ shared, ...result }),
+      );
+      return result;
+    }).pipe(
+      Effect.catchTag("PlatformError", () =>
+        Effect.fail(
+          failure(
+            "record-failed",
+            `Executor moved your desktop data to ${shared} but could not check the result.`,
+          ),
+        ),
+      ),
+      Effect.catchTag("DesktopMigrationFailed", (error) =>
+        Effect.gen(function* () {
+          if (undo) yield* rollback;
+          // rmdir refuses a directory that holds anything, such as a server's lock.
+          if (created)
+            yield* Effect.tryPromise(() => nodeFs.promises.rmdir(shared)).pipe(Effect.ignore);
+          return yield* failure(
+            error.reason,
+            `${error.message} ${yield* whereabouts(Option.isSome(registered))}`,
+          );
+        }),
+      ),
+    );
+  });
+
+/** The migration record that `legacyDirectory`'s migration keeps beside it, if any. */
+const readRecord = (legacyDirectory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const recordPath = path.join(path.dirname(path.resolve(legacyDirectory)), recordFile);
+    if (!(yield* fs.exists(recordPath))) return Option.none<MigrationRecord>();
+    return Option.some(
+      yield* fs
+        .readFileString(recordPath)
+        .pipe(Effect.flatMap(Schema.decodeUnknownEffect(RecordJson))),
+    );
+  });
+
+/** The notice a move leaves for the desktop: where the CLI's data or settings went, and its text. */
+export interface MoveNotice {
+  readonly archived: string;
+  readonly detail: string;
+}
+
+/** The notice's text: where the CLI's data or settings went, and which of its settings changed. */
+const noticeDetail = (archived: string, result: DesktopMigration) => {
+  const { port, variables = [], removed = [] } = result.settings ?? {};
+  return [
+    result.kind === "replaced"
+      ? `The CLI's previous data was moved aside, not deleted. It is here:\n\n${archived}`
+      : `The CLI's previous settings were moved aside, not deleted. They are here:\n\n${archived}`,
+    ...(port === undefined
+      ? []
+      : [
+          `The background Executor now uses port ${port.to}, as the desktop did, instead of the CLI's port ${port.from}. Update MCP clients that use port ${port.from}, or change the port with File → Server port….`,
+        ]),
+    ...(variables.length === 0
+      ? []
+      : [
+          `These CLI env settings belonged to its previous data, so they stayed with it: ${variables.join(", ")}.`,
+        ]),
+    ...(removed.includes("disabled")
+      ? [
+          "The CLI's disabled setting was removed: the desktop runs the background Executor, so `executor` and `executor apps` use it too.",
+        ]
+      : []),
+  ].join("\n\n");
+};
+
+/**
+ * Where a finished migration moved the CLI's data or changed settings aside, and the notice's text,
+ * while that notice has not been shown. A launch that ends before showing it, as one quit while
+ * the data moves, leaves it for the next launch.
+ */
+export const pendingNotice = (legacyDirectory: string) =>
+  readRecord(legacyDirectory).pipe(
+    Effect.map(
+      Option.flatMap((record): Option.Option<MoveNotice> =>
+        record.state === "done" &&
+        record.notice === "pending" &&
+        record.result?.archived !== undefined
+          ? Option.some({
+              archived: record.result.archived,
+              detail: noticeDetail(record.result.archived, record.result),
+            })
+          : Option.none(),
+      ),
+    ),
+  );
+
+/** Record that the notice naming the CLI data a migration moved aside has been shown. */
+export const noticeShown = (platform: string, legacyDirectory: string) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const recordDirectory = path.dirname(path.resolve(legacyDirectory));
+    const record = yield* readRecord(legacyDirectory);
+    if (Option.isNone(record) || record.value.notice !== "pending") return;
+    const contents = yield* Schema.encodeEffect(RecordJson)({ ...record.value, notice: "shown" });
+    yield* writeAtomically(
+      platform,
+      recordDirectory,
+      path.join(recordDirectory, recordFile),
+      contents,
+    );
+  });
diff --git a/apps/local/desktop/src/implementation/recovery.ts b/apps/local/desktop/src/implementation/recovery.ts
index 41abc6fe13..792a9f5733 100644
--- a/apps/local/desktop/src/implementation/recovery.ts
+++ b/apps/local/desktop/src/implementation/recovery.ts
@@ -1,5 +1,5 @@
 /**
- * Isolated, script-free recovery document shown when the local server cannot run. Its buttons are
+ * Isolated, script-free recovery document shown when the background server cannot run. Its buttons are
  * links to `executor-recovery:<action>`, which the main process intercepts in `will-navigate`;
  * the window keeps no preload or IPC bridge.
  */
@@ -24,23 +24,44 @@ const page = (recovery: DesktopRecovery): Page => {
       return {
         title: "Executor could not start its local server",
         detail:
-          "The server program could not be launched. Restart to try again. If this continues, reinstall Executor.",
-        actions: ["restart", "logs", "quit"],
+          "Restart to try again. If another program uses Executor's port, choose another with File → Server port… first. If Executor's data is damaged, reset it. Reset keeps a backup.",
+        actions: ["restart", "logs", "reset", "quit"],
       };
-    case "ready":
+    case "runtime":
       return {
-        title: "Executor's local server did not finish starting",
+        title: "Executor could not prepare its local server",
         detail:
-          "It did not report that it was ready. Restart to try again, or reset Executor's data if it is damaged. Reset keeps a backup.",
-        actions: ["restart", "logs", "reset", "quit"],
+          "Its server program could not be copied out of the app. Check free disk space, then restart. If this continues, reinstall Executor.",
+        actions: ["restart", "logs", "quit"],
       };
     case "crash-loop":
       return {
         title: "Executor keeps stopping",
         detail:
-          "Its local server stopped three times within a minute. Restart to try again, or reset Executor's data if it is damaged. Reset keeps a backup.",
+          "Its local server stopped unexpectedly three times within a minute. Restart to try again, or reset Executor's data if it is damaged. Reset keeps a backup.",
         actions: ["restart", "logs", "reset", "quit"],
       };
+    case "stopped":
+      return {
+        title: "The background Executor was stopped",
+        detail:
+          "It was stopped on purpose, for example by executor service stop in a terminal, so Executor does not start it again by itself. It reconnects as soon as the background Executor runs again, or you can start it now.",
+        actions: ["start", "quit"],
+      };
+    case "dashboard":
+      return {
+        title: "Executor could not load its dashboard",
+        detail:
+          "Its local server is running, but this window could not load the dashboard from it. Restart to try again. Your data has not been changed.",
+        actions: ["restart", "logs", "quit"],
+      };
+    case "migration":
+      return {
+        title: "Executor could not move its data",
+        detail:
+          "Executor now keeps its data with the Executor CLI's, and moving it there failed. Nothing was deleted. Fix what the message below describes, then restart.",
+        actions: ["restart", "quit"],
+      };
     case "configuration":
       switch (recovery.reason) {
         case "credential-unavailable":
@@ -81,7 +102,8 @@ const page = (recovery: DesktopRecovery): Page => {
         case "locked":
           return {
             title: "Executor's data is in use",
-            detail: "Another Executor process is using this data directory. Quit it, then restart.",
+            detail:
+              "Another Executor process that is not its background server is using this data directory. Quit it, then restart.",
             actions: ["restart", "logs", "quit"],
           };
         case "io":
@@ -96,6 +118,7 @@ const page = (recovery: DesktopRecovery): Page => {
 };
 
 const labels: Record<RecoveryAction, string> = {
+  start: "Start",
   restart: "Restart",
   logs: "Show logs",
   reset: "Reset data…",
@@ -104,8 +127,21 @@ const labels: Record<RecoveryAction, string> = {
 
 export const recoveryActions = (recovery: DesktopRecovery) => page(recovery).actions;
 
+const escape = (value: string) =>
+  value.replace(
+    /[&<>"']/g,
+    (character) =>
+      ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[character] ??
+      character,
+  );
+
+/** What the server or the migration said, at most this many characters from its end. */
+const messageLimit = 2000;
+
 export const recoveryUrl = (recovery: DesktopRecovery) => {
   const { title, detail, actions } = page(recovery);
+  const said = "detail" in recovery ? recovery.detail.trim().slice(-messageLimit) : "";
+  const message = said === "" ? "" : `<pre>${escape(said)}</pre>`;
   const buttons = actions
     .map(
       (action, index) =>
@@ -124,6 +160,9 @@ export const recoveryUrl = (recovery: DesktopRecovery) => {
   main { max-width: 440px; text-align: center; padding: 32px; }
   h1 { font-size: 22px; font-weight: 600; letter-spacing: -0.5px; margin: 0 0 10px; }
   p { font-size: 14px; line-height: 1.5; margin: 0 0 24px; opacity: 0.65; }
+  pre { font-size: 12px; line-height: 1.45; text-align: left; white-space: pre-wrap; overflow-wrap: anywhere;
+        max-height: 180px; overflow: auto; margin: -8px 0 24px; padding: 10px 12px; border-radius: 6px;
+        background: color-mix(in srgb, CanvasText 6%, transparent); }
   nav { display: flex; flex-wrap: wrap; gap: 8px; justify-content: center; }
   a { font-size: 13px; font-weight: 500; padding: 7px 14px; border-radius: 6px; text-decoration: none;
       color: CanvasText; border: 1px solid color-mix(in srgb, CanvasText 20%, transparent); }
@@ -131,7 +170,7 @@ export const recoveryUrl = (recovery: DesktopRecovery) => {
   a.primary { background: CanvasText; color: Canvas; border-color: CanvasText; }
   a.primary:hover { opacity: 0.85; }
 </style>
-<main role="alert"><h1>${title}</h1><p>${detail}</p><nav>${buttons}</nav></main>
+<main role="alert"><h1>${title}</h1><p>${detail}</p>${message}<nav>${buttons}</nav></main>
 </html>`)}`;
 };
 
diff --git a/apps/local/desktop/src/implementation/reset.ts b/apps/local/desktop/src/implementation/reset.ts
index 4f2d5e26bd..95c37afdea 100644
--- a/apps/local/desktop/src/implementation/reset.ts
+++ b/apps/local/desktop/src/implementation/reset.ts
@@ -17,8 +17,11 @@ import {
   Semaphore,
 } from "effect";
 import { LocalCredentialService, LocalInstallation } from "@executor-js/local-server/auth";
+import { ServiceFailed, serviceLockFile } from "../../../server/src/contracts/service.ts";
+import { lockDataDirectory } from "../../../server/src/implementation/service-files.ts";
 import { BackupManifest, ResetFailed } from "../contracts/desktop.ts";
-import type { Supervisor } from "./supervisor.ts";
+import type { Connection } from "./connection.ts";
+import { whileHeld } from "./runtime.ts";
 
 const Collector = Schema.Struct({
   state: Schema.Literals(["starting", "running", "restarting", "stopped"]),
@@ -35,9 +38,8 @@ const running = (pid: number) => {
 };
 
 /**
- * The backend's telemetry collector shares its process group, which the supervisor signals once
- * the backend has exited. Wait for it so its database handle does not follow the rename, or on
- * Windows block it.
+ * The background server stops its telemetry collector before it exits. Wait for the collector too,
+ * so its database handle does not follow the rename, or on Windows block it.
  */
 const collectorStopped = (directory: string) =>
   Effect.gen(function* () {
@@ -66,8 +68,8 @@ const stamp = (now: DateTime.Utc) =>
   ).join("")}`;
 
 /**
- * Move `directory` to `backups/data-<stamp>-<random>` and describe it in a manifest. The backend
- * must already be stopped. Any failure before the rename leaves the data in place.
+ * Move `directory` to `backups/data-<stamp>-<random>` and describe it in a manifest. The background
+ * server must already be stopped. Any failure before the rename leaves the data in place.
  */
 export const backupData = (options: {
   readonly directory: string;
@@ -87,18 +89,42 @@ export const backupData = (options: {
     yield* fs
       .makeDirectory(backups, { recursive: true, mode: 0o700 })
       .pipe(Effect.mapError(() => new ResetFailed({ stage: "move" })));
-    // The bootstrap lock proves no other Executor process is setting up this directory.
-    const lockfilePath = path.join(directory, ".bootstrap.lock");
-    const release = yield* Effect.tryPromise({
-      // The lock moves with the directory, so its refresh timer must not throw afterward.
-      try: () => lock(directory, { retries: 0, lockfilePath, onCompromised: () => {} }),
-      catch: () => new ResetFailed({ stage: "lock" }),
-    });
-    yield* options.whileMoving(fs.rename(directory, backup)).pipe(
-      Effect.mapError(() => new ResetFailed({ stage: "move" })),
-      Effect.ensuring(Effect.promise(() => release().catch(() => undefined))),
+    // The server lock proves no server holds this directory, and keeps another client from starting
+    // one while it moves. It is taken by the rule servers use, so a lock a crashed or killed server
+    // left is taken over, and records this process as its owner, so servers treat it as held while
+    // this process runs. The bootstrap lock proves no other process is setting up its keys. Both
+    // locks move with the directory, so their refresh timers must not throw afterward.
+    // proper-lockfile keeps one lock per key in a process, so each lock has its own key, as the
+    // server's own locks do.
+    const take = (key: string, lockfilePath: string, stale: number) =>
+      Effect.acquireRelease(
+        Effect.tryPromise({
+          try: () =>
+            lock(key, {
+              realpath: false,
+              lockfilePath,
+              retries: 0,
+              stale,
+              onCompromised: () => {},
+            }),
+          catch: () => new ResetFailed({ stage: "lock" }),
+        }),
+        (release) => Effect.promise(() => release().catch(() => undefined)),
+      );
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        yield* lockDataDirectory(directory).pipe(
+          Effect.mapError(() => new ResetFailed({ stage: "lock" })),
+        );
+        yield* take(directory, path.join(directory, ".bootstrap.lock"), 10_000);
+        // A server that was just stopped or killed can keep files in it open for a moment.
+        yield* options
+          .whileMoving(whileHeld(fs.rename(directory, backup)))
+          .pipe(Effect.mapError(() => new ResetFailed({ stage: "move" })));
+      }),
     );
-    yield* fs.remove(path.join(backup, ".bootstrap.lock"), { recursive: true }).pipe(Effect.ignore);
+    for (const held of [serviceLockFile, ".bootstrap.lock"])
+      yield* fs.remove(path.join(backup, held), { recursive: true }).pipe(Effect.ignore);
     yield* Effect.logInfo("Moved Executor data to a backup").pipe(Effect.annotateLogs({ backup }));
 
     // The data is safe from here. A manifest or sync failure is logged but does not undo the move.
@@ -158,14 +184,14 @@ export const backupData = (options: {
   });
 
 const failureDetail: Record<(typeof ResetFailed.Type)["stage"], string> = {
-  stop: "Executor's local server or its telemetry collector did not stop in time.",
+  stop: "Executor's background server or its telemetry collector did not stop in time.",
   lock: "Another Executor process is using the data directory. Quit it and try again.",
   move: "The data directory could not be moved. Close any program using files in it and try again.",
 };
 
-/** Confirm, stop the backend, back up the data, restart and announce the backup. Serialized. */
+/** Confirm, stop the server, back up the data, start it again and announce the backup. Serialized. */
 export const makeResetAction = (options: {
-  readonly supervisor: Supervisor;
+  readonly connection: Connection;
   readonly directory: string;
   readonly backups: string;
   readonly appVersion: string;
@@ -187,22 +213,34 @@ export const makeResetAction = (options: {
         type: "warning",
         title: "Reset Executor data?",
         message: "Start over with fresh Executor data?",
-        detail: `Executor will stop, move all of its data to a backup folder and start again without your apps, accounts or connections. Nothing is deleted. Backups are kept in:\n\n${options.backups}\n\nSaved keys, in the OS credential store or keys.json, are kept for the backup.`,
+        detail: `Executor will stop its background server, move all of its data to a backup folder and start again without your apps, accounts or connections. The Executor CLI uses the same data. Nothing is deleted. Backups are kept in:\n\n${options.backups}\n\nSaved keys, in the OS credential store or keys.json, are kept for the backup.`,
         buttons: ["Reset and back up", "Cancel"],
         defaultId: 1,
         cancelId: 1,
       });
       if (response !== 0) return;
       yield* Effect.logInfo("Resetting Executor data");
-      const result = yield* options.supervisor.whileStopped(
-        backupData({
-          directory: options.directory,
-          backups: options.backups,
-          appVersion: options.appVersion,
-          platform: process.platform,
-          whileMoving: options.whileMoving,
-        }).pipe(Effect.provideContext(services), Effect.result),
-      );
+      const result = yield* options.connection
+        .whileStopped(
+          backupData({
+            directory: options.directory,
+            backups: options.backups,
+            appVersion: options.appVersion,
+            platform: process.platform,
+            whileMoving: options.whileMoving,
+          }).pipe(Effect.provideContext(services)),
+        )
+        .pipe(
+          Effect.mapError((error) =>
+            Schema.is(ResetFailed)(error)
+              ? error
+              : // A process the desktop cannot stop, such as an earlier Executor, uses the data.
+                Schema.is(ServiceFailed)(error) && error.reason === "directory-in-use"
+                ? new ResetFailed({ stage: "lock" })
+                : new ResetFailed({ stage: "stop" }),
+          ),
+          Effect.result,
+        );
       if (Result.isFailure(result)) {
         yield* Effect.logError("Executor data reset failed", result.failure);
         yield* messageBox({
diff --git a/apps/local/desktop/src/implementation/rotation.ts b/apps/local/desktop/src/implementation/rotation.ts
index 5c1e30a7f1..879da71dee 100644
--- a/apps/local/desktop/src/implementation/rotation.ts
+++ b/apps/local/desktop/src/implementation/rotation.ts
@@ -1,66 +1,73 @@
-/** Local API key rotation. The backend owns key storage, so rotation runs its entry after it stops. */
+/**
+ * Local API key rotation. The CLI owns key storage, so the desktop runs `executor rotate-key` while
+ * the background server is stopped, then starts it again with the new key.
+ */
 import { dialog } from "electron";
-import { Effect, Schema, Semaphore, Stream } from "effect";
+import { Effect, Semaphore, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { RotationResult } from "../contracts/desktop.ts";
+
+/** How much of a failed rotation's message is shown. */
+const messageLimit = 2000;
 
 const show = (options: Electron.MessageBoxOptions) =>
   Effect.promise(() => dialog.showMessageBox(options));
 
 /**
- * Rotate with the backend entry once no server holds the data directory. The result is one
- * stdout line; its message is the server's sanitized configuration text and never a key.
+ * Run `rotate-key` with the CLI `command`, in its environment `env`, on `directory`. Its stderr
+ * holds the CLI's sanitized message when it fails, and never a key.
  */
-export const rotateAfterStop = (options: {
-  readonly executable: string;
-  readonly entry: string;
-  readonly cwd: string;
+export const rotateKey = (options: {
+  readonly command: ReadonlyArray<string>;
+  readonly env: Readonly<Record<string, string | undefined>>;
   readonly directory: string;
 }) =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    const result = yield* Effect.scoped(
+    const [executable = "", ...args] = options.command;
+    return yield* Effect.scoped(
       Effect.gen(function* () {
         const child = yield* spawner.spawn(
-          ChildProcess.make(options.executable, [options.entry, "--rotate-api-key"], {
-            cwd: options.cwd,
-            env: { ELECTRON_RUN_AS_NODE: "1", EXECUTOR_DATA_DIR: options.directory },
-            extendEnv: true,
+          ChildProcess.make(executable, [...args, "rotate-key"], {
+            env: { ...options.env, EXECUTOR_DATA_DIR: options.directory },
+            extendEnv: false,
             stdin: "ignore",
-            stdout: "pipe",
-            stderr: "ignore",
+            stdout: "ignore",
+            stderr: "pipe",
           }),
         );
-        const output = yield* child.stdout.pipe(Stream.decodeText, Stream.mkString);
-        yield* child.exitCode;
-        const line = output.trim().split("\n").at(-1) ?? "";
-        return yield* Schema.decodeUnknownEffect(Schema.fromJsonString(RotationResult))(line);
+        const [message, code] = yield* Effect.all(
+          [child.stderr.pipe(Stream.decodeText, Stream.mkString), child.exitCode],
+          { concurrency: 2 },
+        );
+        return { rotated: code === 0, message: message.trim().slice(-messageLimit) };
       }),
-    ).pipe(
-      Effect.tapCause((cause) => Effect.logError("Desktop key rotation did not finish", cause)),
-      Effect.catch(() =>
-        Effect.succeed(
-          RotationResult.make({
-            version: 1,
-            rotated: false,
-            message: "Executor could not run the key rotation. The API key was not changed.",
-          }),
-        ),
-      ),
-    );
-    yield* show(
-      result.rotated
-        ? {
-            type: "info",
-            message: "The local API key was rotated.",
-            detail:
-              "Executor restarts now. Update scripts and clients that used the previous key. Browser sessions and MCP sign-ins are kept.",
-          }
-        : { type: "error", message: "The local API key was not rotated.", detail: result.message },
     );
-  });
+  }).pipe(
+    Effect.tapCause((cause) => Effect.logError("Desktop key rotation did not finish", cause)),
+    Effect.catch(() => Effect.succeed({ rotated: false, message: "" })),
+  );
+
+/** Tell the person how the rotation went. */
+export const announceRotation = (result: { readonly rotated: boolean; readonly message: string }) =>
+  show(
+    result.rotated
+      ? {
+          type: "info",
+          message: "The local API key was rotated.",
+          detail:
+            "Executor's background server restarted with the new key. Update scripts and clients that used the previous key. Browser sessions and MCP sign-ins are kept.",
+        }
+      : {
+          type: "error",
+          message: "The local API key was not rotated.",
+          detail:
+            result.message === ""
+              ? "Executor could not run the key rotation. The API key was not changed."
+              : result.message,
+        },
+  );
 
-/** Confirm rotation, then hand the caller the work to run once the backend has stopped. */
+/** Confirm rotation, then hand the caller the work to run while the server is stopped. */
 export const makeRotateKeyAction = (request: () => void) =>
   Effect.gen(function* () {
     const lock = yield* Semaphore.make(1);
@@ -81,7 +88,7 @@ export const makeRotateKeyAction = (request: () => void) =>
         type: "warning",
         message: "Rotate the local API key?",
         detail:
-          "Executor restarts with a new key. Scripts and clients that send the current key stop working until you update them. Saved accounts, browser sessions and MCP sign-ins are kept.",
+          "Executor's background server restarts with a new key. Scripts and clients that send the current key, including the Executor CLI when EXECUTOR_API_KEY is set, stop working until you update them. Saved accounts, browser sessions and MCP sign-ins are kept.",
         buttons: ["Rotate and restart", "Cancel"],
         defaultId: 1,
         cancelId: 1,
diff --git a/apps/local/desktop/src/implementation/runtime.ts b/apps/local/desktop/src/implementation/runtime.ts
new file mode 100644
index 0000000000..c5c10f1728
--- /dev/null
+++ b/apps/local/desktop/src/implementation/runtime.ts
@@ -0,0 +1,525 @@
+/**
+ * The program the desktop runs the background Executor with, and how it starts it. A packaged app
+ * copies the runtime it bundles out of the app first: the server outlives the app, while an
+ * installer replaces the app's files and an AppImage unmounts them. Development runs the CLI from
+ * source, as `bun run executor`.
+ */
+import { utilityProcess } from "electron";
+import {
+  Cause,
+  Deferred,
+  Duration,
+  Effect,
+  Exit,
+  FileSystem,
+  Option,
+  Path,
+  Queue,
+  Ref,
+  Schedule,
+  Schema,
+  Semaphore,
+} from "effect";
+import { ServiceFailed } from "../../../server/src/contracts/service.ts";
+import type {
+  RunningService,
+  ServiceStart,
+} from "../../../server/src/implementation/service-client.ts";
+import {
+  readRegistration,
+  serviceVersion,
+} from "../../../server/src/implementation/service-files.ts";
+import {
+  DesktopFailed,
+  DesktopRuntimeBuild,
+  desktopRuntimeBuildFile,
+  StarterAttempt,
+  StarterCommand,
+  StarterReport,
+} from "../contracts/desktop.ts";
+
+/**
+ * `command` is `[executable, ...arguments]` that runs the CLI; a command such as `serve --service`
+ * follows. `version` is what its servers report, which decides whether a running one is replaced.
+ * `env` is the whole environment it runs with.
+ */
+export interface ServiceProgram {
+  readonly command: ReadonlyArray<string>;
+  readonly version: string;
+  readonly env: Readonly<Record<string, string>>;
+}
+
+export interface ServiceRuntime {
+  readonly program: Effect.Effect<ServiceProgram, DesktopFailed>;
+  /**
+   * Remove staged runtimes other than this one, except those of `version`, which the running
+   * background server may use. One that cannot be removed yet is tried again next launch.
+   */
+  readonly clean: (version: string) => Effect.Effect<void>;
+}
+
+/** What an AppImage's runtime sets for the app it runs: its mount, its file and how it started. */
+const appImageVariables = ["APPDIR", "APPIMAGE", "ARGV0", "OWD"];
+
+/**
+ * The environment a background server runs with: this process's, without what belongs to this app
+ * process only. A server outlives the app. An AppImage's AppRun puts its mount first in PATH,
+ * LD_LIBRARY_PATH, XDG_DATA_DIRS and GSETTINGS_SCHEMA_DIR, and once the app quits the mount is
+ * removed and any local user may create that path in /tmp, so no entry may name it. Electron's own
+ * variables change how Electron and Node children behave.
+ */
+const serverEnvironment = (environment: NodeJS.ProcessEnv) => {
+  const mount = environment.APPDIR?.replace(/\/+$/u, "");
+  const inMount = (entry: string) =>
+    mount !== undefined && mount !== "" && (entry === mount || entry.startsWith(`${mount}/`));
+  return Object.fromEntries(
+    Object.entries(environment).flatMap(([name, value]): Array<[string, string]> => {
+      if (value === undefined || name.startsWith("ELECTRON_")) return [];
+      if (mount !== undefined && appImageVariables.includes(name)) return [];
+      if (!value.split(":").some(inMount)) return [[name, value]];
+      const kept = value.split(":").filter((entry) => !inMount(entry));
+      return kept.length === 0 ? [] : [[name, kept.join(":")]];
+    }),
+  );
+};
+
+/**
+ * Bash closes every descriptor above stderr, then replaces itself with the command, which keeps
+ * its process ID. Descriptor numbers above 9 need Bash; POSIX `sh` may not accept them.
+ */
+const closeInherited = `for fd in /proc/$$/fd/*; do fd=\${fd##*/}; [ "$fd" -gt 2 ] && eval "exec $fd>&-"; done; exec "$@"`;
+
+/**
+ * `command`, started with as few of its starter's descriptors as the platform allows. A background
+ * server outlives the desktop, so anything of the app it inherits stays open after the app quits.
+ *
+ * The desktop starts it from a utility process (see `ensureServer`). On Windows a child inherits
+ * every inheritable handle of its parent. Electron's main process keeps its standard streams
+ * inheritable, while Chromium starts the utility process with only the handles it names and Node
+ * there makes its standard streams non-inheritable. One handle is still inherited: Chromium creates
+ * the utility process's end of its channel to the main process inheritable, so a server holds that
+ * end for as long as it runs. It is no stream or file of the app, and Electron still reports the
+ * utility process's exit, also one ended from outside, while a server holds it (see
+ * `starterDeadline`). On Linux a child inherits every descriptor without close-on-exec, and the
+ * utility process still holds some from Chromium that Node leaves open across exec, such as
+ * Electron's V8 snapshot, which in an AppImage keeps its mount in use. So there Bash closes every
+ * descriptor above stderr first. Without /bin/bash the command starts as it is and keeps them, and
+ * an AppImage's mount stays in use while the server runs. The utility process's channel to the main
+ * process is close-on-exec on Linux, so a server never holds it there. macOS starts each child with
+ * only the descriptors it names.
+ */
+const withoutInherited = (command: ReadonlyArray<string>) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    if (process.platform !== "linux" || !(yield* fs.exists("/bin/bash"))) return command;
+    return ["/bin/bash", "-c", closeInherited, "executor", ...command];
+  });
+
+/**
+ * `bin.ts` runs under the Node on PATH. Its environment is this one, which carries the dev defaults
+ * and EXECUTOR_BUILD_VERSION, so it reports the version this process reads.
+ */
+export const developmentRuntime = (root: string) =>
+  Effect.gen(function* () {
+    const services = yield* Effect.context<FileSystem.FileSystem>();
+    return {
+      program: Effect.gen(function* () {
+        const version = yield* serviceVersion;
+        const command = yield* withoutInherited(["node", `${root}/apps/local/server/src/bin.ts`]);
+        return { command, version, env: serverEnvironment(process.env) };
+      }).pipe(
+        Effect.provideContext(services),
+        Effect.mapError(() => new DesktopFailed({ stage: "runtime" })),
+      ),
+      clean: () => Effect.void,
+    } satisfies ServiceRuntime;
+  });
+
+const BuildJson = Schema.fromJsonString(DesktopRuntimeBuild);
+
+/** The build `file` in `directory` names: `desktop-runtime.json` unless another file is given. */
+const readBuild = (directory: string, file = desktopRuntimeBuildFile) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* fs
+      .readFileString(path.join(directory, file))
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(BuildJson)));
+  });
+
+/**
+ * Written into a staged runtime last, after every file and the rename into place, naming its build.
+ * A staged directory without it is partial, as after a removal that stopped partway, and is never
+ * used; removing a staged runtime removes it first.
+ */
+const stagedFile = ".staged.json";
+
+const hasCode = (...codes: [string, ...Array<string>]) =>
+  Schema.is(Schema.Struct({ cause: Schema.Struct({ code: Schema.Literals(codes) }) }));
+
+/**
+ * Antivirus scanners and the indexer on Windows briefly hold files just written, so renaming or
+ * removing their directory fails with EPERM, EBUSY or EACCES for a moment, which graceful-fs also
+ * retries. A process that was just ended keeps its files open for a moment after it is gone too,
+ * about a third of a second after its tree is killed, so a data directory whose server just stopped
+ * or was killed cannot be renamed yet. There such a step is tried again for a few seconds before it
+ * fails. The data migration and a reset rename data directories the same way.
+ */
+export const whileHeld = <A, E, R>(step: Effect.Effect<A, E, R>) =>
+  process.platform === "win32"
+    ? step.pipe(
+        Effect.retry({
+          while: hasCode("EPERM", "EBUSY", "EACCES"),
+          schedule: Schedule.exponential("50 millis").pipe(
+            Schedule.upTo({ duration: "5 seconds" }),
+          ),
+        }),
+      )
+    : step;
+
+/**
+ * Stage `source`, the app's bundled runtime, as `<staging>/<version>-<build>` once per build. The
+ * copy goes to a temporary directory first, is renamed into place and is then marked staged, so a
+ * staged runtime is used only once it is complete.
+ */
+export const packagedRuntime = (options: { readonly source: string; readonly staging: string }) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const services = yield* Effect.context<FileSystem.FileSystem | Path.Path>();
+    /** Remove a staged runtime, its mark first, so a removal that stops partway is staged again. */
+    const remove = (directory: string) =>
+      whileHeld(fs.remove(path.join(directory, stagedFile), { force: true })).pipe(
+        Effect.andThen(whileHeld(fs.remove(directory, { recursive: true }))),
+      );
+    const stage = Effect.gen(function* () {
+      const build = yield* readBuild(options.source);
+      const name = `${build.version.replace(/[^a-zA-Z0-9._-]/gu, "-")}-${build.build}`;
+      const target = path.join(options.staging, name);
+      const marked = yield* readBuild(target, stagedFile).pipe(Effect.option);
+      if (
+        Option.isNone(marked) ||
+        marked.value.version !== build.version ||
+        marked.value.build !== build.build
+      ) {
+        yield* Effect.logInfo("Staging the Executor runtime").pipe(
+          Effect.annotateLogs({ path: target }),
+        );
+        yield* fs.makeDirectory(options.staging, { recursive: true, mode: 0o700 });
+        // A partial copy is renamed aside under a name `clean` removes, so it is never used.
+        if (yield* fs.exists(target)) {
+          const aside = path.join(options.staging, `.staging-${name}-${crypto.randomUUID()}`);
+          yield* whileHeld(fs.rename(target, aside));
+          yield* remove(aside).pipe(
+            Effect.catch(() =>
+              Effect.logWarning("Could not remove a partial Executor runtime yet").pipe(
+                Effect.annotateLogs({ path: aside }),
+              ),
+            ),
+          );
+        }
+        const temporary = yield* fs.makeTempDirectory({
+          directory: options.staging,
+          prefix: ".staging-",
+        });
+        yield* fs.copy(options.source, temporary, { overwrite: true });
+        yield* whileHeld(fs.rename(temporary, target)).pipe(
+          // Another launch may have staged the same build meanwhile; only whole copies move in.
+          Effect.catch((error) =>
+            fs
+              .exists(target)
+              .pipe(
+                Effect.flatMap((staged) =>
+                  remove(temporary).pipe(
+                    Effect.ignore,
+                    Effect.andThen(staged ? Effect.void : Effect.fail(error)),
+                  ),
+                ),
+              ),
+          ),
+        );
+        yield* fs.writeFileString(
+          path.join(target, stagedFile),
+          yield* Schema.encodeEffect(BuildJson)(build),
+        );
+      }
+      const node = path.join(target, "node", process.platform === "win32" ? "node.exe" : "node");
+      // `bin.mjs` reports the release it was built as, whatever this process's environment says.
+      const program: ServiceProgram = {
+        command: yield* withoutInherited([node, path.join(target, "bin.mjs")]),
+        version: build.version,
+        env: serverEnvironment(process.env),
+      };
+      return { name, program };
+    }).pipe(
+      Effect.provideContext(services),
+      Effect.tapCause((cause) => Effect.logError("Could not stage the Executor runtime", cause)),
+      Effect.mapError(() => new DesktopFailed({ stage: "runtime" })),
+    );
+    // Staged once per launch; a failure is tried again by the next connection attempt.
+    const lock = yield* Semaphore.make(1);
+    const done = yield* Ref.make(Option.none<Effect.Success<typeof stage>>());
+    const staged = lock.withPermit(
+      Effect.gen(function* () {
+        const found = yield* Ref.get(done);
+        if (Option.isSome(found)) return found.value;
+        const result = yield* stage;
+        yield* Ref.set(done, Option.some(result));
+        return result;
+      }),
+    );
+    const clean = (version: string) =>
+      Effect.gen(function* () {
+        const { name } = yield* staged;
+        for (const entry of yield* fs.readDirectory(options.staging)) {
+          if (entry === name) continue;
+          const directory = path.join(options.staging, entry);
+          const build = entry.startsWith(".staging-")
+            ? Option.none<DesktopRuntimeBuild>()
+            : yield* readBuild(directory).pipe(Effect.option);
+          if (Option.isSome(build) && build.value.version === version) continue;
+          yield* remove(directory).pipe(
+            Effect.tap(() =>
+              Effect.logInfo("Removed an old Executor runtime").pipe(
+                Effect.annotateLogs({ path: directory }),
+              ),
+            ),
+            Effect.catch(() =>
+              Effect.logWarning("Could not remove an old Executor runtime yet").pipe(
+                Effect.annotateLogs({ path: directory }),
+              ),
+            ),
+          );
+        }
+      }).pipe(Effect.provideContext(services), Effect.ignore);
+    return {
+      program: Effect.map(staged, ({ program }) => program),
+      clean,
+    } satisfies ServiceRuntime;
+  });
+
+type StarterFailure = (typeof StarterReport.cases.Failed.Type)["error"];
+
+/** The server starter's entry, which `scripts/build.mjs` bundles beside the main entry. */
+const starterEntry = "starter.cjs";
+/** How long a starter gets to end the start attempts it began and exit before it is killed. */
+const starterStop = Duration.seconds(5);
+/**
+ * How long a starter gets to report whether the server started. `ensure` gives up after two
+ * minutes of attempts, and its last probe and stop take seconds more. One that has reported
+ * neither by then has hung: Electron reports a starter that exits, also on Windows, where a server
+ * it started holds its end of its channel to this process (see `withoutInherited`).
+ */
+const starterDeadline = Duration.minutes(3);
+/** How much of a starter's stderr is kept for the log. */
+const starterOutputLimit = 8 * 1024;
+
+/** States in Linux's `/proc/<pid>/stat` of a process that has exited: a zombie, or one being reaped. */
+const exitedStates = new Set(["Z", "X", "x"]);
+
+/**
+ * Whether `pid` still runs, stopped or hung included. Signal 0 also reaches a process that has
+ * exited and has not been reaped yet, a zombie, so on Linux its state in `/proc` decides. macOS has
+ * no such file. There Electron reports a starter's exit as soon as it exits, and a starter is
+ * checked here only when Electron has reported no exit; that leaves a starter that exits just
+ * before the check. On Windows signal 0 reports an exited process as gone.
+ */
+const stillRuns = (pid: number) =>
+  Effect.gen(function* () {
+    const exists = yield* Effect.try(() => process.kill(pid, 0)).pipe(
+      Effect.as(true),
+      Effect.orElseSucceed(() => false),
+    );
+    if (!exists || process.platform !== "linux") return exists;
+    const fs = yield* FileSystem.FileSystem;
+    const stat = yield* fs.readFileString(`/proc/${pid}/stat`).pipe(Effect.option);
+    if (Option.isNone(stat)) return false;
+    // The state follows the command name, which is in parentheses and may contain any character.
+    const state = stat.value.charAt(stat.value.lastIndexOf(")") + 2);
+    return state !== "" && !exitedStates.has(state);
+  });
+
+/**
+ * End the start attempts in `pids` that a starter began and has not reported exited, except the
+ * server registered for `directory`, as `ensure` asks them to exit once it is done. That is done
+ * only while the starter still runs: it is each attempt's parent, so an attempt's ID cannot name
+ * another process before the starter has seen the attempt exit, and the starter reports each exit
+ * it sees. The one gap is an attempt the starter saw exit just before it stopped answering, whose
+ * report has not arrived: its ID is free and may already name another process. Once the starter
+ * has exited, zombie included, nothing holds its attempts' IDs, and an attempt that exits frees its
+ * ID at once; the attempts are left to finish, as the server or by exiting once another one serves.
+ */
+const endAttempts = (directory: string, starter: number | undefined, pids: ReadonlySet<number>) =>
+  Effect.gen(function* () {
+    if (pids.size === 0) return;
+    const running = starter !== undefined && (yield* stillRuns(starter));
+    if (!running)
+      return yield* Effect.logWarning(
+        "Executor's server starter is gone; its start attempts are left to finish",
+      ).pipe(Effect.annotateLogs({ pids: [...pids] }));
+    const server = Option.getOrUndefined(yield* readRegistration(directory))?.pid;
+    for (const pid of pids) {
+      if (pid === server) continue;
+      // A detached attempt leads its own process group on POSIX, with the processes it started.
+      const ended = yield* Effect.try(() =>
+        process.kill(process.platform === "win32" ? pid : -pid, "SIGTERM"),
+      ).pipe(
+        Effect.as(true),
+        Effect.orElseSucceed(() => false),
+      );
+      if (ended)
+        yield* Effect.logWarning(
+          "Ended a start attempt of a server starter that did not exit",
+        ).pipe(Effect.annotateLogs({ pid }));
+    }
+  });
+
+/**
+ * A ready background server for `directory`, started if needed, as the CLI's `ensure` returns it.
+ * The desktop runs `ensure` in a server starter, an Electron utility process (see `starter.ts`), so
+ * the detached server it starts inherits none of this process's handles. The starter ends with the
+ * attempt: when this returns, fails or is interrupted, it is told to stop, which interrupts an
+ * unfinished `ensure`, and it is killed if it has not exited within a few seconds. A starter that
+ * reports no outcome within `starterDeadline` fails the start.
+ */
+export const ensureServer = (
+  directory: string,
+  options: {
+    readonly version: "replace" | "ignore";
+    readonly program: ServiceProgram;
+    readonly onStart: (start: ServiceStart) => Effect.Effect<void>;
+  },
+) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const reports = yield* Queue.unbounded<unknown, ServiceFailed>();
+    const exited = yield* Deferred.make<number>();
+    let output = "";
+    let fatal: { readonly type: string; readonly location: string } | undefined;
+    /** The start attempts the starter began and has not reported exited. */
+    const attempts = new Set<number>();
+    const starter = yield* Effect.acquireRelease(
+      Effect.sync(() => {
+        const child = utilityProcess.fork(path.join(__dirname, starterEntry), [], {
+          serviceName: "Executor server starter",
+          stdio: ["ignore", "ignore", "pipe"],
+        });
+        child.stderr?.on("data", (chunk: Buffer) => {
+          output = (output + chunk.toString()).slice(-starterOutputLimit);
+        });
+        child.on("message", (message: unknown) => {
+          const attempt = Schema.decodeUnknownOption(StarterAttempt)(message);
+          if (Option.isNone(attempt)) {
+            Queue.offerUnsafe(reports, message);
+            return;
+          }
+          StarterAttempt.match(attempt.value, {
+            AttemptStarted: ({ pid }) => {
+              attempts.add(pid);
+            },
+            AttemptExited: ({ pid }) => {
+              attempts.delete(pid);
+            },
+          });
+        });
+        // V8 cannot continue in the starter, which exits next. Like any `error` event, one without
+        // a listener would throw in this process.
+        child.on("error", (type, location) => {
+          fatal = { type, location };
+          Queue.failCauseUnsafe(
+            reports,
+            Cause.fail(
+              new ServiceFailed({
+                reason: "start-failed",
+                detail: `Executor's server starter stopped with a fatal error (${type}) before the server was ready.`,
+              }),
+            ),
+          );
+        });
+        child.once("exit", (code) => {
+          Deferred.doneUnsafe(exited, Exit.succeed(code));
+          // Reports it sent before it exited are still read first.
+          Queue.failCauseUnsafe(
+            reports,
+            Cause.fail(
+              new ServiceFailed({
+                reason: "start-failed",
+                detail: `Executor's server starter exited with code ${code} before the server was ready.`,
+              }),
+            ),
+          );
+        });
+        return child;
+      }),
+      (child) =>
+        Effect.gen(function* () {
+          if (!Deferred.isDoneUnsafe(exited))
+            child.postMessage(
+              yield* Schema.encodeEffect(StarterCommand)(StarterCommand.cases.Stop.make({})),
+            );
+          const code = yield* Deferred.await(exited).pipe(Effect.timeoutOption(starterStop));
+          if (Option.isNone(code)) {
+            yield* Effect.logWarning("Executor's server starter did not exit; stopping it");
+            // It never asked the start attempts it began to exit. They end first, if it still runs.
+            yield* endAttempts(directory, child.pid, attempts);
+            child.kill();
+          }
+          if (fatal !== undefined)
+            yield* Effect.logWarning("Executor's server starter stopped with a fatal error").pipe(
+              Effect.annotateLogs(fatal),
+            );
+          if (output.trim() !== "")
+            yield* Effect.logWarning("Executor's server starter wrote to stderr").pipe(
+              Effect.annotateLogs({ output }),
+            );
+        }).pipe(Effect.orDie),
+    );
+    starter.postMessage(
+      yield* Schema.encodeEffect(StarterCommand)(
+        StarterCommand.cases.Start.make({
+          directory,
+          version: options.version,
+          program: options.program,
+        }),
+      ).pipe(Effect.orDie),
+    );
+    const outcome = Effect.gen(function* () {
+      while (true) {
+        const report = yield* Queue.take(reports).pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(StarterReport)),
+          Effect.catchTag("SchemaError", () =>
+            Effect.fail(
+              new ServiceFailed({
+                reason: "start-failed",
+                detail: "Executor's server starter sent a report this desktop cannot read.",
+              }),
+            ),
+          ),
+        );
+        const service = yield* StarterReport.match<
+          Effect.Effect<Option.Option<RunningService>, StarterFailure>
+        >(report, {
+          Starting: (start) =>
+            options.onStart(start).pipe(Effect.as(Option.none<RunningService>())),
+          Ready: ({ url, version, pid, password, browserOrigin }) =>
+            Effect.succeed(
+              Option.some<RunningService>({ url, version, pid, password, browserOrigin }),
+            ),
+          Failed: ({ error }) => Effect.fail(error),
+        });
+        if (Option.isSome(service)) return service.value;
+      }
+    });
+    return yield* outcome.pipe(
+      Effect.timeoutOrElse({
+        duration: starterDeadline,
+        orElse: () =>
+          Effect.fail(
+            new ServiceFailed({
+              reason: "start-failed",
+              detail: `Executor's server starter did not say whether the server started within ${Duration.toMinutes(starterDeadline)} minutes.`,
+            }),
+          ),
+      }),
+    );
+  }).pipe(Effect.scoped);
diff --git a/apps/local/desktop/src/implementation/settings.ts b/apps/local/desktop/src/implementation/settings.ts
index 7b1c0ed500..55a65759e8 100644
--- a/apps/local/desktop/src/implementation/settings.ts
+++ b/apps/local/desktop/src/implementation/settings.ts
@@ -1,45 +1,67 @@
-/** Desktop-owned settings. The port form is a script-free document; its submission is a navigation. */
+/**
+ * The background server's port, kept in the data directory's `service.json` like `executor service
+ * set port`. The form is a script-free document; its submission is a navigation.
+ */
 import { createServer } from "node:net";
 import { BrowserWindow, session } from "electron";
 import { Effect, FileSystem, Option, Path, Schema } from "effect";
-import { DesktopPort, DesktopSettings, SettingsFailed } from "../contracts/desktop.ts";
+import { readSettings, writeSettings } from "../../../server/src/implementation/service-files.ts";
+import { DesktopPort, LegacyDesktopSettings, SettingsFailed } from "../contracts/desktop.ts";
 
-/** Where the backend port comes from. An explicit EXECUTOR_PORT always wins over the setting. */
+/** Where the server's port comes from. An explicit EXECUTOR_PORT always wins over the setting. */
 export type PortSource =
   | { readonly kind: "environment"; readonly port: string }
   | { readonly kind: "setting"; readonly port: number }
-  | { readonly kind: "default" };
+  | { readonly kind: "default" }
+  | { readonly kind: "invalid"; readonly message: string };
 
-const settingsPath = (directory: string) =>
-  Effect.gen(function* () {
-    const path = yield* Path.Path;
-    return path.join(directory, "desktop.json");
-  });
+/** The port source now. `environment` is EXECUTOR_PORT as this desktop started. */
+export const portSource = (directory: string, environment: Option.Option<string>) =>
+  Option.isSome(environment)
+    ? Effect.succeed<PortSource>({ kind: "environment", port: environment.value })
+    : readSettings(directory).pipe(
+        Effect.map((settings): PortSource =>
+          settings.port === undefined
+            ? { kind: "default" }
+            : { kind: "setting", port: settings.port },
+        ),
+        Effect.catchTag("ServiceSettingInvalid", (error) =>
+          Effect.succeed<PortSource>({ kind: "invalid", message: error.message }),
+        ),
+      );
 
-/** Read `desktop.json`. A missing file is the default; an unreadable one stops startup. */
-export const readSettings = (directory: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const file = yield* settingsPath(directory);
-    if (!(yield* fs.exists(file))) return Option.none<typeof DesktopSettings.Type>();
-    return Option.some(
-      yield* fs
-        .readFileString(file)
-        .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(DesktopSettings)))),
-    );
-  }).pipe(Effect.mapError(() => new SettingsFailed({ reason: "invalid" })));
+/** Keep every other setting; only the port changes. */
+const savePort = (platform: string, directory: string, port: number) =>
+  readSettings(directory).pipe(
+    Effect.flatMap((settings) => writeSettings(platform, directory, { ...settings, port })),
+    Effect.mapError(() => new SettingsFailed()),
+  );
 
-const writeSettings = (directory: string, settings: typeof DesktopSettings.Type) =>
+/**
+ * The port an old desktop saved in its own data directory's `desktop.json`, for the migration.
+ * A missing file has none; an unreadable one is logged and carries none over.
+ */
+export const legacyPort = (directory: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
-    const file = yield* settingsPath(directory);
-    const staged = `${file}.${process.pid}.tmp`;
-    const contents = yield* Schema.encodeEffect(Schema.fromJsonString(DesktopSettings))(settings);
-    yield* fs.writeFileString(staged, `${contents}\n`, { mode: 0o600 });
-    yield* fs.rename(staged, file);
-  }).pipe(Effect.mapError(() => new SettingsFailed({ reason: "write" })));
+    const path = yield* Path.Path;
+    const file = path.join(directory, "desktop.json");
+    if (!(yield* fs.exists(file))) return undefined;
+    const settings = yield* fs
+      .readFileString(file)
+      .pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(LegacyDesktopSettings))),
+      );
+    return settings.port;
+  }).pipe(
+    Effect.catch(() =>
+      Effect.logWarning("The old desktop.json is unreadable; its port is not carried over").pipe(
+        Effect.as(undefined),
+      ),
+    ),
+  );
 
-/** Probe the loopback address the backend binds. A later bind can still race another process. */
+/** Probe the loopback address the server binds. A later bind can still race another process. */
 const portAvailable = (port: number) =>
   Effect.callback<boolean>((resume) => {
     const server = createServer();
@@ -63,12 +85,15 @@ const portPage = (options: {
   readonly value: string;
   readonly error: string | undefined;
 }) => {
-  const locked = options.source.kind === "environment";
-  const note = locked
-    ? `EXECUTOR_PORT sets the port for this launch. Unset it to choose a port here.`
-    : options.current === undefined
-      ? `The local server is not running. Executor restarts to apply a new port.`
-      : `MCP clients and scripts use http://127.0.0.1:${options.current}. Update them after a change. Executor restarts to apply it.`;
+  const locked = options.source.kind === "environment" || options.source.kind === "invalid";
+  const note =
+    options.source.kind === "environment"
+      ? `EXECUTOR_PORT sets the port for this launch. Unset it to choose a port here.`
+      : options.source.kind === "invalid"
+        ? options.source.message
+        : options.current === undefined
+          ? `The background server is not running. It restarts to apply a new port.`
+          : `MCP clients and scripts use http://127.0.0.1:${options.current}. Update them after a change. The background server restarts to apply it, and the Executor CLI uses it too.`;
   return `data:text/html;charset=utf-8,${encodeURIComponent(`<!doctype html>
 <html lang="en">
 <meta charset="utf-8">
@@ -100,15 +125,18 @@ const portPage = (options: {
 };
 
 /**
- * Make the "Server port…" action. `current` is the port the running backend bound, if one is
- * running. Saving writes `desktop.json` and asks the caller to restart, because the listener cannot
- * move in place.
+ * Make the "Server port…" action. `current` is the port the running server bound, if one is
+ * running. Saving writes `service.json` and restarts the background server, because the listener
+ * cannot move in place.
  */
 export const makePortAction = (options: {
   readonly directory: string;
+  readonly platform: string;
+  /** EXECUTOR_PORT as this desktop started; it locks the form. */
+  readonly environment: Option.Option<string>;
   readonly current: () => number | undefined;
-  readonly source: PortSource;
   readonly parent: () => BrowserWindow | undefined;
+  /** Stop the background server and start it again, so it listens on the saved port. */
   readonly restart: () => void;
 }) =>
   Effect.gen(function* () {
@@ -116,8 +144,11 @@ export const makePortAction = (options: {
     const run = <A, E>(effect: Effect.Effect<A, E, FileSystem.FileSystem | Path.Path>) =>
       Effect.runPromise(Effect.provide(effect, services));
     let open: BrowserWindow | undefined;
-    const show = Effect.sync(() => {
+    const show = Effect.gen(function* () {
       if (open !== undefined && !open.isDestroyed()) return open.focus();
+      // Read once per opened form, so a restart while it is open cannot change the page.
+      const source = yield* portSource(options.directory, options.environment);
+      const running = options.current();
       const parent = options.parent();
       const current = new BrowserWindow({
         width: 420,
@@ -145,11 +176,9 @@ export const makePortAction = (options: {
       current.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
       current.webContents.on("will-attach-webview", (event) => event.preventDefault());
       current.once("ready-to-show", () => current.show());
-      // Read once per opened form, so a backend restart while it is open cannot change the page.
-      const running = options.current();
       const load = (value: string, error: string | undefined) => {
         void current
-          .loadURL(portPage({ current: running, source: options.source, value, error }))
+          .loadURL(portPage({ current: running, source, value, error }))
           .catch(() => current.destroy());
       };
       const submit = (value: string) =>
@@ -162,10 +191,7 @@ export const makePortAction = (options: {
               value,
               `Port ${port.value} is in use by another program. Choose another port.`,
             );
-          const saved = yield* writeSettings(options.directory, {
-            version: 1,
-            port: port.value,
-          }).pipe(
+          const saved = yield* savePort(options.platform, options.directory, port.value).pipe(
             Effect.as(true),
             Effect.catch(() => Effect.succeed(false)),
           );
@@ -179,7 +205,7 @@ export const makePortAction = (options: {
         });
       current.webContents.on("will-navigate", (event, url) => {
         event.preventDefault();
-        if (options.source.kind === "environment" || !url.startsWith(action)) {
+        if (source.kind === "environment" || source.kind === "invalid" || !url.startsWith(action)) {
           current.destroy();
           return;
         }
@@ -187,10 +213,7 @@ export const makePortAction = (options: {
         if (target.pathname === "port") void run(submit(target.searchParams.get("port") ?? ""));
         else current.destroy();
       });
-      load(
-        String(running ?? (options.source.kind === "setting" ? options.source.port : "")),
-        undefined,
-      );
+      load(String(running ?? (source.kind === "setting" ? source.port : "")), undefined);
     });
     return show;
   });
diff --git a/apps/local/desktop/src/implementation/startup.ts b/apps/local/desktop/src/implementation/startup.ts
index 175bae2751..3ae17d2244 100644
--- a/apps/local/desktop/src/implementation/startup.ts
+++ b/apps/local/desktop/src/implementation/startup.ts
@@ -1,5 +1,6 @@
-/** Isolated, script-free startup document shown before the local server is ready. */
-export const startupUrl = `data:text/html;charset=utf-8,${encodeURIComponent(`<!doctype html>
+/** Isolated, script-free status documents shown before the local server is ready. */
+const statusUrl = (title: string, detail: string) =>
+  `data:text/html;charset=utf-8,${encodeURIComponent(`<!doctype html>
 <html lang="en">
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -12,5 +13,13 @@ export const startupUrl = `data:text/html;charset=utf-8,${encodeURIComponent(`<!
   h1 { font-size: 22px; font-weight: 600; letter-spacing: -0.5px; margin: 0 0 10px; }
   p { font-size: 14px; margin: 0; opacity: 0.65; }
 </style>
-<main role="status"><h1>Starting Executor</h1><p>Your apps will open here.</p></main>
+<main role="status"><h1>${title}</h1><p>${detail}</p></main>
 </html>`)}`;
+
+export const startupUrl = statusUrl("Starting Executor", "Your apps will open here.");
+
+/** Shown while the desktop's old data moves into the CLI's data directory, once. */
+export const movingUrl = statusUrl(
+  "Moving your Executor data…",
+  "Executor now shares its data with the CLI. This happens once and can take a minute.",
+);
diff --git a/apps/local/desktop/src/implementation/supervisor.ts b/apps/local/desktop/src/implementation/supervisor.ts
deleted file mode 100644
index c0a00d02fa..0000000000
--- a/apps/local/desktop/src/implementation/supervisor.ts
+++ /dev/null
@@ -1,164 +0,0 @@
-/** Keeps one backend running: restarts it with backoff and stops after a crash loop. */
-import { Clock, Duration, Effect, Fiber, Option, Redacted, Ref, Scope, Semaphore } from "effect";
-import type { ChildProcessSpawner } from "effect/process";
-import type { DesktopBootstrap } from "@executor-js/local-server/auth";
-import type { DesktopFailed, DesktopRecovery } from "../contracts/desktop.ts";
-import { classifyBackendExit, type BackendExit, type BackendRun } from "./backend.ts";
-
-/** Restart delays start here and double after each unexpected exit. Readiness resets them. */
-const initialDelay = Duration.millis(500);
-const maximumDelay = Duration.seconds(10);
-/** This many unexpected exits inside the window stop supervision and show recovery. */
-const crashLoopExits = 3;
-const crashLoopWindow = Duration.seconds(60);
-const readyTimeout = Duration.seconds(60);
-
-export const restartDelay = (attempt: number) =>
-  Duration.min(Duration.times(initialDelay, 2 ** attempt), maximumDelay);
-
-type Token = (typeof DesktopBootstrap.Type)["token"];
-type Outcome =
-  | { readonly kind: "stopped" }
-  | { readonly kind: "recover"; readonly recovery: DesktopRecovery }
-  | { readonly kind: "exited"; readonly ready: boolean };
-
-const mintToken = (): Token =>
-  Redacted.make(
-    Array.from(crypto.getRandomValues(new Uint8Array(32)), (byte) =>
-      byte.toString(16).padStart(2, "0"),
-    ).join(""),
-  );
-
-export const makeSupervisor = (options: {
-  /** Spawn one backend with a fresh one-use bootstrap token. */
-  readonly start: (
-    token: Token,
-  ) => Effect.Effect<
-    BackendRun,
-    DesktopFailed,
-    Scope.Scope | ChildProcessSpawner.ChildProcessSpawner
-  >;
-  /** True once the app has begun quitting; exits after that need no recovery. */
-  readonly quitting: Effect.Effect<boolean>;
-  /** A run is starting; show the startup page. */
-  readonly onStarting: Effect.Effect<void>;
-  /** The run is ready. Scoped to that run, so forwarding stops when it exits. */
-  readonly onReady: (run: BackendRun, origin: string) => Effect.Effect<void, never, Scope.Scope>;
-  /** Supervision stopped; show the recovery page. */
-  readonly onRecovery: (recovery: DesktopRecovery) => Effect.Effect<void>;
-}) =>
-  Effect.gen(function* () {
-    const scope = yield* Effect.scope;
-    const spawner = yield* Effect.context<ChildProcessSpawner.ChildProcessSpawner>();
-    const lock = yield* Semaphore.make(1);
-    const supervision = yield* Ref.make(Option.none<Fiber.Fiber<void>>());
-    const current = yield* Ref.make(Option.none<BackendRun>());
-    const runs = yield* Ref.make(0);
-
-    const report = (runId: number, exit: BackendExit, kind: string) =>
-      (kind === "external-shutdown" ? Effect.logWarning : Effect.logError)(
-        "Desktop backend exited",
-      ).pipe(
-        Effect.annotateLogs({
-          run: runId,
-          kind,
-          exitCode: exit.code,
-          signal: exit.signal,
-          ready: exit.ready,
-          configuration: Option.getOrUndefined(exit.configuration),
-          stderr: exit.stderr,
-        }),
-      );
-
-    const runOnce = Effect.gen(function* () {
-      const runId = yield* Ref.updateAndGet(runs, (value) => value + 1);
-      const started = yield* options.start(mintToken()).pipe(Effect.option);
-      if (Option.isNone(started)) return { kind: "recover", recovery: { stage: "start" } } as const;
-      const run = started.value;
-      yield* Effect.acquireRelease(Ref.set(current, Option.some(run)), () =>
-        Ref.set(current, Option.none()),
-      );
-      const first = yield* Effect.raceFirst(
-        run.ready.pipe(
-          Effect.timeoutOption(readyTimeout),
-          Effect.orElseSucceed(() => Option.none<string>()),
-          Effect.map((origin) => ({ kind: "ready", origin }) as const),
-        ),
-        run.exited.pipe(Effect.map((exit) => ({ kind: "exited", exit }) as const)),
-      );
-      let exit: BackendExit;
-      if (first.kind === "exited") exit = first.exit;
-      else if (Option.isNone(first.origin)) {
-        // A bad readiness line or no readiness in time: stop this run and keep its output.
-        yield* report(runId, yield* run.stop, "ready");
-        return { kind: "recover", recovery: { stage: "ready" } } as const;
-      } else {
-        yield* Effect.logInfo("Desktop backend ready").pipe(
-          Effect.annotateLogs({ run: runId, origin: first.origin.value }),
-        );
-        yield* options.onReady(run, first.origin.value);
-        exit = yield* run.exited;
-      }
-      const kind = classifyBackendExit(exit, yield* options.quitting);
-      if (kind.kind === "managed-stop") {
-        yield* Effect.logInfo("Desktop backend stopped").pipe(Effect.annotateLogs({ run: runId }));
-        return { kind: "stopped" } as const;
-      }
-      yield* report(runId, exit, kind.kind);
-      if (Option.isSome(exit.configuration))
-        return {
-          kind: "recover",
-          recovery: { stage: "configuration", reason: exit.configuration.value },
-        } as const;
-      return { kind: "exited", ready: exit.ready } as const;
-    });
-
-    const supervise = Effect.gen(function* () {
-      let exits: ReadonlyArray<number> = [];
-      let attempt = 0;
-      while (true) {
-        yield* options.onStarting;
-        const outcome: Outcome = yield* Effect.scoped(runOnce);
-        if (outcome.kind === "stopped") return;
-        if (outcome.kind === "recover") return yield* options.onRecovery(outcome.recovery);
-        if (outcome.ready) attempt = 0;
-        const now = yield* Clock.currentTimeMillis;
-        exits = [...exits.filter((at) => now - at < Duration.toMillis(crashLoopWindow)), now];
-        if (exits.length >= crashLoopExits)
-          return yield* options.onRecovery({ stage: "crash-loop" });
-        const delay = restartDelay(attempt);
-        attempt += 1;
-        yield* Effect.logInfo("Restarting the desktop backend").pipe(
-          Effect.annotateLogs({ delayMillis: Duration.toMillis(delay) }),
-        );
-        yield* Effect.sleep(delay);
-      }
-    }).pipe(Effect.provideContext(spawner));
-
-    const stopUnlocked = Effect.gen(function* () {
-      const fiber = yield* Ref.getAndSet(supervision, Option.none());
-      if (Option.isNone(fiber)) return;
-      const run = yield* Ref.get(current);
-      if (Option.isSome(run)) yield* run.value.stop;
-      yield* Fiber.interrupt(fiber.value);
-    });
-
-    const startUnlocked = Effect.gen(function* () {
-      yield* stopUnlocked;
-      const fiber = yield* Effect.forkIn(supervise, scope);
-      yield* Ref.set(supervision, Option.some(fiber));
-    });
-
-    return {
-      /** Start supervision, first stopping any current backend. Calls are serialized. */
-      start: lock.withPermit(startUnlocked),
-      /**
-       * Stop the backend, run `effect` and start again. No other start can run in between, so
-       * nothing can use the data directory while `effect` works on it.
-       */
-      whileStopped: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-        lock.withPermit(stopUnlocked.pipe(Effect.andThen(effect), Effect.ensuring(startUnlocked))),
-    };
-  });
-
-export type Supervisor = Effect.Success<ReturnType<typeof makeSupervisor>>;
diff --git a/apps/local/desktop/src/implementation/updates.ts b/apps/local/desktop/src/implementation/updates.ts
index 93b9c3ec9d..0781454fbb 100644
--- a/apps/local/desktop/src/implementation/updates.ts
+++ b/apps/local/desktop/src/implementation/updates.ts
@@ -43,7 +43,8 @@ export const makeUpdater = (restart: (install: () => void) => void) =>
           dialog.showMessageBox({
             type: "question",
             message: `Executor 2 ${version} is ready to install.`,
-            detail: "The local server will stop while Executor restarts.",
+            detail:
+              "Executor restarts to install it. Its background server keeps running until the new version replaces it.",
             buttons: ["Restart", "Later"],
             defaultId: 1,
             cancelId: 1,
diff --git a/apps/local/desktop/src/main.ts b/apps/local/desktop/src/main.ts
index 262ed76191..85d834369e 100644
--- a/apps/local/desktop/src/main.ts
+++ b/apps/local/desktop/src/main.ts
@@ -1,4 +1,8 @@
-/** Electron composition root. No Electron or Node capability is exposed to the renderer. */
+/**
+ * Electron composition root. The desktop shares the CLI's background Executor: it starts or joins
+ * the server for the CLI's data directory and shows its dashboard. No Electron or Node capability
+ * is exposed to the renderer.
+ */
 import { resolve } from "node:path";
 import { app, BrowserWindow, dialog, Menu, nativeTheme, session, shell } from "electron";
 import * as NodeServices from "@effect/platform-node/NodeServices";
@@ -7,7 +11,9 @@ import { startProcessMetrics } from "@executor-js/telemetry/process";
 import {
   Cause,
   Config,
+  DateTime,
   Deferred,
+  Duration,
   Effect,
   Exit,
   FiberSet,
@@ -17,17 +23,26 @@ import {
   Path,
   Redacted,
   Ref,
+  Result,
   Schema,
-  Stream,
 } from "effect";
+import type { ChildProcessSpawner } from "effect/process";
 import { OAuthCallbackPath } from "@executor-js/local-server/contracts";
+import { desktopReturnHeader } from "../../server/src/contracts/desktop-return.ts";
+import { ServiceFailed } from "../../server/src/contracts/service.ts";
 import { DesktopFailed, externalUrl, type DesktopRecovery } from "./contracts/desktop.ts";
-import { startBackend } from "./implementation/backend.ts";
 import { release } from "../../../../scripts/releases/config.ts";
 import { makeUpdater } from "./implementation/updates.ts";
 import { makeOpenBrowserAction } from "./implementation/browser.ts";
-import { startupUrl } from "./implementation/startup.ts";
-import { makeSupervisor } from "./implementation/supervisor.ts";
+import { movingUrl, startupUrl } from "./implementation/startup.ts";
+import { makeConnection, type Connection } from "./implementation/connection.ts";
+import {
+  migrateDesktopData,
+  type MoveNotice,
+  noticeShown,
+  pendingNotice,
+} from "./implementation/migration.ts";
+import { developmentRuntime, packagedRuntime } from "./implementation/runtime.ts";
 import {
   isRecoveryLink,
   recoveryAction,
@@ -35,10 +50,9 @@ import {
   recoveryUrl,
 } from "./implementation/recovery.ts";
 import { makeResetAction } from "./implementation/reset.ts";
-import { makePortAction, readSettings, type PortSource } from "./implementation/settings.ts";
+import { legacyPort, makePortAction, portSource } from "./implementation/settings.ts";
 import { makeExportDiagnosticsAction } from "./implementation/diagnostics.ts";
-import { makeRotateKeyAction, rotateAfterStop } from "./implementation/rotation.ts";
-import type { ChildProcessSpawner } from "effect/process";
+import { announceRotation, makeRotateKeyAction, rotateKey } from "./implementation/rotation.ts";
 
 const root = app.isPackaged
   ? resolve(process.resourcesPath, "runtime")
@@ -58,11 +72,80 @@ else
 const rendererReloads = 3;
 const rendererReloadWindowMillis = 60_000;
 
+/**
+ * The dashboard is loaded this many times in a row, each time with a fresh pairing link, before
+ * the window shows recovery. A load that has not finished within `dashboardLoadTimeout`, from a
+ * server on this machine, is stuck. Each attempt after the first waits `dashboardRetryDelay`, so
+ * a server that stopped answering, which the connection notices within three seconds, is followed
+ * there instead of being reported here.
+ */
+const dashboardAttempts = 3;
+const dashboardLoadTimeout = Duration.seconds(30);
+const dashboardRetryDelay = Duration.seconds(2);
+
 /** The dashboard's `--background` token for the system appearance, painted before content loads. */
 const windowBackground = () => (nativeTheme.shouldUseDarkColors ? "#0a0a0a" : "#ffffff");
 
+const newWindow = (browserSession: Electron.Session) =>
+  new BrowserWindow({
+    width: 1180,
+    height: 800,
+    minWidth: 760,
+    minHeight: 540,
+    title: "Executor",
+    show: false,
+    backgroundColor: windowBackground(),
+    webPreferences: {
+      backgroundThrottling: false,
+      session: browserSession,
+      sandbox: true,
+      contextIsolation: true,
+      nodeIntegration: false,
+      webSecurity: true,
+    },
+  });
+
 /** Electron's `loadURL` rejection names the URL whose main-frame load failed. */
 const FailedLoad = Schema.Struct({ url: Schema.String });
+/**
+ * Why a main-frame load failed, as Electron's `loadURL` rejection says it. `ERR_ABORTED` is also
+ * how it reports a load that another navigation of the window replaced.
+ */
+const LoadError = Schema.Struct({ code: Schema.String, errno: Schema.Number });
+type LoadError = typeof LoadError.Type;
+
+/**
+ * The application menu, with the desktop's own items in it. Updates and Help are left out while
+ * they have none; File always ends with Quit (Close on macOS).
+ */
+const applicationMenu = (items: {
+  readonly file: ReadonlyArray<Electron.MenuItemConstructorOptions>;
+  readonly updates: ReadonlyArray<Electron.MenuItemConstructorOptions>;
+  readonly help: ReadonlyArray<Electron.MenuItemConstructorOptions>;
+}) =>
+  Menu.buildFromTemplate([
+    ...(process.platform === "darwin" ? [{ role: "appMenu" as const }] : []),
+    {
+      label: "File",
+      submenu: [
+        ...items.file,
+        ...(items.file.length === 0 ? [] : [{ type: "separator" as const }]),
+        { role: process.platform === "darwin" ? "close" : "quit" },
+      ],
+    },
+    ...(items.updates.length === 0 ? [] : [{ label: "Updates", submenu: [...items.updates] }]),
+    { role: "editMenu" },
+    { role: "viewMenu" },
+    { role: "windowMenu" },
+    ...(items.help.length === 0 ? [] : [{ role: "help" as const, submenu: [...items.help] }]),
+  ]);
+
+/** A page the window that opens before the data moves was asked to show, and that load. */
+interface EarlyPage {
+  readonly url: string;
+  readonly loading: Promise<void>;
+  failed: boolean;
+}
 
 /** What the window shows. A pairing link is one-use, so it is cleared once loaded. */
 type View =
@@ -70,51 +153,149 @@ type View =
   | { readonly kind: "ready"; readonly origin: string; readonly pairing: string | undefined }
   | { readonly kind: "recovery"; readonly recovery: DesktopRecovery };
 
+/**
+ * The data directories. The desktop uses the CLI's, so both share one background server: the
+ * CLI's default when packaged, and `bun run executor`'s in development. EXECUTOR_DESKTOP_DATA_DIR
+ * chooses another. Desktops before the background service kept their own data, which only the
+ * migration reads; a chosen directory migrates only an old one chosen with
+ * EXECUTOR_DESKTOP_LEGACY_DATA_DIR, so a throwaway directory never takes a real one's data.
+ */
+const dataDirectories = Effect.gen(function* () {
+  const path = yield* Path.Path;
+  const chosen = yield* Config.String("EXECUTOR_DESKTOP_DATA_DIR").pipe(Config.option);
+  const shared = Option.isSome(chosen)
+    ? chosen.value
+    : app.isPackaged
+      ? path.join(app.getPath("home"), ".executor", "v2", "cli")
+      : yield* Config.String("EXECUTOR_DATA_DIR").pipe(
+          Config.withDefault(path.join(root, ".local/dev/local")),
+        );
+  const legacy = yield* Config.String("EXECUTOR_DESKTOP_LEGACY_DATA_DIR").pipe(Config.option);
+  return {
+    directory: path.resolve(shared),
+    legacy: Option.isSome(legacy)
+      ? Option.some(path.resolve(legacy.value))
+      : Option.isSome(chosen)
+        ? Option.none<string>()
+        : Option.some(
+            app.isPackaged
+              ? path.join(app.getPath("userData"), "data")
+              : path.join(root, ".local/dev/desktop"),
+          ),
+  };
+});
+
 const desktop = Effect.gen(function* () {
   const quit = yield* Deferred.make<void, DesktopFailed>();
   const path = yield* Path.Path;
-  const fs = yield* FileSystem.FileSystem;
-  const directory = path.resolve(
-    yield* Config.String("EXECUTOR_DESKTOP_DATA_DIR").pipe(
-      Config.withDefault(
-        app.isPackaged
-          ? path.join(app.getPath("userData"), "data")
-          : path.join(root, ".local/desktop"),
-      ),
-    ),
-  );
+  const services = yield* Effect.context<FileSystem.FileSystem | Path.Path>();
+  const { directory, legacy } = yield* dataDirectories;
   const diagnostics = path.join(directory, "diagnostics");
-  // Beside the data directory, so a reset is a same-volume rename.
+  // Beside the data directory, so a reset or the migration is a same-volume rename.
   const backups = path.join(path.dirname(directory), "backups");
-  yield* fs.makeDirectory(directory, { recursive: true });
-  const log = yield* rotatingJsonLogger(diagnostics, "executor-desktop");
-  const environmentPort = yield* Config.String("EXECUTOR_PORT").pipe(Config.option);
-  const source: PortSource = Option.isSome(environmentPort)
-    ? { kind: "environment", port: environmentPort.value }
-    : Option.match(
-        yield* readSettings(directory).pipe(
-          Effect.mapError(() => new DesktopFailed({ stage: "configuration" })),
-        ),
-        {
-          onNone: () => ({ kind: "default" }),
-          onSome: (settings) => ({ kind: "setting", port: settings.port }),
-        },
-      );
-  const backendEntry = {
-    executable: app.isPackaged
-      ? path.join(root, "node", process.platform === "win32" ? "node.exe" : "node")
-      : process.execPath,
-    entry: path.join(
-      root,
-      app.isPackaged ? "desktop-server.mjs" : "apps/local/desktop/src/server.ts",
-    ),
-    cwd: root,
-    directory,
+  const stop = () => {
+    Effect.runSync(Deferred.succeed(quit, undefined));
   };
+  // From before the data moves: quitting meanwhile ends the app once the move is done.
+  const beforeQuit = (event: Electron.Event) => {
+    event.preventDefault();
+    stop();
+  };
+  app.on("before-quit", beforeQuit);
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  yield* Effect.addFinalizer(() =>
+    Effect.sync(() => {
+      app.removeListener("before-quit", beforeQuit);
+      process.removeListener("SIGTERM", stop);
+      process.removeListener("SIGINT", stop);
+    }),
+  );
+  yield* Effect.tryPromise({
+    try: () => app.whenReady(),
+    catch: () => new DesktopFailed({ stage: "window" }),
+  });
+  const browserSession = session.fromPartition("executor-desktop");
+  // The app's own menu is in place before its first window opens. Until the desktop is set up it
+  // has none of the desktop's items, which need its data.
+  Menu.setApplicationMenu(applicationMenu({ file: [], updates: [], help: [] }));
+  // The window opens on the startup page before the data moves, which can take a while, and says
+  // so meanwhile. It becomes the app's window once the desktop is set up (see `createWindow`). If
+  // the app's first page is the one it was last asked to show, that load becomes the window's own
+  // instead of loading the page again, unless it already failed; a failure before then is not
+  // reported.
+  let early: BrowserWindow | undefined = newWindow(browserSession);
+  const opening = early;
+  opening.once("ready-to-show", () => {
+    if (!opening.isDestroyed()) opening.show();
+  });
+  // Nothing it shows until then may navigate it or open another window.
+  const stay = (event: Electron.Event) => event.preventDefault();
+  opening.webContents.on("will-navigate", stay);
+  opening.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+  let earlyPage: EarlyPage | undefined;
+  const showEarly = (url: string) => {
+    if (opening.isDestroyed()) return;
+    const page: EarlyPage = { url, loading: opening.loadURL(url), failed: false };
+    page.loading.catch(() => {
+      page.failed = true;
+    });
+    earlyPage = page;
+  };
+  showEarly(startupUrl);
+  // Before anything uses the shared directory, the desktop's old data moves into it, once.
+  let movingSince = Option.none<DateTime.Utc>();
+  const migration = yield* Option.match(legacy, {
+    onNone: () => Effect.succeed({ kind: "none" as const }),
+    onSome: (legacyDirectory) =>
+      Effect.flatMap(legacyPort(legacyDirectory), (port) =>
+        migrateDesktopData({
+          platform: process.platform,
+          legacyDirectory,
+          sharedDirectory: directory,
+          backups,
+          legacyPort: port,
+          onMoving: Effect.gen(function* () {
+            movingSince = Option.some(yield* DateTime.now);
+            yield* Effect.logInfo("Moving the desktop's data");
+            showEarly(movingUrl);
+          }),
+        }),
+      ),
+  }).pipe(
+    // The desktop's log is in the shared directory, which the move must find as it was, so until
+    // the move is done its lines go to stderr only. The log records it once the move is done.
+    Effect.provide(Logger.layer([Logger.withConsoleError(Logger.formatJson)])),
+    Effect.result,
+  );
+  const moved = yield* Option.match(movingSince, {
+    onNone: () => Effect.succeed({}),
+    onSome: (since) =>
+      Effect.map(DateTime.now, (now) => ({
+        startedAt: DateTime.formatIso(since),
+        seconds: Duration.toSeconds(DateTime.distance(since, now)),
+      })),
+  });
+  // A failed migration may resume next launch, so it must find the shared directory as it was.
+  const log = Result.isSuccess(migration)
+    ? Option.some(yield* rotatingJsonLogger(diagnostics, "executor-desktop"))
+    : Option.none();
+  const environmentPort = yield* Config.String("EXECUTOR_PORT").pipe(Config.option);
   return yield* Effect.gen(function* () {
     yield* startProcessMetrics("executor-desktop");
-    const run = yield* FiberSet.makeRuntime();
-    yield* Effect.logInfo("Starting Executor desktop");
+    // Menu, window and recovery actions run in the desktop's scope, with its platform services.
+    const run = yield* FiberSet.makeRuntime<
+      FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner
+    >();
+    yield* Effect.logInfo("Starting Executor desktop").pipe(Effect.annotateLogs({ directory }));
+    if (Result.isFailure(migration))
+      yield* Effect.logError("Executor could not move the desktop's data", migration.failure).pipe(
+        Effect.annotateLogs(moved),
+      );
+    else if (migration.success.kind !== "none")
+      yield* Effect.logInfo("Moved the desktop's data").pipe(
+        Effect.annotateLogs({ ...migration.success, ...moved }),
+      );
     const onException = (error: Error) => {
       run(Effect.logError("Desktop uncaught exception", Cause.die(error)));
     };
@@ -122,63 +303,27 @@ const desktop = Effect.gen(function* () {
     yield* Effect.addFinalizer(() =>
       Effect.sync(() => process.removeListener("uncaughtExceptionMonitor", onException)),
     );
-    // Updates, restarts and key rotation run after every window and the local server have shut
-    // down. Each yields the final synchronous step that ends this process.
-    const afterStop = yield* Ref.make(
-      Option.none<Effect.Effect<() => void, never, ChildProcessSpawner.ChildProcessSpawner>>(),
-    );
+    // Installing an update or relaunching runs once every window has closed. Each is the final
+    // synchronous step that ends this process; the background server keeps running.
+    const afterStop = yield* Ref.make(Option.none<() => void>());
+    const after = (step: () => void) => {
+      Effect.runSync(Ref.set(afterStop, Option.some(step)));
+      stop();
+    };
     const relaunch = () => {
       app.relaunch();
       app.exit(0);
     };
-    const stop = () => {
-      Effect.runSync(Deferred.succeed(quit, undefined));
-    };
     const failed = (stage: (typeof DesktopFailed.Type)["stage"]) => {
       Effect.runSync(Deferred.fail(quit, new DesktopFailed({ stage })));
     };
-    const beforeQuit = (event: Electron.Event) => {
-      event.preventDefault();
-      stop();
-    };
-    app.on("before-quit", beforeQuit);
-    process.on("SIGTERM", stop);
-    process.on("SIGINT", stop);
-    yield* Effect.addFinalizer(() =>
-      Effect.sync(() => {
-        app.removeListener("before-quit", beforeQuit);
-        process.removeListener("SIGTERM", stop);
-        process.removeListener("SIGINT", stop);
-      }),
-    );
+    // Quitting while the data moved ends the app now, before any server starts.
+    if (yield* Deferred.isDone(quit)) return Option.none<() => void>();
     yield* Effect.raceFirst(
       Effect.gen(function* () {
-        yield* Effect.tryPromise({
-          try: () => app.whenReady(),
-          catch: () => new DesktopFailed({ stage: "window" }),
-        });
-        const browserSession = session.fromPartition("executor-desktop");
-        const windowOptions = {
-          width: 1180,
-          height: 800,
-          minWidth: 760,
-          minHeight: 540,
-          title: "Executor",
-          show: false,
-          webPreferences: {
-            backgroundThrottling: false,
-            session: browserSession,
-            sandbox: true,
-            contextIsolation: true,
-            nodeIntegration: false,
-            webSecurity: true,
-          },
-        };
-
         let view: View = { kind: "starting" };
         let everReady = false;
         let window: BrowserWindow | undefined;
-        let pendingOAuthState: string | undefined;
         const origin = () => (view.kind === "ready" ? view.origin : undefined);
         // The dashboard's copy buttons need clipboard writes; every other permission stays denied.
         browserSession.setPermissionRequestHandler((_contents, permission, callback, details) =>
@@ -203,113 +348,285 @@ const desktop = Effect.gen(function* () {
         };
         // A newer load supersedes an older one; only the current load's failure matters.
         let loads = 0;
-        const load = (current: BrowserWindow, url: string) => {
-          const generation = ++loads;
-          void current.loadURL(url).catch((error: unknown) => {
-            if (current.isDestroyed() || generation !== loads) return;
-            // The dashboard may be mid-restart. Its own failure can name its normalized or
-            // redirected URL, so any failure is reported.
-            if (!url.startsWith("data:")) {
-              run(Effect.logWarning("Desktop window could not load the dashboard"));
+        /** The page the window was last asked to show. */
+        let requested: string | undefined;
+        /** Dashboard loads that failed in a row, since one loaded or a server was joined. */
+        let dashboardFailures = 0;
+        /**
+         * Follow the window's load `generation` of the dashboard. One that fails, or does not
+         * finish in time, while it is still the window's current load is tried again with a fresh
+         * pairing link, since the one it used is spent; after `dashboardAttempts` the window shows
+         * the dashboard recovery page with the failure, whose Restart joins the server and loads
+         * the dashboard again. Its failure can name its normalized or redirected URL, so any
+         * failure counts, except a load that another navigation of the window replaced, such as an
+         * OAuth return, which shows its own page, also while a retry waits. A server that stops
+         * meanwhile is the connection's to follow (see `dashboardRetryDelay`). The failure's URL is
+         * never logged: it holds the link.
+         */
+        const followDashboard = (
+          current: BrowserWindow,
+          generation: number,
+          loading: Promise<void>,
+        ) =>
+          Effect.gen(function* () {
+            const outcome = yield* Effect.tryPromise({
+              try: () => loading,
+              catch: Schema.decodeUnknownOption(LoadError),
+            }).pipe(Effect.timeoutOption(dashboardLoadTimeout), Effect.result);
+            const replaced = () => current.isDestroyed() || generation !== loads;
+            if (replaced()) return;
+            if (Result.isSuccess(outcome) && Option.isSome(outcome.success)) {
+              dashboardFailures = 0;
               return;
             }
+            const error = Result.isFailure(outcome) ? outcome.failure : Option.none<LoadError>();
+            if (Option.isSome(error) && error.value.code === "ERR_ABORTED") return;
+            let failure = Result.isSuccess(outcome)
+              ? `it did not finish loading within ${Duration.toSeconds(dashboardLoadTimeout)} seconds`
+              : Option.match(error, {
+                  onNone: () => "its load failed",
+                  onSome: ({ code, errno }) => `${code} (${errno})`,
+                });
+            while (view.kind === "ready" && connection !== undefined) {
+              dashboardFailures += 1;
+              yield* Effect.logWarning("Desktop window could not load the dashboard").pipe(
+                Effect.annotateLogs({ failure, attempt: dashboardFailures }),
+              );
+              if (dashboardFailures >= dashboardAttempts)
+                return yield* showRecovery({
+                  stage: "dashboard",
+                  detail: `The Executor window could not load the dashboard from ${view.origin} ${dashboardFailures} times in a row. The last time: ${failure}.`,
+                });
+              yield* Effect.sleep(dashboardRetryDelay);
+              if (replaced()) return;
+              const pairing = yield* connection.pairWindow.pipe(Effect.option);
+              if (replaced() || view.kind !== "ready") return;
+              if (Option.isSome(pairing)) {
+                view = { ...view, pairing: pairing.value };
+                return showView();
+              }
+              failure = "the background Executor did not give the window a pairing link";
+            }
+          });
+        /** `loading` is the window's load of `url`, which it now shows. */
+        const follow = (current: BrowserWindow, url: string, loading: Promise<void>) => {
+          const generation = ++loads;
+          requested = url;
+          if (!url.startsWith("data:")) {
+            run(followDashboard(current, generation, loading));
+            return;
+          }
+          void loading.catch((error: unknown) => {
+            if (current.isDestroyed() || generation !== loads) return;
             // The app's own documents must load. Electron rejects a load when any main-frame load
             // fails before it finishes, also the replaced document's: on Windows a dashboard still
-            // loading when its server exits reports its abort after this page has committed. A
-            // data: document never redirects, so a failure naming another URL is not its own.
-            if (Schema.is(FailedLoad)(error) && !error.url.startsWith("data:")) return;
+            // loading when its server exits reports its abort after this page has committed, and
+            // so can a status page this one replaced before it finished. A data: document never
+            // redirects, so a failure naming another URL is not its own. Loading the same page
+            // again while it loads would make that abort name this URL, so a status page the
+            // window was last asked to show is never loaded again (see `showView`).
+            if (Schema.is(FailedLoad)(error) && error.url !== url) return;
             failed("window");
           });
         };
+        const load = (current: BrowserWindow, url: string) =>
+          follow(current, url, current.loadURL(url));
         const showView = () => {
-          if (window !== undefined && !window.isDestroyed()) load(window, viewUrl());
-        };
-
-        const openExternal = (value: string) => {
-          const url = externalUrl(value);
-          if (url === undefined) return;
-          const redirect = url.searchParams.get("redirect_uri");
-          const state = url.searchParams.get("state");
-          if (redirect === `${origin()}${OAuthCallbackPath}` && state !== null)
-            pendingOAuthState = state;
-          void shell.openExternal(url.href).catch(() => {
-            if (!Deferred.isDoneUnsafe(quit)) failed("oauth");
-          });
+          if (window === undefined || window.isDestroyed()) return;
+          const url = viewUrl();
+          // A status page the window already shows, or still loads, is not loaded again.
+          if (url.startsWith("data:") && url === requested) return;
+          load(window, url);
         };
         const showLogs = () =>
           shell.showItemInFolder(path.join(diagnostics, "executor-desktop.jsonl"));
+        const showRecovery = (recovery: DesktopRecovery) =>
+          Effect.gen(function* () {
+            yield* Effect.logWarning("Showing desktop recovery").pipe(
+              Effect.annotateLogs({
+                recovery: {
+                  stage: recovery.stage,
+                  ...("reason" in recovery ? { reason: recovery.reason } : {}),
+                },
+              }),
+            );
+            view = { kind: "recovery", recovery };
+            createWindow();
+            announceReplaced();
+          });
 
-        const supervisor = yield* makeSupervisor({
-          start: (token) =>
-            startBackend({
-              ...backendEntry,
-              port: source.kind === "setting" ? source.port : undefined,
-              collectorBundle: app.isPackaged
-                ? path.join(root, "packages/telemetry/dist/motel")
-                : path.join(__dirname, "motel"),
-              development: !app.isPackaged && process.argv.includes("--dev"),
-              token,
-            }),
-          quitting: Deferred.isDone(quit),
-          onStarting: Effect.sync(() => {
-            const shown = window !== undefined && !window.isDestroyed() ? window : undefined;
-            view = { kind: "starting" };
-            if (shown !== undefined && shown.webContents.getURL() !== startupUrl) showView();
-          }),
-          onReady: (backend, ready) =>
-            Effect.gen(function* () {
-              view = { kind: "ready", origin: ready, pairing: backend.pairingUrl(ready) };
-              everReady = true;
-              showView();
-              yield* backend.callbacks.pipe(
-                Stream.runForEach(({ url }) =>
-                  Effect.gen(function* () {
-                    const callback = new URL(Redacted.value(url));
-                    if (
-                      callback.origin !== ready ||
-                      callback.pathname !== OAuthCallbackPath ||
-                      pendingOAuthState === undefined ||
-                      callback.searchParams.get("state") !== pendingOAuthState
-                    )
-                      return;
-                    pendingOAuthState = undefined;
-                    const current = window;
-                    if (current === undefined || current.isDestroyed()) return;
-                    yield* Effect.tryPromise({
-                      try: () =>
-                        current.loadURL(callback.href, {
-                          extraHeaders: "x-executor-desktop-return: 1\r\n",
-                        }),
-                      catch: () => new DesktopFailed({ stage: "oauth" }),
-                    });
-                    current.show();
-                    current.focus();
-                  }),
+        // When the migration replaced the CLI's data, or changed its settings, say where they went,
+        // once, over the first page the window settles on: the dashboard, or recovery if no server
+        // runs. The migration's record keeps the notice until it has been shown, so a launch that
+        // ends first, as one quit while the data moved, leaves it for the next.
+        let replacedNotice =
+          Option.isSome(legacy) && Result.isSuccess(migration)
+            ? yield* pendingNotice(legacy.value).pipe(
+                Effect.catch((error) =>
+                  Effect.as(
+                    Effect.logWarning(
+                      "Could not read whether the moved data notice was shown",
+                      error,
+                    ),
+                    Option.none<MoveNotice>(),
+                  ),
                 ),
-                Effect.catch((error) => Deferred.fail(quit, error)),
-                Effect.forkScoped,
+              )
+            : Option.none<MoveNotice>();
+        const announceReplaced = () => {
+          if (Option.isNone(replacedNotice)) return;
+          const { archived, detail } = replacedNotice.value;
+          replacedNotice = Option.none();
+          run(
+            Effect.gen(function* () {
+              yield* Effect.logInfo("Showing the moved data notice").pipe(
+                Effect.annotateLogs({ archived }),
               );
-              yield* Effect.logInfo("Executor desktop ready").pipe(
-                Effect.annotateLogs({ origin: ready }),
+              const box: Electron.MessageBoxOptions = {
+                type: "info",
+                title: "Executor now shares its data with the CLI",
+                message: "Executor moved its data to the folder the Executor CLI uses.",
+                detail,
+                buttons: ["Show in folder", "OK"],
+                defaultId: 1,
+                cancelId: 1,
+              };
+              const parent = window;
+              const answer = yield* Effect.promise(() =>
+                parent === undefined || parent.isDestroyed()
+                  ? dialog.showMessageBox(box)
+                  : dialog.showMessageBox(parent, box),
               );
+              if (Option.isSome(legacy))
+                yield* noticeShown(process.platform, legacy.value).pipe(
+                  Effect.catch((error) =>
+                    Effect.logWarning(
+                      "Could not record that the moved data notice was shown",
+                      error,
+                    ),
+                  ),
+                );
+              if (answer.response === 0) shell.showItemInFolder(archived);
             }),
-          onRecovery: (recovery) =>
+          );
+        };
+
+        // The server, and the actions that use its data, exist once the data is in place.
+        const runtime = app.isPackaged
+          ? yield* packagedRuntime({
+              source: root,
+              staging: path.join(app.getPath("userData"), "runtime"),
+            })
+          : yield* developmentRuntime(root);
+        const connection: Connection | undefined = Result.isFailure(migration)
+          ? undefined
+          : yield* makeConnection({
+              directory,
+              runtime,
+              onStarting: Effect.sync(() => {
+                view = { kind: "starting" };
+                showView();
+              }),
+              // Shown in the window if one is open; a stop on purpose opens none.
+              onStopped: Effect.sync(() => {
+                view = { kind: "recovery", recovery: { stage: "stopped" } };
+                showView();
+              }),
+              onReady: ({ origin: ready, pairing }) =>
+                Effect.gen(function* () {
+                  view = { kind: "ready", origin: ready, pairing };
+                  everReady = true;
+                  dashboardFailures = 0;
+                  showView();
+                  yield* Effect.logInfo("Executor desktop ready").pipe(
+                    Effect.annotateLogs({ origin: ready }),
+                  );
+                  announceReplaced();
+                }),
+              onReturn: (url) =>
+                Effect.gen(function* () {
+                  const callback = new URL(Redacted.value(url));
+                  const current = window;
+                  if (
+                    callback.origin !== origin() ||
+                    callback.pathname !== OAuthCallbackPath ||
+                    current === undefined ||
+                    current.isDestroyed()
+                  )
+                    return;
+                  // It replaces the window's load, so a dashboard load waiting to be tried again
+                  // leaves it. With the header the server completes the callback, in the window's
+                  // session.
+                  loads += 1;
+                  requested = callback.href;
+                  yield* Effect.tryPromise({
+                    try: () =>
+                      current.loadURL(callback.href, {
+                        extraHeaders: `${desktopReturnHeader}: 1\r\n`,
+                      }),
+                    catch: () => new DesktopFailed({ stage: "oauth" }),
+                  }).pipe(
+                    Effect.catch(() =>
+                      Effect.logWarning("Desktop window could not load an OAuth return"),
+                    ),
+                  );
+                  current.show();
+                  current.focus();
+                }),
+              onRecovery: showRecovery,
+            });
+
+        /**
+         * The server keeps the callback of an OAuth authorization that returns to this window's
+         * origin for the desktop, so it must expect that callback before the browser opens.
+         */
+        const openExternal = (value: string) => {
+          const url = externalUrl(value);
+          if (url === undefined) return;
+          const state = url.searchParams.get("state");
+          const current = origin();
+          const returns =
+            current !== undefined &&
+            url.searchParams.get("redirect_uri") === `${current}${OAuthCallbackPath}`;
+          run(
             Effect.gen(function* () {
-              yield* Effect.logWarning("Showing desktop recovery").pipe(
-                Effect.annotateLogs({ recovery }),
+              if (returns && state !== null && connection !== undefined) {
+                const expected = yield* connection.expectReturn(state).pipe(Effect.result);
+                if (Result.isFailure(expected)) {
+                  yield* Effect.logWarning("The background Executor did not expect the sign-in");
+                  yield* Effect.promise(() =>
+                    dialog.showMessageBox({
+                      type: "error",
+                      message: "Executor could not start this sign-in.",
+                      detail:
+                        "Its local server did not answer. Wait for Executor to finish starting, then try again.",
+                    }),
+                  );
+                  return;
+                }
+              }
+              yield* Effect.tryPromise(() => shell.openExternal(url.href)).pipe(
+                Effect.catch(() =>
+                  Effect.sync(() => {
+                    if (!Deferred.isDoneUnsafe(quit)) failed("oauth");
+                  }),
+                ),
               );
-              view = { kind: "recovery", recovery };
-              createWindow();
             }),
-        });
-        const reset = yield* makeResetAction({
-          supervisor,
-          directory,
-          backups,
-          appVersion: app.getVersion(),
-          whileMoving: log.whileMoving,
-          window: () => window,
-        });
+          );
+        };
+
+        const reset =
+          connection !== undefined && Option.isSome(log)
+            ? yield* makeResetAction({
+                connection,
+                directory,
+                backups,
+                appVersion: app.getVersion(),
+                whileMoving: log.value.whileMoving,
+                window: () => window,
+              })
+            : undefined;
 
         const recover = (current: BrowserWindow, url: string) => {
           const action = recoveryAction(url);
@@ -322,12 +639,14 @@ const desktop = Effect.gen(function* () {
           )
             return;
           switch (action.value) {
+            case "start":
             case "restart":
-              return run(supervisor.start);
+              // A failed migration runs again when the app starts again.
+              return connection === undefined ? after(relaunch) : run(connection.start);
             case "logs":
               return showLogs();
             case "reset":
-              return run(reset);
+              return reset === undefined ? undefined : run(reset);
             case "quit":
               return stop();
           }
@@ -348,10 +667,12 @@ const desktop = Effect.gen(function* () {
             window.focus();
             return;
           }
-          const current = new BrowserWindow({
-            ...windowOptions,
-            backgroundColor: windowBackground(),
-          });
+          // The window that opened before the data moved, if it is still open, is set up first.
+          const adopted = early !== undefined && !early.isDestroyed() ? early : undefined;
+          const current = adopted ?? newWindow(browserSession);
+          const shownEarly = adopted === undefined ? undefined : earlyPage;
+          early = undefined;
+          current.webContents.removeListener("will-navigate", stay);
           window = current;
           if (process.argv.includes("--devtools"))
             current.webContents.openDevTools({ mode: "detach" });
@@ -364,7 +685,7 @@ const desktop = Effect.gen(function* () {
           });
           current.once("closed", () => {
             if (window === current) window = undefined;
-            // Closing the window before the server was ever ready ends the launch.
+            // Closing the window before the dashboard was ever ready ends the launch.
             if (!everReady) stop();
           });
           current.webContents.on("will-attach-webview", (event) => event.preventDefault());
@@ -411,8 +732,13 @@ const desktop = Effect.gen(function* () {
               ),
             );
           });
-          load(current, viewUrl());
+          // A page the early window already shows or still loads is not loaded again.
+          const url = viewUrl();
+          if (shownEarly !== undefined && shownEarly.url === url && !shownEarly.failed)
+            follow(current, url, shownEarly.loading);
+          else load(current, url);
         };
+        // Closing the last window quits the app on Windows and Linux; the server keeps running.
         const allClosed = () => {
           if (process.platform !== "darwin") stop();
         };
@@ -427,70 +753,79 @@ const desktop = Effect.gen(function* () {
             for (const current of BrowserWindow.getAllWindows()) current.destroy();
           }),
         );
-        const after = (
-          step: Effect.Effect<() => void, never, ChildProcessSpawner.ChildProcessSpawner>,
-        ) => {
-          Effect.runSync(Ref.set(afterStop, Option.some(step)));
-          stop();
-        };
-        const checkForUpdates = yield* makeUpdater((install) => after(Effect.succeed(install)));
+
+        const checkForUpdates = yield* makeUpdater(after);
         const openBrowser = yield* makeOpenBrowserAction(browserSession, origin);
-        const changePort = yield* makePortAction({
-          directory,
-          current: () => {
-            const current = origin();
-            return current === undefined ? undefined : Number(new URL(current).port);
-          },
-          source,
-          parent: () => window,
-          restart: () => after(Effect.succeed(relaunch)),
-        });
-        const rotateKey = yield* makeRotateKeyAction(() =>
-          after(rotateAfterStop(backendEntry).pipe(Effect.as(relaunch))),
-        );
         const exportDiagnostics = yield* makeExportDiagnosticsAction({
           directory,
           origin,
-          source,
+          portSource: portSource(directory, environmentPort).pipe(Effect.provideContext(services)),
         });
-        Menu.setApplicationMenu(
-          Menu.buildFromTemplate([
-            ...(process.platform === "darwin" ? [{ role: "appMenu" as const }] : []),
-            {
-              label: "File",
-              submenu: [
-                { label: "Open in browser", click: () => run(openBrowser) },
-                { type: "separator" },
-                { label: "Server port…", click: () => run(changePort) },
-                { label: "Rotate local API key…", click: () => run(rotateKey) },
-                { type: "separator" },
-                { role: process.platform === "darwin" ? "close" : "quit" },
-              ],
-            },
-            ...(app.isPackaged
-              ? [
-                  {
-                    label: "Updates",
-                    submenu: [{ label: "Check for updates…", click: () => run(checkForUpdates) }],
+        const dataActions =
+          connection === undefined
+            ? []
+            : yield* Effect.gen(function* () {
+                const changePort = yield* makePortAction({
+                  directory,
+                  platform: process.platform,
+                  environment: environmentPort,
+                  current: () => {
+                    const current = origin();
+                    return current === undefined ? undefined : Number(new URL(current).port);
                   },
-                ]
-              : []),
-            { role: "editMenu" },
-            { role: "viewMenu" },
-            { role: "windowMenu" },
-            {
-              role: "help",
-              submenu: [
-                { label: "Show diagnostics folder", click: () => void shell.openPath(diagnostics) },
-                { label: "Export diagnostics…", click: () => run(exportDiagnostics) },
-                { type: "separator" },
-                { label: "Reset Executor data…", click: () => run(reset) },
-              ],
-            },
-          ]),
+                  parent: () => window,
+                  restart: () => run(connection.whileStopped(Effect.void).pipe(Effect.ignore)),
+                });
+                const rotate = connection
+                  .whileStopped(
+                    Effect.flatMap(runtime.program, ({ command, env }) =>
+                      rotateKey({ command, env, directory }),
+                    ),
+                  )
+                  .pipe(
+                    Effect.catch((error) =>
+                      Effect.succeed({
+                        rotated: false,
+                        message:
+                          Schema.is(ServiceFailed)(error) && error.reason === "directory-in-use"
+                            ? `${error.message} The API key was not changed.`
+                            : "Executor's background server did not stop. The API key was not changed.",
+                      }),
+                    ),
+                    Effect.flatMap(announceRotation),
+                  );
+                const rotateKeyAction = yield* makeRotateKeyAction(() => run(rotate));
+                return [
+                  { type: "separator" as const },
+                  { label: "Server port…", click: () => run(changePort) },
+                  { label: "Rotate local API key…", click: () => run(rotateKeyAction) },
+                ];
+              });
+        Menu.setApplicationMenu(
+          applicationMenu({
+            file: [{ label: "Open in browser", click: () => run(openBrowser) }, ...dataActions],
+            updates: app.isPackaged
+              ? [{ label: "Check for updates…", click: () => run(checkForUpdates) }]
+              : [],
+            help: [
+              { label: "Show diagnostics folder", click: () => void shell.openPath(diagnostics) },
+              { label: "Export diagnostics…", click: () => run(exportDiagnostics) },
+              ...(reset === undefined
+                ? []
+                : [
+                    { type: "separator" as const },
+                    { label: "Reset Executor data…", click: () => run(reset) },
+                  ]),
+            ],
+          }),
         );
+        if (Result.isFailure(migration))
+          view = {
+            kind: "recovery",
+            recovery: { stage: "migration", detail: migration.failure.message },
+          };
         createWindow();
-        yield* supervisor.start;
+        if (connection !== undefined) yield* connection.start;
         return yield* Effect.never;
       }),
       Deferred.await(quit),
@@ -509,35 +844,37 @@ const desktop = Effect.gen(function* () {
           )
         : Effect.void,
     ),
-    Effect.provide(Logger.layer([Logger.withConsoleError(Logger.formatJson), log.logger])),
+    Effect.provide(
+      Logger.layer([
+        Logger.withConsoleError(Logger.formatJson),
+        ...Option.toArray(log).map(({ logger }) => logger),
+      ]),
+    ),
   );
 });
 
 if (!app.requestSingleInstanceLock()) app.quit();
 else
-  void Effect.runPromiseExit(
-    Effect.scoped(desktop).pipe(
-      // The step runs after the desktop scope closed, so the backend no longer holds its directory.
-      Effect.flatMap(Effect.transposeOption),
-      Effect.provide(NodeServices.layer),
-    ),
-  ).then((result) => {
-    if (Exit.isFailure(result)) {
-      const error = Cause.findErrorOption(result.cause);
-      const stage =
-        Option.isSome(error) && Schema.is(DesktopFailed)(error.value)
-          ? error.value.stage
-          : "configuration";
-      console.error(`Executor desktop failed at ${stage}.`);
-      // Server failures show the recovery page and a renderer crash loop has its own box.
-      if (stage !== "renderer")
-        dialog.showErrorBox(
-          "Executor could not continue",
-          app.isPackaged
-            ? "The Executor window stopped. Restart Executor Preview."
-            : "The Executor window stopped. Restart with bun run desktop:dev.",
-        );
-    }
-    if (Exit.isSuccess(result) && Option.isSome(result.value)) result.value.value();
-    else app.exit(Exit.isFailure(result) ? 1 : 0);
-  });
+  void Effect.runPromiseExit(Effect.scoped(desktop).pipe(Effect.provide(NodeServices.layer))).then(
+    (result) => {
+      if (Exit.isFailure(result)) {
+        const error = Cause.findErrorOption(result.cause);
+        const stage =
+          Option.isSome(error) && Schema.is(DesktopFailed)(error.value)
+            ? error.value.stage
+            : "configuration";
+        console.error(`Executor desktop failed at ${stage}.`);
+        // Server failures show the recovery page and a renderer crash loop has its own box.
+        if (stage !== "renderer")
+          dialog.showErrorBox(
+            "Executor could not continue",
+            app.isPackaged
+              ? "The Executor window stopped. Restart Executor Preview."
+              : "The Executor window stopped. Restart with bun run desktop:dev.",
+          );
+      }
+      // The step runs after the desktop scope closed, once every window is gone.
+      if (Exit.isSuccess(result) && Option.isSome(result.value)) result.value.value();
+      else app.exit(Exit.isFailure(result) ? 1 : 0);
+    },
+  );
diff --git a/apps/local/desktop/src/server.ts b/apps/local/desktop/src/server.ts
deleted file mode 100644
index bc02a434e0..0000000000
--- a/apps/local/desktop/src/server.ts
+++ /dev/null
@@ -1,150 +0,0 @@
-/** Desktop backend composition edge. The Electron parent owns this process and both private pipes. */
-import { createWriteStream } from "node:fs";
-import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
-import * as NodeServices from "@effect/platform-node/NodeServices";
-import { Console, Effect, Redacted, Schema } from "effect";
-import { HttpServerRequest, HttpServerResponse } from "effect/http";
-import {
-  localConfiguration,
-  LocalConfigurationError,
-  rotateApiKey,
-} from "../../server/src/implementation/bootstrap.ts";
-import {
-  readDesktopBootstrap,
-  startLocalServer,
-  type LocalOAuthCallback,
-} from "../../server/src/node.ts";
-import {
-  DesktopCallback,
-  DesktopConfigurationFailed,
-  DesktopFailed,
-  RotationResult,
-} from "./contracts/desktop.ts";
-
-const server = Effect.gen(function* () {
-  const callbackPipe = yield* Effect.acquireRelease(
-    Effect.sync(() => {
-      const pipe = createWriteStream("", { fd: 4, autoClose: true });
-      // Write callbacks surface pipe failures through the request Effect.
-      pipe.on("error", () => {});
-      return pipe;
-    }),
-    (pipe) => Effect.sync(() => pipe.destroy()),
-  );
-  const send = (message: string) =>
-    Effect.tryPromise({
-      try: () =>
-        new Promise<void>((resolve, reject) =>
-          callbackPipe.write(`${message}\n`, (error) => (error ? reject(error) : resolve())),
-        ),
-      catch: () => new DesktopFailed({ stage: "oauth" }),
-    });
-  // The parent chooses its recovery actions from this reason; the message stays on stderr.
-  const settings = yield* localConfiguration(process.platform).pipe(
-    Effect.tapErrorTag("LocalConfigurationError", (error) =>
-      Schema.encodeEffect(Schema.fromJsonString(DesktopConfigurationFailed))({
-        version: 1,
-        configuration: error.reason,
-      }).pipe(Effect.flatMap(send), Effect.ignore),
-    ),
-  );
-  const bootstrap = yield* readDesktopBootstrap;
-  const development =
-    process.env.EXECUTOR_DESKTOP_DEV === "1"
-      ? yield* Effect.promise(() => import("../../server/src/implementation/development.ts")).pipe(
-          Effect.flatMap(({ developmentWeb }) =>
-            developmentWeb(settings, { cacheDir: ".local/vite-desktop" }),
-          ),
-        )
-      : undefined;
-  const oauthCallback: LocalOAuthCallback = (origin) => (page) =>
-    Effect.gen(function* () {
-      const request = yield* HttpServerRequest.HttpServerRequest;
-      // The server has already matched OAuthCallbackPath. HEAD and the desktop return render the SPA.
-      if (
-        request.method === "GET" &&
-        request.headers.host === new URL(origin).host &&
-        request.headers["x-executor-desktop-return"] !== "1"
-      ) {
-        if (request.url.length > 8192) return HttpServerResponse.empty({ status: 400 });
-        const callback = new URL(request.url, origin);
-        if (callback.search === "") return yield* page;
-        if (!callback.searchParams.has("state")) return HttpServerResponse.empty({ status: 400 });
-        return yield* Schema.encodeEffect(Schema.fromJsonString(DesktopCallback))({
-          version: 1,
-          url: Redacted.make(callback.href),
-        }).pipe(
-          Effect.flatMap(send),
-          Effect.as(
-            HttpServerResponse.text(
-              "<!doctype html><title>Executor</title><p>Return to Executor to finish connecting your account.</p>",
-              {
-                headers: {
-                  "content-type": "text/html; charset=utf-8",
-                  "cache-control": "no-store",
-                  "referrer-policy": "no-referrer",
-                  "content-security-policy": "default-src 'none'",
-                },
-              },
-            ),
-          ),
-          Effect.catch(() =>
-            Effect.succeed(
-              HttpServerResponse.text(
-                "Executor could not receive this sign-in. Return to the app and try again.",
-                { status: 503 },
-              ),
-            ),
-          ),
-        );
-      }
-      return yield* page;
-    });
-  const local = yield* startLocalServer(settings, bootstrap, {
-    product: "desktop",
-    web: development,
-    oauthCallback,
-  });
-  yield* Console.log(JSON.stringify({ version: 1, url: local.url }));
-  return yield* Effect.never;
-});
-
-/** Replace the saved API key after the parent has stopped the server; report on stdout. */
-const rotation = rotateApiKey(process.platform).pipe(
-  Effect.as(RotationResult.make({ version: 1, rotated: true, message: "" })),
-  Effect.catch((error) =>
-    Effect.succeed(
-      RotationResult.make({
-        version: 1,
-        rotated: false,
-        message: Schema.is(LocalConfigurationError)(error)
-          ? error.message
-          : "Executor could not rotate the API key. The API key was not changed.",
-      }),
-    ),
-  ),
-  Effect.flatMap(Schema.encodeEffect(Schema.fromJsonString(RotationResult))),
-  Effect.flatMap(Console.log),
-  Effect.provide(NodeServices.layer),
-);
-
-if (process.argv.includes("--rotate-api-key")) NodeRuntime.runMain(rotation);
-else
-  NodeRuntime.runMain(
-    Effect.scoped(server).pipe(
-      Effect.provide(NodeServices.layer),
-      Effect.catch((error) =>
-        Console.error(
-          Schema.is(LocalConfigurationError)(error)
-            ? error.message
-            : "Executor desktop server could not start. Check its configuration.",
-        ).pipe(
-          Effect.andThen(
-            Effect.sync(() => {
-              process.exitCode = 1;
-            }),
-          ),
-        ),
-      ),
-    ),
-  );
diff --git a/apps/local/desktop/src/starter.ts b/apps/local/desktop/src/starter.ts
new file mode 100644
index 0000000000..b2d1763764
--- /dev/null
+++ b/apps/local/desktop/src/starter.ts
@@ -0,0 +1,92 @@
+/**
+ * The desktop's server starter, run in an Electron utility process. It starts or joins the
+ * background Executor for the desktop as the CLI does, reports the server over its parent port,
+ * and exits when the desktop says so.
+ *
+ * The desktop starts its server from here so that the server keeps none of the app's streams open.
+ * Electron's main process keeps its standard streams inheritable, and on Windows libuv starts each
+ * child with every inheritable handle of its parent. A server started from the main process would
+ * keep the desktop's stdout and stderr open after the desktop quits, so whatever waits for them to
+ * close, such as a launcher or a shell pipe, would wait until the server stopped. Chromium starts a
+ * utility process with only the handles it names, and Node there makes its standard streams
+ * non-inheritable. On Windows a server started here still inherits this process's end of its
+ * channel to the desktop, which Chromium creates inheritable; Electron still reports this process's
+ * exit. The desktop gives this process a deadline in case it hangs (see `starterDeadline` in
+ * `runtime.ts`). On Linux this process also holds descriptors from Chromium without close-on-exec,
+ * which Bash closes before the server starts, and which a server keeps where there is no /bin/bash
+ * (see `withoutInherited`); macOS starts each child with only the descriptors it names.
+ */
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Cause, Effect, Exit, Fiber, Option, Queue, Schema } from "effect";
+import { ensure } from "../../server/src/implementation/service-client.ts";
+import {
+  StarterAttempt,
+  StarterCommand,
+  StarterDirectoryFailed,
+  StarterReport,
+} from "./contracts/desktop.ts";
+
+const post = (encoded: unknown) => Effect.sync(() => process.parentPort.postMessage(encoded));
+
+const report = (message: StarterReport) =>
+  Schema.encodeEffect(StarterReport)(message).pipe(Effect.flatMap(post), Effect.orDie);
+
+const tell = (message: StarterAttempt) =>
+  Schema.encodeEffect(StarterAttempt)(message).pipe(Effect.flatMap(post), Effect.orDie);
+
+/** Say that a start attempt began, and later that it exited, for as long as this process runs. */
+const reportAttempt = ({
+  pid,
+  exited,
+}: {
+  readonly pid: number;
+  readonly exited: Effect.Effect<void>;
+}) =>
+  tell(StarterAttempt.cases.AttemptStarted.make({ pid })).pipe(
+    Effect.andThen(
+      Effect.forkDetach(
+        Effect.andThen(exited, tell(StarterAttempt.cases.AttemptExited.make({ pid }))),
+      ),
+    ),
+    Effect.asVoid,
+  );
+
+/** Start or join the server and report the outcome; a failure is reported, not raised. */
+const start = ({ directory, version, program }: typeof StarterCommand.cases.Start.Type) =>
+  ensure(directory, {
+    version,
+    program,
+    onStart: (started) => report(StarterReport.cases.Starting.make(started)),
+    onAttempt: reportAttempt,
+  }).pipe(
+    Effect.map((service) => StarterReport.cases.Ready.make(service)),
+    // The program names its version, so `ensure` never reads it from the configuration.
+    Effect.catchTag("ConfigError", Effect.die),
+    Effect.catchTag("PlatformError", () => Effect.fail(new StarterDirectoryFailed())),
+    Effect.catch((error) => Effect.succeed(StarterReport.cases.Failed.make({ error }))),
+    Effect.flatMap(report),
+  );
+
+const starter = Effect.gen(function* () {
+  const commands = yield* Queue.unbounded<unknown>();
+  process.parentPort.on("message", ({ data }) => {
+    Queue.offerUnsafe(commands, data);
+  });
+  const next = Queue.take(commands).pipe(
+    Effect.flatMap(Schema.decodeUnknownEffect(StarterCommand)),
+  );
+  const work = yield* StarterCommand.match(yield* next, {
+    Start: (request) => Effect.map(Effect.forkChild(start(request)), Option.some),
+    Stop: () => Effect.succeed(Option.none()),
+  });
+  if (Option.isNone(work)) return;
+  // Every later command ends the starter. The desktop sends one once it has the outcome, or when
+  // it no longer needs one; interrupting `ensure` asks the attempts it began to exit.
+  yield* next;
+  yield* Fiber.interrupt(work.value);
+});
+
+void Effect.runPromiseExit(starter.pipe(Effect.provide(NodeServices.layer))).then((exit) => {
+  if (Exit.isFailure(exit)) console.error(Cause.pretty(exit.cause));
+  process.exit(Exit.isSuccess(exit) ? 0 : 1);
+});
diff --git a/apps/local/server/README.md b/apps/local/server/README.md
index 3ecdfa2974..0b40a527bd 100644
--- a/apps/local/server/README.md
+++ b/apps/local/server/README.md
@@ -8,7 +8,7 @@ Its HTTP, MCP, dashboard, and app UI handlers call that public Effect API.
 
 Read these files in order:
 
-1. `src/bin.ts` runs the CLI; `src/main.ts` is the headless supervisor entry. Both use `src/node.ts` for one scoped local server.
+1. `src/bin.ts` runs the CLI; `src/main.ts` is the headless supervisor entry. Both serve through `src/implementation/server-process.ts`, which uses `src/node.ts` for one scoped local server.
 2. `src/implementation/server.ts` assembles storage, credentials, runtime and HTTP routes.
 3. `src/implementation/storage.ts` opens the native Effect SQL PGlite driver and initializes the fumadb-effect schema.
 4. `aesGcmCredentials` from `@executor-js/sdk/core` encrypts account fields with AES-GCM.
@@ -36,33 +36,37 @@ The repository scripts need no configuration. `scripts/local-dev.ts` keeps data
 and a development key pair in the checkout's ignored `.local/dev/`. `bun run server`
 and `bun run dev` listen behind the shared Portless proxy at
 `https://local.executor.localhost:5394`, or `https://local.<checkout>.executor.localhost:5394`
-in another checkout. `bun run executor` listens on `http://127.0.0.1:4312`.
-Variables that you set win over these defaults. For example:
+in another checkout. `bun run executor` starts or joins the
+[background service](#background-service) for `.local/dev/local` on
+`http://127.0.0.1:4312` and exits; that server keeps running until
+`bun run executor service stop`. Variables that you set win over these defaults.
+For example:
 
 ```sh
 curl -H "Authorization: Bearer $(node -p 'require("./.local/dev/keys.json").apiKey')" \
   https://local.executor.localhost:5394/v1/apps
 ```
 
-Press Ctrl+C to stop. Package-level `bun run start` reads its existing process
-environment only. Relative data paths are resolved from the process working
-directory. `bun run with:local …` loads 1Password values instead; see
+Press Ctrl+C to stop `bun run server` or `bun run dev`. Package-level
+`bun run start` reads its existing process environment only. Relative data paths
+are resolved from the process working directory. `bun run with:local …` loads
+1Password values instead; see
 [configuration](../../../README.md#development-configuration).
 
 ## Configuration
 
 | Variable                                | Meaning                                                                                                                                                                                     |
 | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `EXECUTOR_DATA_DIR`                     | Directory containing `executor.pglite/`, `browser-auth.pglite/`, and `builds/`; defaults to `.local/executor`.                                                                              |
-| `EXECUTOR_PORT`                         | Loopback listener port; defaults to `4312`.                                                                                                                                                 |
+| `EXECUTOR_DATA_DIR`                     | Directory containing `executor.pglite/`, `browser-auth.pglite/`, `builds/` and the [service files](#background-service); defaults to `.local/executor` (`~/.executor/v2/cli` in releases).  |
+| `EXECUTOR_PORT`                         | Loopback listener port; wins over the background service's `port` setting, then defaults to `4312`. `0` chooses any free port.                                                              |
 | `EXECUTOR_API_KEY`                      | Optional supplied bearer token; set with the encryption key. At least 32 characters.                                                                                                        |
 | `EXECUTOR_ENCRYPTION_KEY`               | Optional supplied AES key; set with the API key. Exactly 64 hexadecimal characters.                                                                                                         |
 | `EXECUTOR_KEY_STORAGE`                  | Optional key storage for a new directory: `file` for `keys.json`, `os` for the OS credential store without the key file fallback. See [Key storage](#key-storage).                          |
 | `EXECUTOR_MCP_TIMEOUT_MS`               | Catalog discovery plus program timeout; defaults to `300000`.                                                                                                                               |
 | `EXECUTOR_MCP_MAX_TOOL_CALLS`           | Admitted calls per execute, including search; defaults to `100`.                                                                                                                            |
-| `EXECUTOR_MCP_MAX_OUTPUT_BYTES`         | Result value/log truncation budget; defaults to `100000`. Protocol metadata and truncation markers add overhead.                                                                            |
 | `EXECUTOR_TOOL_LISTING_FRESH_SECONDS`   | Reuse an app's evaluated tool list this long before refreshing it in the background; defaults to `30`.                                                                                      |
-| `EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS` | Never serve an evaluated tool list older than this; `0` evaluates every list. Defaults to `60`.                                                                                             |
+| `EXECUTOR_TOOL_LISTING_RENEW_SECONDS`   | Renew the tool lists search serves in the background once they are this old; defaults to `86400`.                                                                                           |
+| `EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS` | Never serve an evaluated tool list older than this; `0` evaluates every list. Defaults to `604800`.                                                                                         |
 | `EXECUTOR_TOOL_LISTING_LOAD_SECONDS`    | Stop evaluating an app's tool list after this long when no request is waiting for it; defaults to `45`.                                                                                     |
 | `EXECUTOR_EVALUATION_MEMORY_MB`         | Memory for kept tool lists and app declarations; defaults to `256`.                                                                                                                         |
 | `EXECUTOR_APP_WORKERS`                  | Most app and data Workers kept loaded; defaults to `64`. Idle ones above it unload and reload on their next call. An app with a database runs its calls in a data Worker, which counts too. |
@@ -122,23 +126,173 @@ A refused key setup reports one reason: `credential-unavailable` (the
 directory needs an OS store and there is none), `credential-denied`,
 `credential-missing`, `invalid` (a damaged record or key), `misconfigured`
 (`EXECUTOR_KEY_STORAGE` or supplied keys cannot apply to this directory),
-`locked` or `io`. The desktop backend also sends that reason on its private fd4
-pipe so the desktop can choose recovery actions.
+`locked` or `io`. The desktop receives that reason too, so it can choose
+recovery actions.
 
 `executor rotate-key` replaces the saved API key in place, in the OS credential
 store or `keys.json`, and keeps the encryption key, so saved accounts and MCP
 sign-ins keep working. The record is unchanged. A running server keeps using its
-current key until it restarts; the next start also updates the managed Executor
-account. Rotation refuses supplied keys, a directory without saved keys, and a
+current key until it restarts (`executor service restart`); the next start also
+updates the managed Executor account. Rotation refuses supplied keys, a directory without saved keys, and a
 store that is locked or denied, and changes nothing in those cases.
 Account-connection links signed with the old key stop working.
 
 SDK routes, including `/mcp` and `/openapi.json`, require `Authorization: Bearer …`.
+The running server's `server.json` password is accepted wherever the API key is.
 The local token grants access to the whole local instance. Owner filters do not
 represent user authentication. SDK and MCP requests with a browser `Origin`
 header are rejected. Dashboard data requires the same bearer key and permits
 only the configured loopback origin when an `Origin` header is present.
 
+## Background service
+
+One server serves each data directory, and every local client shares it.
+`src/contracts/service.ts` is the contract, `service-client.ts` finds, starts
+and stops the server, and `server-process.ts` runs it. Nothing is installed with
+the OS: no system service, no login item and no idle exit. The server runs until
+something stops it, so after a reboot MCP clients get connection refused until
+something runs `executor` or `executor service start`.
+
+- `executor` starts or joins the server, pairs the browser through
+  `POST /auth/pair`, prints the Executor, MCP and Connect lines, opens the link
+  and exits. It replaces a server that runs another version, as
+  `executor service restart` does. `executor pair`, `executor apps` without
+  `--host` or `EXECUTOR_HOST`, and `executor service start` use whatever version
+  runs. `executor pair` waits up to 30 seconds for a registered server that is
+  still starting or stopping, or that holds the data directory without
+  answering.
+- The CLI prints or opens a connection link only when it is an `http` or
+  `https` URL without credentials in it. A link from the CLI's own server, the
+  background or private one, must also be on that server's URL or its HTTPS
+  `EXECUTOR_BROWSER_ORIGIN`; anything else fails as an unexpected response.
+- `executor serve` runs the server in the foreground and registers it the same
+  way, so other clients use it while it runs.
+- `executor --standalone` runs a private, unregistered `serve --stdio` child on a
+  free port for as long as the command runs. It keeps the child's stderr until
+  the child is ready, so a refusal reports the child's own reason. The command
+  fails, saying how, if the child stops first. When the command ends it closes
+  the child's stdin and gives it five seconds to stop before the child is
+  killed, which on Windows skips its cleanup.
+  `executor --server <url>` pairs with a server elsewhere, sending
+  `EXECUTOR_API_KEY` or the saved API key.
+- `executor service start|stop|restart|status|get|set|unset` manages it.
+  `status` prints `starting` before the address while the registered server
+  boots, `stopping` once it is asked to stop, and `not responding` while its
+  info request times out but its process still runs, as a hung or suspended
+  server's does. The settings are `port`, `env`
+  (`set env <name> <value>`, `unset env <name>`) and `disabled`. `disabled`
+  makes `executor` and `executor apps` without `--host` or `EXECUTOR_HOST` run
+  a private server, as `--standalone` does; `executor service start`,
+  `executor pair` and the desktop still use the background server. Changing
+  `port` or `env`, or setting `disabled`, saves the setting and then stops the
+  server, so whichever client starts it next, even at once, starts it with the
+  new settings. The desktop then shows that it was stopped and starts none
+  itself.
+- `executor apps` without `--host` reports a local server that cannot start like
+  its other failures: code `LocalServerUnavailable`, and JSON on stdout when
+  stdout is not a terminal.
+- `executor upgrade` and `--rollback` stop the registered server before a
+  standalone install switches versions, which removes older version
+  directories, or before the package manager runs, which replaces the installed
+  files. Afterwards they run the new version's `executor service start`. A
+  target that refuses `executor service status`, as a release from before the
+  background service does, gets no restart; the upgrade says to run
+  `executor serve` there instead. A failed or interrupted upgrade starts the
+  server again with this CLI. When the server does not stop, a standalone
+  switch keeps its version directory, and an npm, pnpm, Bun or Yarn upgrade
+  stops with `service-running`. A server from a development build is left
+  running.
+- A registered server stops itself, removing its registration, once its
+  executable is no longer the file it started from: every 5 seconds it compares
+  the device, inode, size and modification time of the release executable, or
+  of the Node or Bun that runs the CLI, with those at its start. `brew upgrade`,
+  `npm i -g` and the install script remove or replace that file without asking
+  the server to stop, which would leave it serving from deleted runtime files;
+  the next client then starts the installed version. The install scripts also
+  stop the registered server through the installed `executor service stop`
+  before they replace or prune a version. On Windows a running executable
+  cannot be replaced or removed, so `npm i -g` fails while the server runs.
+
+The port is `EXECUTOR_PORT`, then the `port` setting, then `4312`. A client
+starts detached `serve --service` processes with its own environment (the
+desktop passes its own) plus `env` and the absolute data directory, and waits up
+to two minutes for one to answer. `EXECUTOR_API_KEY` and
+`EXECUTOR_ENCRYPTION_KEY` reach a server it starts, background or private, only
+when both are set; one alone is the client's credential, which it only sends as
+its bearer. A starting server that finds the port held by this directory's
+registered server exits quietly; one that finds another program there fails
+with `port-in-use` at once, and one that finds another Executor there waits up
+to 15 seconds for it to go, then fails saying another Executor holds it. The
+message names `EXECUTOR_PORT` when that chose the port.
+Once a client has its server, it sends SIGTERM to every process it started that
+did not become the registered server, so none can take the port later. A
+foreground or private server whose port this directory's registered server holds
+fails with `directory-in-use` and that server's URL, also when that server does
+not answer within a second but its process still runs. A server that cannot take
+the data directory's lock names the registered server's URL when that server
+proves it answers, or still runs without answering in time; otherwise the
+holder is unregistered, such as a
+`--standalone` server or the desktop moving data, which `executor service stop`
+cannot stop, and the message says so.
+
+The first start that writes `keys.json` prints which file it wrote on stderr,
+which nothing reads for a background server. `executor` and
+`executor service start` repeat that line when the data directory had no
+installation record before they started the server and has a `file` record
+after; they read only the record.
+
+Executor 2 servers before the background service wrote `server.json` as
+`{ pid, version?, url, command }` and took no `.server.lock`. While the process
+such a record names runs and an Executor answers `GET /auth/session` at its URL
+(or does not answer within two seconds), servers and clients refuse the data
+directory with `directory-in-use`, naming that process and its URL, instead of
+opening the same databases. A record whose process runs while nothing answers
+there, or something else does, was left by a killed server whose pid another
+program now has: it is ignored, with a line on stderr, until a server replaces
+it.
+
+| File           | Contents                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `server.json`  | The running server's `id`, `version`, `url`, `pid`, on Linux and macOS `started` and `boot` (its process, as `.server.lock` records it), and per-process `password`; `group` when it leads its own process group, as a background server does; `browserOrigin` when set. Mode `0600`, replaced atomically, removed on exit. A server stops once the file no longer names it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `service.json` | The `port`, `env` and `disabled` settings. Mode `0600`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `.server.lock` | Held for the server's lifetime, before storage opens, and by the desktop while it moves or resets data; `owner.json` inside names the holder's process by `pid`, on Linux and macOS with `started` and `boot`, on Windows with the `pipe` it listens on, and its `host` and, for messages, for a server, its loopback `port`. A second server fails with `directory-in-use`. `started` is the start time the operating system keeps: on Linux the clock ticks from boot, on macOS the second, read with `/bin/ps`. `boot` is Linux's boot ID with the reader's pid and time namespaces, and macOS's boot session UUID. A process reads its own as it reads any other process's, so the two are compared for equality. On Windows, Node and Bun read another process's start time only by starting a program such as PowerShell, which takes seconds on a busy machine, so nothing there starts a program to check a lock. The holder listens on a named pipe with a random name, `\\.\pipe\executor-lock-<random>`, from before it takes the lock until after it releases it. Windows removes the pipe as soon as that process exits, also when it is killed, and keeps it while the process is suspended. Opening it connects, or fails at once with EBUSY once a suspended holder's few pipe instances are taken, and both mean it runs; once it has exited, the pipe is not found. The pipe holds no file in the data directory open, so the desktop can rename the directory while it holds the lock. A lock whose owner can be checked is held, however stale its time, while that process runs, as a suspended or sleeping server does: its pid runs on this boot with that start time, or its pipe exists on the host that recorded it. It is taken over at once when that process has exited, also when its pid now names another program, whatever listens on its port. A lock without an owner, as one being taken, one owned on another boot, machine or time namespace, or recorded without a start time or pipe, and one whose owner's start time, this boot or pipe cannot be read now, is taken over once it is 30 seconds stale. A server that cannot read its own start time says so once, on stderr and in its diagnostics log; one that cannot listen on its pipe says so in its log. A takeover is decided once, under `.server.lock.takeover`, and renames the abandoned lock aside before removing it. A holder releases the lock only while `owner.json` still holds the record it wrote, so a host name change does not leave it behind. |
+
+`GET /api/service` answers before storage opens and needs no credential:
+`{ id, version, pid, status }`, with 503 and `starting` until every route is
+served, then 200 and `ready`, and 503 and `stopping` from when it is asked to
+stop, or starts closing, until it exits. A client waits for a stopping server
+to exit instead of joining it or counting it as lost, then starts one if it
+starts servers. Anyone on the machine can read those, so they do
+not identify the server. A client sends `?challenge=<random nonce>`, and a
+server with a password adds `proof`: the base64url HMAC-SHA256 of the nonce,
+keyed with its password. Clients, and a starting server checking who holds its
+port, trust `server.json` only when this route answers with its `id`, `pid`,
+`version` and a `proof` made with the password in that file, so a process that
+took the port after the server died cannot pass as it, and the password is
+never sent before the proof. `POST /api/service/stop` with the registration
+password as bearer shuts the server down gracefully; a server that does not
+exit then gets SIGTERM and SIGKILL. A server that only times out is signalled
+without being sent the password. Each signal goes only to a pid that runs on
+this boot with the start time `server.json` records, or on Windows that the data
+directory's lock names while its pipe exists, checked again before each;
+otherwise the server has exited and its pid may now name another program, or
+that cannot be told, so escalation stops and its registration is removed. A
+start also removes, without waiting, a registration whose process does not
+answer and has exited, or, when that cannot be told, as for one from another
+boot, no longer holds the data directory's lock with a refresh in the last 30
+seconds. A registration with
+`group` is signalled with its process group on POSIX, so its telemetry
+collector and app runtimes stop with it. Both routes refuse requests with an
+`Origin` header. The password changes with every server process, so do not give
+it to MCP clients.
+
+Known limitation: another machine's boot looks like an earlier boot of this
+one. With the data directory on a home directory shared by two machines, a
+client on the machine that does not run the server finds nothing at the
+registered loopback URL, so it removes the registration, and the server on the
+other machine then stops within five seconds. A lock owned on another boot
+stays held while it is refreshed, so the two never open the databases at once.
+
 ## Local dashboard
 
 For UI development, run `bun run dev` from the repository root. It starts the
@@ -156,16 +310,19 @@ bun run web:build
 bun run server
 ```
 
-`bun run executor` starts the server and opens a one-use connection link.
-`bun run executor serve` (or `bun run server`) prints the link without opening a
-browser. `bun run executor pair` prints a fresh link for the running server.
+`bun run executor` starts or joins the background server, opens a one-use
+connection link and exits. `bun run executor serve` (or `bun run server`) runs
+the server in the foreground and prints the link without opening a browser.
+`bun run executor pair` prints a fresh link for the registered server, sent the
+password from its `server.json`. `bun run dev` runs a private server that does
+not register, so `executor pair` cannot reach it; it holds `.local/dev/local`,
+so stop it before running `bun run executor`.
 A paired dashboard can also issue a new link through `POST /auth/pair`, with its
 session cookie and a valid local Origin. Executor desktop uses this for **File →
 Open in browser**. A bearer key alone still cannot mint a link from browser requests.
-Repository commands run TypeScript source through Node. The npm beta uses
-`executor`, `executor serve`, and `executor pair`, with data in
-`~/.executor/v2/cli`. Build it with `bun run release:cli`; see
-[release packaging](../../../scripts/releases/README.md).
+Repository commands run TypeScript source through Node. Released builds use the
+same commands with data in `~/.executor/v2/cli`. Build one with
+`bun run release:cli`; see [release packaging](../../../scripts/releases/README.md).
 
 The link expires after five minutes and is consumed once. Its token is carried
 in the URL fragment, removed from browser history before exchange, and replaced
@@ -192,35 +349,33 @@ See [reactive storage](../../../notes/reactive-storage.md) for runtime limits. D
 previews both use the local server origin. `src/dev.ts` owns Vite's lifetime;
 the production entry points do not load Vite.
 
-## Desktop startup foundation
-
-The desktop foundation lets a parent launch the same `src/bin.ts --bootstrap-fd 3` process
-with a private pipe at fd3. It sends a JSON `DesktopBootstrap` envelope:
-`{ "version": 1, "token": "<64 lowercase hex characters>" }`, then closes the pipe.
-The parent generates this ephemeral token; it is not a persistent API key.
+## Hosts and the desktop
 
-The server parses and bounds the pipe input, registers the one-use token, and
-writes a credential-free `ServerReady` line to stdout:
-`{ "version": 1, "url": "http://127.0.0.1:<port>" }`. The parent opens that URL with
-`/#pair=<token>` in its renderer, using the same cookie exchange as the browser.
-No token is sent in argv, environment variables, or readiness logs.
+`@executor-js/local-server/node` is the composition edge for the CLI's
+foreground, background and private servers. `listenLocal` binds `127.0.0.1` and
+serves the service routes at once, `lockDataDirectory` holds `.server.lock`, and
+only then does `composeLocalServer` open storage and serve the product.
+`startLocalServer` does all three for one private, unregistered server, as
+`bun run dev` does, and stops, like every server, if it loses the lock. Its
+Effect scope owns HTTP, persistence, and auth; closing it interrupts requests
+and closes retained connections. `EXECUTOR_PORT=0` chooses an available
+loopback port.
 
-`startLocalServer` is exported from `@executor-js/local-server/node` for in-process
-hosts. Its Effect scope owns HTTP, persistence, and auth; closing it interrupts
-requests and closes retained connections. `EXECUTOR_PORT=0` chooses an available
-loopback port. The fd3 protocol is exercised by a real child-process test. The
-[Electron desktop host](../desktop/README.md) now uses this server composition
-with its own entry, Vite middleware, and a private OAuth callback pipe. Run
-`bun run desktop:dev` from the repository root. Distribution packaging and
-a cross-process reconnect manager remain separate work.
+Executor desktop shares the same background service as the CLI. The
+[desktop README](../desktop/README.md) describes how it starts, pairs and
+recovers it. Run `bun run desktop:dev` from the repository root.
 
 ## Connect an MCP client
 
 - Transport: Streamable HTTP
-- URL: `http://127.0.0.1:4312/mcp`
-- Header: `Authorization: Bearer <EXECUTOR_API_KEY>`
+- URL: `http://127.0.0.1:4312/mcp`, or the port `executor service status` prints
+- Header: `Authorization: Bearer <API key>`, the saved local API key or `EXECUTOR_API_KEY`
 - Tools: `skills`, for app documents; `execute`, with a `code` string
 
+Do not configure a client with the `server.json` password, which changes every
+time the server starts. The client reaches the background server only while it
+runs; after a reboot, run `executor` or `executor service start` first.
+
 The server sends the Executor app's `executor` skill as its MCP instructions.
 Discover the Executor app with `skills({})`, then read that skill with
 `{ app: "executor", name: "executor" }` using its current slug. It links to
@@ -349,7 +504,7 @@ further importer work. Unsupported features fail explicitly before deploying.
 
 Local uses disk-persisted PGlite with the PostgreSQL schema and an in-process
 live coordinator. The host owns each database until shutdown. Only one server
-process may open a data directory. `fumadb-effect/pglite` configures the native
+process may open a data directory; `.server.lock` enforces this. `fumadb-effect/pglite` configures the native
 Effect driver to preserve UTC dates on machines outside UTC.
 
 Existing `executor.sqlite` and `browser-auth.sqlite` files are untouched and are
diff --git a/apps/local/server/src/bin.ts b/apps/local/server/src/bin.ts
index 3acdc59923..82b34f7414 100755
--- a/apps/local/server/src/bin.ts
+++ b/apps/local/server/src/bin.ts
@@ -6,18 +6,32 @@ import {
   appsCommand,
   describeAppFailure,
   encodeAppFailure,
+  LocalServerUnavailable,
   renderAppFailure,
 } from "@executor-js/app-management/cli";
 /** CLI composition root. Platform dependencies and raw process arguments stop here. */
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { Console, Effect, Option, Schema } from "effect";
+import { Cause, Config, Console, Effect, Option, Runtime, Schema } from "effect";
 import { CliError, Command } from "effect/cli";
+import {
+  ServiceFailed,
+  ServiceSettingInvalid,
+  serviceCommand,
+  serviceGetCommand,
+  serviceRestartCommand,
+  serviceSetCommand,
+  serviceStartCommand,
+  serviceStatusCommand,
+  serviceStopCommand,
+  serviceUnsetCommand,
+} from "./contracts/service.ts";
 import {
   LegacyCommand,
   PairFailed,
   executorCommand,
   legacyCommands,
+  legacyServiceCommands,
   pairCommand,
   rotateKeyCommand,
   serveCommand,
@@ -28,6 +42,19 @@ import { LocalConfigurationError, rotateApiKey } from "./implementation/bootstra
 import { launch } from "./implementation/launcher.ts";
 import { outdatedCli } from "./implementation/update-notice.ts";
 import { pair } from "./implementation/pair.ts";
+import { processOutput } from "./implementation/process-output.ts";
+import { serveProcess } from "./implementation/server-process.ts";
+import { ensure, standalone } from "./implementation/service-client.ts";
+import { readSettings, serviceDirectory } from "./implementation/service-files.ts";
+import {
+  serviceGet,
+  serviceRestart,
+  serviceSet,
+  serviceStart,
+  serviceStatus,
+  serviceStop,
+  serviceUnset,
+} from "./implementation/service-settings.ts";
 import { upgrade } from "./implementation/upgrade.ts";
 
 // The file that started the CLI shows how it was installed: the npm launcher, or the release
@@ -40,17 +67,76 @@ const launcherNode =
   (process.versions.bun === undefined ? process.versions.node : undefined);
 /** Failures whose message is written for the person running the command. */
 const explained = Schema.is(
-  Schema.Union([LocalConfigurationError, PairFailed, LegacyCommand, UpgradeFailed]),
+  Schema.Union([
+    LocalConfigurationError,
+    PairFailed,
+    LegacyCommand,
+    UpgradeFailed,
+    ServiceFailed,
+    ServiceSettingInvalid,
+  ]),
 );
 
-const cli = executorCommand.pipe(
-  Command.withHandler(({ bootstrapFd }) =>
-    launch(Option.isSome(bootstrapFd) ? "desktop" : "browser", process.platform, entry),
+/**
+ * App commands without --host or EXECUTOR_HOST use the background server, started if needed, or
+ * a private server for the command when the service is disabled. They send its password, or
+ * EXECUTOR_API_KEY when that is set. A local server that cannot start fails the command the way
+ * its other failures do, with the reason as JSON on stdout for programs.
+ */
+const localServer = Effect.gen(function* () {
+  const supplied = yield* Config.Redacted("EXECUTOR_API_KEY").pipe(Config.option);
+  const directory = yield* serviceDirectory;
+  const service =
+    (yield* readSettings(directory)).disabled === true
+      ? yield* standalone
+      : yield* ensure(directory, { version: "ignore" });
+  return { url: service.url, token: Option.getOrElse(supplied, () => service.password) };
+}).pipe(
+  Effect.mapError((error) =>
+    explained(error) ? new LocalServerUnavailable({ message: error.message }) : error,
   ),
+);
+
+const cli = executorCommand.pipe(
+  Command.withHandler((options) => processOutput.serve(launch(options, process.platform, entry))),
   Command.withSubcommands([
-    appsCommand(process.platform),
-    serveCommand.pipe(Command.withHandler(() => launch("headless", process.platform, entry))),
-    pairCommand.pipe(Command.withHandler(() => pair(process.platform))),
+    appsCommand(process.platform, localServer),
+    serveCommand.pipe(
+      Command.withHandler(({ service, stdio }) =>
+        Effect.gen(function* () {
+          if (service && stdio)
+            return yield* new CliError.UserError({ cause: "Use --service or --stdio, not both." });
+          return yield* processOutput.serve(
+            serveProcess({
+              mode: service ? "service" : stdio ? "stdio" : "foreground",
+              platform: process.platform,
+              ...(entry === undefined ? {} : { entry }),
+            }),
+          );
+        }),
+      ),
+    ),
+    serviceCommand.pipe(
+      Command.withSubcommands([
+        serviceStartCommand.pipe(Command.withHandler(() => serviceStart)),
+        serviceStopCommand.pipe(Command.withHandler(() => serviceStop)),
+        serviceRestartCommand.pipe(Command.withHandler(() => serviceRestart)),
+        serviceStatusCommand.pipe(Command.withHandler(() => serviceStatus)),
+        serviceGetCommand.pipe(Command.withHandler(serviceGet)),
+        serviceSetCommand.pipe(Command.withHandler((input) => serviceSet(process.platform, input))),
+        serviceUnsetCommand.pipe(
+          Command.withHandler((input) => serviceUnset(process.platform, input)),
+        ),
+        ...legacyServiceCommands.map((legacy) =>
+          legacy.pipe(
+            Command.withHandler(() =>
+              Effect.fail(new LegacyCommand({ command: `service ${legacy.name}` })),
+            ),
+          ),
+        ),
+      ]),
+    ),
+    pairCommand.pipe(Command.withHandler(() => pair)),
     upgradeCommand.pipe(
       Command.withHandler((options) =>
         upgrade(options, {
@@ -67,7 +153,7 @@ const cli = executorCommand.pipe(
         rotateApiKey(process.platform).pipe(
           Effect.andThen(
             Console.log(
-              "Rotated the local API key. Restart Executor to use it, then update clients that used the previous key.",
+              "Rotated the local API key. Run `executor service restart` to use it, then update clients that used the previous key.",
             ),
           ),
         ),
@@ -84,6 +170,9 @@ const cli = executorCommand.pipe(
 NodeRuntime.runMain(
   Command.run(cli, { version: process.env.EXECUTOR_BUILD_VERSION ?? "0.0.0-dev" }).pipe(
     Effect.scoped,
+    // A reader that closed the pipe, or output that cannot be written, ends a command that is not
+    // serving.
+    Effect.raceFirst(processOutput.closed),
     // Effect CLI renders argument errors and supplies the exit status for help.
     // Operational failures retain the launcher's sanitized message. An apps command failure
     // states the host's code, status, message and recovery, and also prints them as JSON on
@@ -111,6 +200,14 @@ NodeRuntime.runMain(
         });
       });
     }),
+    // runMain's own report of an unhandled failure, written through the console below.
+    Effect.tapCause((cause) =>
+      Cause.hasInterruptsOnly(cause) || !Runtime.getErrorReported(Cause.squash(cause))
+        ? Effect.void
+        : Effect.logError(cause),
+    ),
+    Effect.provideService(Console.Console, processOutput.console),
     Effect.provide(NodeServices.layer),
   ),
+  { disableErrorReporting: true, teardown: processOutput.teardown },
 );
diff --git a/apps/local/server/src/contracts/account-connections.ts b/apps/local/server/src/contracts/account-connections.ts
index cd15dfd18c..1bfedb37cf 100644
--- a/apps/local/server/src/contracts/account-connections.ts
+++ b/apps/local/server/src/contracts/account-connections.ts
@@ -1,3 +1,4 @@
+import { RequestRejection } from "@executor-js/sdk/core";
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 /** Local browser handoff. These grants authorize one SDK connection, never a dashboard session. */
 import { Schema } from "effect";
@@ -123,7 +124,7 @@ const scopeConnect = <const S extends AccountScope>(scope: S) =>
   );
 
 /** Browser submissions never accept an owner, provider, callback destination, or target account. */
-export const AccountConnectApi = HttpApi.make("account-connect").add(
+const accountConnectApi = HttpApi.make("account-connect").add(
   HttpApiGroup.make("accountConnect")
     .add(
       HttpApiEndpoint.post("issue", "/account-connect/api/requests", {
@@ -195,3 +196,5 @@ export const AccountConnectApi = HttpApi.make("account-connect").add(
       }),
     ),
 );
+/** Every endpoint answers a request its schema rejects with `RequestInvalid`. */
+export const AccountConnectApi = accountConnectApi.middleware(RequestRejection);
diff --git a/apps/local/server/src/contracts/auth.ts b/apps/local/server/src/contracts/auth.ts
index 9a988a3af9..273cd32154 100644
--- a/apps/local/server/src/contracts/auth.ts
+++ b/apps/local/server/src/contracts/auth.ts
@@ -1,7 +1,7 @@
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import { ApiError } from "@executor-js/utils/api-error";
-/** Local browser pairing and the private desktop bootstrap protocol. */
-import { Schema, type Effect } from "effect";
+/** Local browser pairing and the keys a local data directory keeps. */
+import { Config, Schema, type Effect } from "effect";
 import { AppId } from "@executor-js/sdk";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/http-api";
 
@@ -90,14 +90,6 @@ export const PairingLink = Schema.Struct({
   url: Schema.RedactedFromValue(Schema.String),
   expiresAt: Schema.Date,
 });
-/** Private pipe payload sent by a desktop parent, never command-line arguments or environment. */
-export const DesktopBootstrap = Schema.Struct({
-  version: Schema.Literal(1),
-  token: BootstrapToken,
-});
-export type DesktopBootstrap = typeof DesktopBootstrap.Type;
-/** Parent/CLI ready notification contains no credential. */
-export const ServerReady = Schema.Struct({ version: Schema.Literal(1), url: Schema.String });
 
 /** OS credential-store service. Each installation's entry uses its installation ID as the account. */
 export const LocalCredentialService = "com.usefulsoftware.executor.v2";
@@ -130,7 +122,21 @@ export const LocalConfigurationReason = Schema.Literals([
 ]);
 export type LocalConfigurationReason = typeof LocalConfigurationReason.Type;
 
-/** Shared contracts used by the local browser, CLI, and future desktop parent. */
+/**
+ * Key storage for a new data directory. Unset uses the OS credential store and falls back to
+ * `keys.json` only when there is no store; `os` never falls back; `file` always uses `keys.json`.
+ * Bootstrap applies it before `config`, and never uses it to switch an existing directory.
+ */
+export const KeyStorage = Schema.Literals(["os", "file"]);
+export type KeyStorage = typeof KeyStorage.Type;
+export const keyStorageConfig = Config.schema(KeyStorage, "EXECUTOR_KEY_STORAGE").pipe(
+  Config.option,
+);
+/** Why a server refuses another EXECUTOR_KEY_STORAGE value, before it writes anything. */
+export const keyStorageInvalid =
+  'EXECUTOR_KEY_STORAGE must be "file" (keep keys in keys.json) or "os" (OS credential store only), or unset. Nothing was changed.';
+
+/** Shared contracts used by the local browser, the CLI and Executor desktop. */
 export const LocalAuthApi = HttpApi.make("local-auth").add(
   HttpApiGroup.make("auth")
     .add(
diff --git a/apps/local/server/src/contracts/config.ts b/apps/local/server/src/contracts/config.ts
index baea4aaef6..559b04ef21 100644
--- a/apps/local/server/src/contracts/config.ts
+++ b/apps/local/server/src/contracts/config.ts
@@ -2,6 +2,7 @@
 import { UrlPolicy, defaultUrlPolicy, urlPolicyConfig } from "@executor-js/utils/url-policy";
 import { Config, Effect, Option, Schema } from "effect";
 import { McpLimits, defaultMcpLimits } from "@executor-js/mcp";
+import { dataDirectoryConfig, defaultPort } from "./service.ts";
 
 /** One explicit HTTPS origin for a private reverse proxy, without paths or credentials. */
 export const BrowserOrigin = Schema.String.check(
@@ -23,6 +24,11 @@ export const ServerConfig = Schema.Struct({
   encryptionKey: Schema.RedactedFromValue(
     Schema.String.check(Schema.isPattern(/^[a-fA-F0-9]{64}$/u)),
   ),
+  /**
+   * This process's background service password, random per process and accepted wherever the API
+   * key is. The process sets it after reading the environment; it is never configured.
+   */
+  password: Schema.optional(Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32)))),
   mcp: McpLimits.pipe(Schema.withDecodingDefault(Effect.succeed(defaultMcpLimits))),
   urlPolicy: UrlPolicy.pipe(Schema.withDecodingDefault(Effect.succeed(defaultUrlPolicy))),
   oauthClientMetadataUrl: Schema.optional(Schema.NonEmptyString),
@@ -32,14 +38,6 @@ export const ServerConfig = Schema.Struct({
 /** Parsed configuration, with secrets redacted at ingress. */
 export type ServerConfig = typeof ServerConfig.Type;
 
-/** The port a local server listens on when EXECUTOR_PORT is unset. */
-const defaultPort = 4312;
-
-/** The data directory, before it is resolved. The npm launcher defaults it to ~/.executor/v2/cli. */
-export const dataDirectoryConfig = Config.String("EXECUTOR_DATA_DIR").pipe(
-  Config.withDefault(".local/executor"),
-);
-
 /** Read the environment at process startup. Local defaults only apply to directory and port. */
 export const config = Config.all({
   directory: dataDirectoryConfig,
@@ -66,9 +64,6 @@ export const config = Config.all({
     maxToolCalls: Config.Number("EXECUTOR_MCP_MAX_TOOL_CALLS").pipe(
       Config.withDefault(defaultMcpLimits.maxToolCalls),
     ),
-    maxOutputBytes: Config.Number("EXECUTOR_MCP_MAX_OUTPUT_BYTES").pipe(
-      Config.withDefault(defaultMcpLimits.maxOutputBytes),
-    ),
   }),
 }).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.toType(ServerConfig))));
 
@@ -76,12 +71,11 @@ export const config = Config.all({
 export const serverPortConfig = Config.Port("EXECUTOR_PORT").pipe(Config.withDefault(defaultPort));
 
 /**
- * Key storage for a new data directory. Unset uses the OS credential store and falls back to
- * `keys.json` only when there is no store; `os` never falls back; `file` always uses `keys.json`.
- * Bootstrap applies it before `config`, and never uses it to switch an existing directory.
+ * The port a server listens on: EXECUTOR_PORT, then the background service's `port` setting, then
+ * 4312. 0 listens on any free port, as a private server does.
  */
-export const KeyStorage = Schema.Literals(["os", "file"]);
-export type KeyStorage = typeof KeyStorage.Type;
-export const keyStorageConfig = Config.schema(KeyStorage, "EXECUTOR_KEY_STORAGE").pipe(
-  Config.option,
-);
+export const listenPortConfig = (setting: number | undefined) =>
+  Config.schema(
+    Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 65535 })),
+    "EXECUTOR_PORT",
+  ).pipe(Config.withDefault(setting ?? defaultPort));
diff --git a/apps/local/server/src/contracts/dashboard.ts b/apps/local/server/src/contracts/dashboard.ts
index ae67e66cf5..ad7a605099 100644
--- a/apps/local/server/src/contracts/dashboard.ts
+++ b/apps/local/server/src/contracts/dashboard.ts
@@ -10,6 +10,7 @@ import {
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import { DashboardAppBrowser } from "./app-browser.ts";
 import { DashboardWorkflows, DashboardWebhooks } from "./resources.ts";
+import { RequestRejection } from "@executor-js/sdk/core";
 import { AccountChoiceUnsupported, ToolKind, ToolKindMismatch } from "@executor-js/sdk/core";
 import { AppWorkflowsActive, AccountWorkflowsActive } from "@executor-js/sdk/core";
 import { DashboardSchedules } from "./schedules.ts";
@@ -490,7 +491,7 @@ const toolErrors = [
 ] as const;
 
 /** Product operations share typed session protection; programmatic SDK routes remain separate. */
-export const DashboardApi = HttpApi.make("local-dashboard").add(
+const dashboardApi = HttpApi.make("local-dashboard").add(
   HttpApiGroup.make("dashboard")
     .add(
       HttpApiEndpoint.get("mcpInstallation", "/dashboard/api/mcp-installation", {
@@ -835,3 +836,5 @@ export const DashboardApi = HttpApi.make("local-dashboard").add(
   DashboardWebhooks.middleware(DashboardAccess),
   DashboardMcpConnections.middleware(DashboardAccess),
 );
+/** Every endpoint answers a request its schema rejects with `RequestInvalid`. */
+export const DashboardApi = dashboardApi.middleware(RequestRejection);
diff --git a/apps/local/server/src/contracts/desktop-return.ts b/apps/local/server/src/contracts/desktop-return.ts
new file mode 100644
index 0000000000..6e3312aa2f
--- /dev/null
+++ b/apps/local/server/src/contracts/desktop-return.ts
@@ -0,0 +1,47 @@
+/**
+ * OAuth returns for Executor desktop. The desktop opens a provider's consent page in the system
+ * browser, and the provider sends that browser back to this server's callback. For a state the
+ * desktop said it expects, the server keeps the callback for the desktop and asks the person to
+ * return to the app, which loads the callback in its own window with its own session. Callbacks
+ * for any other state, including every OAuth a browser starts, complete in the browser as before.
+ */
+import { Schema } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/http-api";
+import { AuthForbidden, PairingUnauthorized } from "./auth.ts";
+
+/** The desktop sends this header when it loads a kept callback, so the callback completes. */
+export const desktopReturnHeader = "x-executor-desktop-return";
+
+/** At most this many expected states and kept callbacks; the oldest goes first. */
+export const desktopReturnLimit = 16;
+/** An expected state, or a kept callback, is forgotten after this long. */
+export const desktopReturnLifetimeMillis = 15 * 60_000;
+/** How long one `next` request waits for a callback before it answers with none. */
+export const desktopReturnWaitMillis = 20_000;
+
+/** The `state` parameter of an OAuth authorization the desktop opened in the browser. */
+export const DesktopReturnState = Schema.String.check(
+  Schema.isMinLength(1),
+  Schema.isMaxLength(1024),
+);
+
+/** A provider callback for an expected state. It holds an authorization code: never log it. */
+export const DesktopReturn = Schema.Struct({ url: Schema.RedactedFromValue(Schema.String) });
+export type DesktopReturn = typeof DesktopReturn.Type;
+
+/** Programmatic routes: a local credential as the bearer, and no browser Origin. */
+export const DesktopReturnApi = HttpApi.make("desktop-return").add(
+  HttpApiGroup.make("desktopReturns")
+    .add(
+      HttpApiEndpoint.post("expect", "/api/desktop/oauth-returns", {
+        payload: Schema.Struct({ state: DesktopReturnState }),
+        error: [AuthForbidden, PairingUnauthorized],
+      }),
+    )
+    .add(
+      HttpApiEndpoint.get("next", "/api/desktop/oauth-returns", {
+        success: Schema.Struct({ returns: Schema.Array(DesktopReturn) }),
+        error: [AuthForbidden, PairingUnauthorized],
+      }),
+    ),
+);
diff --git a/apps/local/server/src/contracts/feedback.ts b/apps/local/server/src/contracts/feedback.ts
index d800f8d1ae..381d3ea0bb 100644
--- a/apps/local/server/src/contracts/feedback.ts
+++ b/apps/local/server/src/contracts/feedback.ts
@@ -1,4 +1,5 @@
 /** Feedback from agents and people using this local Executor; local has no organizations. */
+import { RequestRejection } from "@executor-js/sdk/core";
 import {
   Feedback,
   FeedbackDisabled,
@@ -8,7 +9,7 @@ import { Schema } from "effect";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
 
 /** The same `feedback.submit` operation as hosted Executor, without an organization parameter. */
-export const LocalFeedbackApi = HttpApi.make("local-feedback").add(
+const localFeedbackApi = HttpApi.make("local-feedback").add(
   HttpApiGroup.make("feedback").add(
     HttpApiEndpoint.post("submit", "/v1/feedback", {
       payload: Feedback,
@@ -22,3 +23,5 @@ export const LocalFeedbackApi = HttpApi.make("local-feedback").add(
       ),
   ),
 );
+/** Every endpoint answers a request its schema rejects with `RequestInvalid`. */
+export const LocalFeedbackApi = localFeedbackApi.middleware(RequestRejection);
diff --git a/apps/local/server/src/contracts/management.ts b/apps/local/server/src/contracts/management.ts
index ef9b046c9d..9c4d8f1c67 100644
--- a/apps/local/server/src/contracts/management.ts
+++ b/apps/local/server/src/contracts/management.ts
@@ -1,7 +1,7 @@
 import { DashboardApi } from "./dashboard.ts";
 import { LocalAppManagementApi, LocalFrameworkApi } from "./app-management.ts";
 /** The local agent-facing API, projected from the contracts that serve its requests. */
-import { ExecutorApi } from "@executor-js/sdk/core";
+import { ExecutorApi, RequestRejection } from "@executor-js/sdk/core";
 import { HttpApi, HttpApiGroup, OpenApi } from "effect/http-api";
 import { AccountConnectApi } from "./account-connections.ts";
 import { LocalWebhookSetupApi } from "./webhook-setup.ts";
@@ -80,6 +80,16 @@ const api = HttpApi.make("local-management")
 
 /** Browser secret exchange, raw delivery, subscriptions and approval protocols are not management tools. */
 export const localManagementDocument = (): OpenApi.OpenAPISpec => {
+  // Agents read each operation's declared errors; an undeclared 400 reaches them without its cause.
+  HttpApi.reflect(api, {
+    onGroup: () => {},
+    onEndpoint: ({ endpoint, group, middleware }) => {
+      if (![...middleware].some((service) => service.key === RequestRejection.key))
+        throw new Error(
+          `Management API endpoint ${group.identifier}.${endpoint.identifier} must declare request rejections.`,
+        );
+    },
+  });
   const document = OpenApi.fromApi(api);
   return {
     ...document,
diff --git a/apps/local/server/src/contracts/server.ts b/apps/local/server/src/contracts/server.ts
index c798146b95..1d4f5b6d44 100644
--- a/apps/local/server/src/contracts/server.ts
+++ b/apps/local/server/src/contracts/server.ts
@@ -3,19 +3,7 @@ import type { HostPipeline } from "@executor-js/dashboard-start/in-process";
 import type { Effect, Layer } from "effect";
 import type { LocalAuth } from "../implementation/auth.ts";
 import type { ServerConfig } from "./config.ts";
-import type { HttpPlatform, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
-
-/** Wrap an HTTP handler while preserving its errors and required services. */
-export type LocalHttpMiddleware = <E, R>(
-  handler: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
-) => Effect.Effect<
-  HttpServerResponse.HttpServerResponse,
-  E,
-  R | HttpServerRequest.HttpServerRequest
->;
-
-/** Customize only the already-matched provider callback; origin comes from the bound listener. */
-export type LocalOAuthCallback = (origin: string) => LocalHttpMiddleware;
+import type { HttpPlatform, HttpRouter, HttpServerResponse } from "effect/http";
 
 /** A request handler mounted by the local server's native route table. */
 export type LocalHttpHandler = Effect.Effect<
@@ -37,13 +25,15 @@ export interface LocalWeb {
   readonly fallback: LocalHttpHandler;
 }
 
-/** The product and optional adapters owned by the CLI or desktop composition. */
+/** The product and optional adapters owned by the CLI composition. */
 export interface LocalServerOptions {
-  /** The product reported by analytics: the CLI or the desktop backend. */
-  readonly product: "cli" | "desktop";
+  /**
+   * The product reported by analytics. Every local server is the CLI's, including the background
+   * server Executor desktop joins.
+   */
+  readonly product: "cli";
   /** The Node edge supplies its platform names for analytics. */
   readonly platform?: { readonly os: string; readonly arch: string } | undefined;
-  readonly oauthCallback?: LocalOAuthCallback | undefined;
   readonly web?: LocalWeb | undefined;
   /** Only the development entry point supplies local session shortcuts. */
   readonly devtools?: (
diff --git a/apps/local/server/src/contracts/service.ts b/apps/local/server/src/contracts/service.ts
new file mode 100644
index 0000000000..b677d8a846
--- /dev/null
+++ b/apps/local/server/src/contracts/service.ts
@@ -0,0 +1,259 @@
+/**
+ * The background service: one Executor server per data directory, shared by every local client.
+ *
+ * A server that owns its port and data directory advertises itself in `server.json`. That file is
+ * the whole discovery contract: a client reads it, asks the unauthenticated info route whether that
+ * process answers, and uses the per-process password for everything else. `service.json` holds the
+ * settings a background server starts with. Adapted from OpenCode's service model
+ * (MIT, Copyright (c) 2025 opencode).
+ */
+import { Config, Schema } from "effect";
+import { Argument, Command, Flag } from "effect/cli";
+import { LocalConfigurationReason } from "./auth.ts";
+
+/** The data directory, before it is resolved. The npm launcher defaults it to ~/.executor/v2/cli. */
+export const dataDirectoryConfig = Config.String("EXECUTOR_DATA_DIR").pipe(
+  Config.withDefault(".local/executor"),
+);
+
+/** The port a local server listens on when neither EXECUTOR_PORT nor the `port` setting is set. */
+export const defaultPort = 4312;
+/** Written by a running server in its data directory, mode 0600, replaced atomically. */
+export const serviceRegistrationFile = "server.json";
+/** Background service settings in the data directory, mode 0600. */
+export const serviceSettingsFile = "service.json";
+/** Held for a server's whole lifetime, so two servers never open one data directory. */
+export const serviceLockFile = ".server.lock";
+/** Unauthenticated identity and readiness of the server answering on a port. */
+export const serviceInfoPath = "/api/service";
+/** Ask the server to shut down gracefully; requires the registration password. */
+export const serviceStopPath = "/api/service/stop";
+/** Carries a parent-generated password to a `serve --stdio` child; the child removes it. */
+export const servicePasswordVariable = "EXECUTOR_SERVICE_PASSWORD";
+
+const Pid = Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0));
+const Port = Schema.Number.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: 65535 }));
+
+/** `server.json`: which process serves this data directory and how to reach it. */
+export const ServiceRegistration = Schema.Struct({
+  /** Unique per server process; distinguishes a restart that reused a pid. */
+  id: Schema.String,
+  /** `EXECUTOR_BUILD_VERSION`, or `0.0.0-dev` for development builds. */
+  version: Schema.String,
+  /** Loopback base URL, `http://127.0.0.1:<port>`. */
+  url: Schema.String,
+  pid: Pid,
+  /**
+   * When that process started and on which boot, as its operating system records them, so a pid
+   * another program has since been given is never taken for it. Absent when they could not be read,
+   * and on Windows, where the pipe the data directory's lock records names the process instead.
+   */
+  started: Schema.optional(Schema.String),
+  boot: Schema.optional(Schema.String),
+  /** Random per process. Accepted wherever the local API key is accepted. */
+  password: Schema.String,
+  /**
+   * The server leads its own process group, as a background server does, so stopping it signals
+   * the group: its telemetry collector and app runtimes end with it. A foreground server shares
+   * its terminal's group and is signalled alone.
+   */
+  group: Schema.optional(Schema.Boolean),
+  /** `EXECUTOR_BROWSER_ORIGIN`, where its connection links point instead of `url`, when set. */
+  browserOrigin: Schema.optional(Schema.String),
+});
+export type ServiceRegistration = typeof ServiceRegistration.Type;
+
+/**
+ * `server.json` as Executor servers wrote it before the background service. Such a server holds no
+ * `.server.lock`, so while its process runs, no server or client may use the data directory.
+ */
+export const EarlierServerRecord = Schema.Struct({
+  pid: Pid,
+  version: Schema.optional(Schema.String),
+  url: Schema.String,
+  command: Schema.Literals(["executor", "executor serve"]),
+});
+
+/** `GET /api/service?challenge=<nonce>`: a fresh random nonce the server proves it can sign. */
+export const ServiceChallenge = Schema.String.check(Schema.isPattern(/^[\w-]{16,128}$/u));
+
+/**
+ * `GET /api/service` answers before storage opens: 503 with `starting` while the server boots,
+ * 200 with `ready` once every route is served, and 503 with `stopping` from when it is asked to
+ * stop, or starts closing, until it exits. Anyone on the machine can read `id`, `pid` and
+ * `version`, so they prove nothing. With a `challenge`, a server that has a password adds `proof`:
+ * base64url HMAC-SHA256 of the challenge, keyed with its password. A client trusts the answer only
+ * when `proof` matches the password in the registration it read, so it never sends that password
+ * to a process that has not proved it knows it.
+ */
+export const ServiceInfo = Schema.Struct({
+  id: Schema.String,
+  version: Schema.String,
+  pid: Pid,
+  status: Schema.Literals(["starting", "ready", "stopping"]),
+  proof: Schema.optional(Schema.String),
+});
+export type ServiceInfo = typeof ServiceInfo.Type;
+
+/** `service.json`. Changing a setting stops the background server; the next client starts it. */
+export const ServiceSettings = Schema.Struct({
+  /** Port for the background server. `EXECUTOR_PORT` wins over it; the default is 4312. */
+  port: Schema.optional(Port),
+  /** Extra environment for the background server process. */
+  env: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+  /**
+   * `executor` and `executor apps` without --host or EXECUTOR_HOST run a private server for the
+   * command instead, as with `--standalone`. `executor service start`, `executor pair` and the
+   * desktop still use the background server.
+   */
+  disabled: Schema.optional(Schema.Boolean),
+});
+export type ServiceSettings = typeof ServiceSettings.Type;
+
+/** Settings `executor service get|set|unset` accept. */
+export const ServiceSettingKey = Schema.Literals(["port", "env", "disabled"]);
+export type ServiceSettingKey = typeof ServiceSettingKey.Type;
+
+/**
+ * The one line a background or private (`serve --stdio`) server writes on stderr, before its
+ * message, when its key setup or its data directory refuses to start. The client that started it
+ * moves the reason into ServiceFailed and leaves the line out of the message, so a desktop can
+ * offer the matching recovery.
+ */
+export const ServiceRefusal = Schema.fromJsonString(
+  Schema.Struct({ executorService: Schema.Literal("refused"), reason: LocalConfigurationReason }),
+);
+
+/** A server could not take its port or data directory, or a client could not reach one. */
+export class ServiceFailed extends Schema.TaggedError<ServiceFailed>()("ServiceFailed", {
+  reason: Schema.Literals([
+    "port-in-use",
+    "directory-in-use",
+    "start-failed",
+    "start-timeout",
+    "stop-failed",
+    "unreachable",
+    "exited",
+  ]),
+  /**
+   * Port, data directory, URL, the starting process's last output, or for `exited` how the
+   * process ended, depending on `reason`.
+   */
+  detail: Schema.String,
+  /** For `start-failed`: why the server's key setup or data directory refused, when it said. */
+  configuration: Schema.optional(LocalConfigurationReason),
+  /** For `start-failed`: the server was this command's private one, not the background Executor. */
+  standalone: Schema.optional(Schema.Boolean),
+  /**
+   * For `directory-in-use`: where the registered server that uses the directory answers. Without
+   * it, the holder is not registered, so `executor service stop` cannot stop it.
+   */
+  url: Schema.optional(Schema.String),
+  /** For `directory-in-use`: the process of an Executor from before the background service. */
+  earlier: Schema.optional(Pid),
+  /** For `port-in-use`: the port came from EXECUTOR_PORT, which wins over the `port` setting. */
+  variable: Schema.optional(Schema.Boolean),
+  /** For `port-in-use`: an Executor server that is not this directory's registered one holds it. */
+  executor: Schema.optional(Schema.Boolean),
+}) {
+  get message() {
+    switch (this.reason) {
+      case "port-in-use":
+        return `Port ${this.detail} is already in use by ${this.executor === true ? "another Executor server, for another data directory" : "another program"}. ${
+          this.variable === true
+            ? `EXECUTOR_PORT is set to ${this.detail} and wins over the \`port\` setting: set EXECUTOR_PORT to another port, or unset it, then try again.`
+            : "Choose another port with `executor service set port <port>`, then run `executor` again."
+        }`;
+      case "directory-in-use":
+        if (this.earlier !== undefined)
+          return `An Executor from before the background service (process ${this.earlier}) is using the data directory ${this.detail}${this.url === undefined ? "" : ` at ${this.url}`}. Stop it, for example with Ctrl+C where it runs, then try again. If no such Executor runs, remove ${serviceRegistrationFile} from that folder.`;
+        if (this.url !== undefined)
+          return `The background Executor already serves the data directory ${this.detail} at ${this.url}. Stop it with \`executor service stop\`, or set EXECUTOR_DATA_DIR to another folder.`;
+        return `Another Executor is using the data directory ${this.detail}, and it is not the background Executor, so \`executor service stop\` cannot stop it. Quit Executor desktop if it is open, or stop the \`executor --standalone\` or \`executor serve\` that uses the folder where it runs, then try again. Or set EXECUTOR_DATA_DIR to another folder.`;
+      case "start-failed":
+        return `${this.standalone === true ? "This command's private Executor server could not start." : "The background Executor could not start."}${this.detail === "" ? "" : `\n${this.detail}`}`;
+      case "exited":
+        return `This command's private Executor server stopped (${this.detail}). Run the command again to start a new one.`;
+      case "start-timeout":
+        return "Timed out waiting for the background Executor to start. Run `executor service status` to check it, or `executor service restart` to try again.";
+      case "stop-failed":
+        return `The background Executor (process ${this.detail}) did not stop.`;
+      case "unreachable":
+        return `No Executor server answered at ${this.detail}. Check the URL and that the server is running.`;
+    }
+  }
+}
+
+/** `executor service set|unset|get` was given a value it cannot use. Nothing was changed. */
+export class ServiceSettingInvalid extends Schema.TaggedError<ServiceSettingInvalid>()(
+  "ServiceSettingInvalid",
+  { message: Schema.String },
+) {}
+
+/** Shared by the default command: where to find the server this invocation uses. */
+export const standaloneFlag = Flag.Boolean("standalone").pipe(
+  Flag.withDescription("Run a private server for this command instead of the background service"),
+  Flag.withDefault(false),
+);
+export const serverFlag = Flag.String("server").pipe(
+  Flag.withDescription(
+    "Connect to the Executor server at this URL instead of the background service",
+  ),
+  Flag.optional,
+);
+
+const key = Argument.Literals("key", ServiceSettingKey.literals).pipe(
+  Argument.withDescription("Setting name: port, env or disabled"),
+);
+
+export const serviceStartCommand = Command.make("start").pipe(
+  Command.withDescription(
+    "Start the background server, or confirm that it runs, and print its URL",
+  ),
+);
+export const serviceStopCommand = Command.make("stop").pipe(
+  Command.withDescription("Stop the background server"),
+);
+export const serviceRestartCommand = Command.make("restart").pipe(
+  Command.withDescription("Stop the background server and start it again"),
+);
+export const serviceStatusCommand = Command.make("status").pipe(
+  Command.withDescription(
+    "Print the background server's URL, version and process, `starting` or `stopping` before them while it starts or stops, or `stopped`",
+  ),
+);
+export const serviceGetCommand = Command.make("get", {
+  key: key.pipe(Argument.optional),
+  name: Argument.String("name").pipe(
+    Argument.withDescription("Variable name, for env"),
+    Argument.optional,
+  ),
+}).pipe(Command.withDescription("Print the background server's settings, or one setting"));
+export const serviceSetCommand = Command.make("set", {
+  key,
+  value: Argument.String("value").pipe(
+    Argument.withDescription("New value; for env, the variable name"),
+  ),
+  envValue: Argument.String("env-value").pipe(
+    Argument.withDescription("Variable value, for env"),
+    Argument.optional,
+  ),
+}).pipe(
+  Command.withDescription("Change a setting. Stops the background server so it restarts with it"),
+);
+export const serviceUnsetCommand = Command.make("unset", {
+  key,
+  name: Argument.String("name").pipe(
+    Argument.withDescription("Variable name, for env"),
+    Argument.optional,
+  ),
+}).pipe(
+  Command.withDescription(
+    "Remove a setting. Stops the background server so it restarts without it",
+  ),
+);
+
+/** `executor service …`; handlers are attached at the composition root. */
+export const serviceCommand = Command.make("service").pipe(
+  Command.withDescription("Manage the background Executor server that local clients share"),
+);
diff --git a/apps/local/server/src/contracts/startup.ts b/apps/local/server/src/contracts/startup.ts
index 22312a102b..2e89cf3065 100644
--- a/apps/local/server/src/contracts/startup.ts
+++ b/apps/local/server/src/contracts/startup.ts
@@ -2,6 +2,7 @@
 import { Schema } from "effect";
 import { Argument, Command, Flag } from "effect/cli";
 import { hostedExecutorOrigin } from "@executor-js/sdk/core";
+import { serverFlag, standaloneFlag } from "./service.ts";
 
 /** System codes permitted in persistent startup diagnostics. */
 export const StartupCode = Schema.Literals([
@@ -21,7 +22,6 @@ export const StartupCode = Schema.Literals([
 /** One explicit startup stage failed without exposing its raw input. */
 export class StartupFailed extends Schema.TaggedError<StartupFailed>()("StartupFailed", {
   stage: Schema.Literals([
-    "desktop-bootstrap",
     "authentication",
     "storage",
     "runtime",
@@ -38,28 +38,34 @@ export class StartupFailed extends Schema.TaggedError<StartupFailed>()("StartupF
     return `Local startup failed at ${this.stage}${this.code === undefined ? "" : ` (${this.code})`}`;
   }
 }
-/** Entry modes share a server implementation; desktop receives a private bootstrap pipe. */
-export type LaunchMode = "browser" | "headless" | "desktop";
-
-/** CLI declarations parse before handlers acquire configuration or server resources. */
+/**
+ * CLI declarations parse before handlers acquire configuration or server resources. The default
+ * command uses the background server unless `--standalone` or `--server` chooses another.
+ */
 export const executorCommand = Command.make("executor", {
-  bootstrapFd: Flag.Literals("bootstrap-fd", ["3"]).pipe(
-    Flag.withDescription("Read the desktop bootstrap envelope from fd3"),
-    Flag.optional,
+  standalone: standaloneFlag,
+  server: serverFlag,
+}).pipe(Command.withDescription("Start or join the background Executor and open its dashboard"));
+
+/**
+ * Run a server in this process without opening a browser. `--service` is the background server a
+ * client starts; `--stdio` is a client's private server, which prints `{"url"}` and stops when its
+ * stdin closes.
+ */
+export const serveCommand = Command.make("serve", {
+  service: Flag.Boolean("service").pipe(
+    Flag.withDescription("Run as the background server for this data directory"),
+    Flag.withDefault(false),
     Flag.withHidden,
   ),
-}).pipe(
-  Command.withDescription(
-    "Start the local server and open its dashboard. First launch saves keys in the OS credential store.",
+  stdio: Flag.Boolean("stdio").pipe(
+    Flag.withDescription("Run as a private server until standard input closes"),
+    Flag.withDefault(false),
+    Flag.withHidden,
   ),
-);
-
-/** Start the same server without opening a browser. */
-export const serveCommand = Command.make("serve").pipe(
-  Command.withDescription("Start without opening a browser"),
-);
+}).pipe(Command.withDescription("Start without opening a browser"));
 
-/** Pair with an existing server without opening local storage. */
+/** Pair with the running server without opening local storage. */
 export const pairCommand = Command.make("pair").pipe(
   Command.withDescription("Print a new connection link for the running server"),
 );
@@ -69,35 +75,48 @@ export const desktopPairing =
   "If Executor desktop is running, use its File > Open in browser menu item instead.";
 
 /**
- * `executor pair` found no server on EXECUTOR_PORT, a server that refused it, or something there
- * that is not a working Executor server. Pairing only reads keys, so every message says what to
- * correct and that nothing was changed.
- * `keys` says whether the sent key was saved in `directory` or supplied as EXECUTOR_API_KEY.
+ * Pairing found no running server, a registered one still starting, stopping or not responding
+ * after 30 seconds, a server that refused the credential, or something that is not a working
+ * Executor server, including one whose link the CLI may not open. Pairing only reads keys, so
+ * every message says what to correct and that nothing was changed. `keys` says which credential
+ * was sent: the API key saved in `directory`, EXECUTOR_API_KEY, or the password the background
+ * server registered. `server` is the host the request went to; none when no server was found.
  */
 export class PairFailed extends Schema.TaggedError<PairFailed>()("PairFailed", {
   reason: Schema.Literals([
     "no-server",
+    "starting",
+    "stopping",
+    "unresponsive",
     "key-rejected",
     "storage-unavailable",
     "unexpected-response",
   ]),
-  port: Schema.Number,
+  server: Schema.optional(Schema.String),
   directory: Schema.String,
-  keys: Schema.Literals(["saved", "supplied"]),
+  keys: Schema.Literals(["saved", "supplied", "registered"]),
 }) {
   get message() {
-    const server = `127.0.0.1:${this.port}`;
+    const server = this.server ?? "the registered address";
     switch (this.reason) {
       case "no-server":
-        return `No server answered on ${server}. Start Executor with \`executor\` or \`executor serve\`, or set EXECUTOR_PORT to the port it listens on. ${desktopPairing} Nothing was changed.`;
+        return `No background Executor is running for ${this.directory}. Start it with \`executor\` or \`executor service start\`. ${desktopPairing} Nothing was changed.`;
+      case "starting":
+        return `The background Executor on ${server} is still starting. Try again shortly, or run \`executor service status\` to check it. Nothing was changed.`;
+      case "stopping":
+        return `The background Executor on ${server} is still stopping. Run \`executor service restart\` to stop it and start it again. Nothing was changed.`;
+      case "unresponsive":
+        return `The background Executor on ${server} is not responding. Run \`executor service restart\` to stop it and start it again. Nothing was changed.`;
       case "key-rejected":
-        return this.keys === "supplied"
-          ? `The Executor server on ${server} did not accept the supplied EXECUTOR_API_KEY. Supply the key that server started with. Nothing was changed.`
-          : `The Executor server on ${server} did not accept the API key saved in ${this.directory}. It may use another data directory: set EXECUTOR_DATA_DIR to the folder it uses. ${desktopPairing} If you ran \`executor rotate-key\`, restart the server to use the new key. Nothing was changed.`;
+        return {
+          supplied: `The Executor server on ${server} did not accept the supplied EXECUTOR_API_KEY. Supply the key that server started with. Nothing was changed.`,
+          saved: `The Executor server on ${server} did not accept the API key saved in ${this.directory}. It may use another data directory: set EXECUTOR_DATA_DIR to the folder it uses. ${desktopPairing} If you ran \`executor rotate-key\`, restart the server to use the new key. Nothing was changed.`,
+          registered: `The background Executor on ${server} did not accept the password it registered in ${this.directory}. Run \`executor service restart\`, then try again. Nothing was changed.`,
+        }[this.keys];
       case "storage-unavailable":
         return `The Executor server on ${server} could not save a connection link because its access storage is unavailable. Try again, and restart the server if this continues. Nothing was changed.`;
       case "unexpected-response":
-        return `Something is listening on ${server}, but it did not answer as an Executor server. Check that EXECUTOR_PORT is the port Executor listens on. Nothing was changed.`;
+        return `Something is listening on ${server}, but it did not answer as an Executor server. Run \`executor service status\` to see where the background Executor listens. Nothing was changed.`;
     }
   }
 }
@@ -105,7 +124,7 @@ export class PairFailed extends Schema.TaggedError<PairFailed>()("PairFailed", {
 /** Replace the saved local API key. A running server uses the new key after it restarts. */
 export const rotateKeyCommand = Command.make("rotate-key").pipe(
   Command.withDescription(
-    "Replace the saved local API key. Restart Executor to use it, then update clients that used the old key",
+    "Replace the saved local API key. Run `executor service restart` to use it, then update clients that used the old key",
   ),
 );
 
@@ -142,7 +161,9 @@ export const upgradeCommand = Command.make("upgrade", {
 /**
  * `executor upgrade` stopped. Every message says what to do next, and whether anything changed:
  * only `install-failed` and `verify-failed` follow a package manager run, and a standalone
- * install switches versions only after the new one has passed its checks.
+ * install switches versions only after the new one has passed its checks. `service-running`: the
+ * background server did not stop, so the package manager did not run over its files. A failure
+ * after the background server stopped starts it again first.
  */
 export class UpgradeFailed extends Schema.TaggedError<UpgradeFailed>()("UpgradeFailed", {
   reason: Schema.Literals([
@@ -160,6 +181,7 @@ export class UpgradeFailed extends Schema.TaggedError<UpgradeFailed>()("UpgradeF
     "checksum-mismatch",
     "no-previous-version",
     "not-standalone",
+    "service-running",
   ]),
   message: Schema.String,
 }) {}
@@ -169,7 +191,6 @@ export const LegacyCommandName = Schema.Literals([
   "web",
   "open",
   "daemon",
-  "service",
   "install",
   "mcp",
   "call",
@@ -180,12 +201,22 @@ export const LegacyCommandName = Schema.Literals([
   "docs",
 ]);
 export type LegacyCommandName = typeof LegacyCommandName.Type;
+/**
+ * Executor 1's `executor service` subcommands that Executor 2's `executor service` does not have.
+ * Both have `status` and `restart`.
+ */
+export const LegacyServiceCommandName = Schema.Literals(["install", "uninstall"]);
+/** The words after `executor` that run an Executor 1 command. */
+const LegacyInvocation = Schema.Union([
+  LegacyCommandName,
+  Schema.TemplateLiteral(["service ", LegacyServiceCommandName]),
+]);
+type LegacyInvocation = typeof LegacyInvocation.Type;
 
-// Until Executor 2 has a background service, `service` and `install` point at `executor serve`.
-const backgroundService =
-  "Executor 2 cannot run as a background service yet. Keep `executor serve` running while your agents use Executor.";
+const installsNothing =
+  "Executor 2 installs nothing with your operating system. `executor` or `executor service start` starts the background Executor, which runs until `executor service stop`.";
 const mcpOverHttp =
-  "Start the server with `executor` or `executor serve`, then point your client at its /mcp endpoint, http://127.0.0.1:4312/mcp by default.";
+  "Start the server with `executor` or `executor service start`, then point your client at its /mcp endpoint, http://127.0.0.1:4312/mcp by default.";
 const toolsOverMcp = `Executor 2 runs tools through MCP. ${mcpOverHttp}`;
 const serverTarget = ["base-url", "server", "scope"];
 
@@ -196,7 +227,7 @@ const serverTarget = ["base-url", "server", "scope"];
  */
 const legacy: Readonly<
   Record<
-    LegacyCommandName,
+    LegacyInvocation,
     {
       readonly replacement: string;
       readonly switches: ReadonlyArray<string>;
@@ -218,12 +249,18 @@ const legacy: Readonly<
   },
   daemon: {
     replacement:
-      "Executor 2 has no daemon. Run `executor serve` to start the local server without opening a browser, and keep it running.",
+      "In Executor 2, run `executor service start` to start the background server without opening a browser. It keeps running until `executor service stop`.",
     switches: ["foreground"],
     values: ["port", "hostname", "allowed-host", "auth-token", "base-url", "scope"],
   },
-  service: { replacement: backgroundService, switches: ["boot"], values: ["port"] },
-  install: { replacement: backgroundService, switches: ["boot"], values: ["port"] },
+  install: { replacement: installsNothing, switches: ["boot"], values: ["port"] },
+  "service install": { replacement: installsNothing, switches: ["boot"], values: ["port"] },
+  "service uninstall": {
+    replacement:
+      "Executor 2 installs nothing with your operating system, so there is nothing to remove. `executor service stop` stops the background Executor.",
+    switches: [],
+    values: [],
+  },
   mcp: {
     replacement: `Executor 2 serves MCP over HTTP from the running server. ${mcpOverHttp}`,
     switches: ["no-artifacts", "search-tools"],
@@ -260,7 +297,7 @@ const legacy: Readonly<
 
 /** An Executor 1 command was run; the message names the Executor 2 replacement. */
 export class LegacyCommand extends Schema.TaggedError<LegacyCommand>()("LegacyCommand", {
-  command: LegacyCommandName,
+  command: LegacyInvocation,
 }) {
   get message() {
     return `\`executor ${this.command}\` is an Executor 1 command. ${legacy[this.command].replacement}`;
@@ -269,19 +306,24 @@ export class LegacyCommand extends Schema.TaggedError<LegacyCommand>()("LegacyCo
 
 /**
  * Executor 1's commands, accepted by exact name with any words and Executor 1 flags after them,
- * such as `service install --port 4788`. Unlisted, with hidden flags, so help and typo suggestions
+ * such as `daemon run --port 4788`. Unlisted, with hidden flags, so help and typo suggestions
  * show only Executor 2 commands and a legacy command's help shows only its replacement.
  */
-export const legacyCommands = LegacyCommandName.literals.map((name) =>
+const legacyCommand = <const Name extends string>(name: Name, invocation: LegacyInvocation) =>
   Command.make(name, {
     words: Argument.String("words").pipe(Argument.variadic()),
     flags: [
-      ...legacy[name].switches.map((flag) =>
+      ...legacy[invocation].switches.map((flag) =>
         Flag.Boolean(flag).pipe(Flag.optional, Flag.withHidden),
       ),
-      ...legacy[name].values.map((flag) =>
+      ...legacy[invocation].values.map((flag) =>
         Flag.String(flag).pipe(Flag.atLeast(0), Flag.withHidden),
       ),
     ],
-  }).pipe(Command.withDescription(legacy[name].replacement), Command.unlisted),
+  }).pipe(Command.withDescription(legacy[invocation].replacement), Command.unlisted);
+
+export const legacyCommands = LegacyCommandName.literals.map((name) => legacyCommand(name, name));
+/** Under `executor service`, such as `service install --port 4788`. */
+export const legacyServiceCommands = LegacyServiceCommandName.literals.map((name) =>
+  legacyCommand(name, `service ${name}`),
 );
diff --git a/apps/local/server/src/contracts/webhook-setup.ts b/apps/local/server/src/contracts/webhook-setup.ts
index 8a5dceb429..7d2668c22d 100644
--- a/apps/local/server/src/contracts/webhook-setup.ts
+++ b/apps/local/server/src/contracts/webhook-setup.ts
@@ -7,6 +7,7 @@ import {
   HttpApiMiddleware,
   OpenApi,
 } from "effect/http-api";
+import { RequestRejection } from "@executor-js/sdk/core";
 import {
   CompleteWebhookSetup,
   HttpUrl,
@@ -70,4 +71,5 @@ export const LocalWebhookSetupApi = HttpApi.make("local-webhook-setup")
         ),
       )
       .middleware(WebhookSetupAccess),
-  );
+  )
+  .middleware(RequestRejection);
diff --git a/apps/local/server/src/dev.ts b/apps/local/server/src/dev.ts
index 4aedd7fcc1..c36f708a4c 100644
--- a/apps/local/server/src/dev.ts
+++ b/apps/local/server/src/dev.ts
@@ -10,7 +10,7 @@ import { startLocalServer } from "./node.ts";
 const development = Effect.gen(function* () {
   const settings = yield* localConfiguration(process.platform);
   const web = yield* developmentWeb(settings);
-  const server = yield* startLocalServer(settings, undefined, {
+  const server = yield* startLocalServer(settings, {
     product: "cli",
     web,
     devtools: localDevtools,
@@ -19,7 +19,9 @@ const development = Effect.gen(function* () {
   yield* Console.log(
     `Executor dev: ${settings.browserOrigin ?? server.url}\nUI hot reload is enabled.\nConnect (one use, expires in 5 minutes):\n${Redacted.value(link.url)}`,
   );
-  return yield* Effect.never;
+  // It stops, as every server does, once another server has taken its data directory's lock.
+  const reason = yield* server.stopped;
+  yield* Console.error(`Executor dev stopped: ${reason}.`);
 });
 
 NodeRuntime.runMain(Effect.scoped(development).pipe(Effect.provide(NodeServices.layer)));
diff --git a/apps/local/server/src/implementation/account-choice.ts b/apps/local/server/src/implementation/account-choice.ts
index c75b3d569d..aade3a39f3 100644
--- a/apps/local/server/src/implementation/account-choice.ts
+++ b/apps/local/server/src/implementation/account-choice.ts
@@ -1,18 +1,23 @@
 /**
  * Local serves the SDK routes, whose contract decodes `accounts` as an operation's account map.
  * Callers never choose accounts: a well-formed choice reaches `linkedOperation`, which refuses it,
- * but one in another shape fails the contract before any handler runs. This middleware answers that
- * request with the same `AccountChoiceUnsupported`, so a choice is refused in any shape. Any other
- * request the contract rejects gets `RequestInvalid`'s body rather than an empty 400.
+ * but one in another shape fails the contract before any handler runs. Their `RequestRejection`
+ * answers that request with the same `AccountChoiceUnsupported`, so a choice is refused in any
+ * shape. Any other request the contract rejects gets `RequestInvalid`, as on every product API.
  */
-import { AccountChoiceUnsupported, AppId, RequestInvalid } from "@executor-js/sdk/core";
-import { isRequestRejection } from "@executor-js/telemetry/http";
+import {
+  AccountChoiceUnsupported,
+  AppId,
+  RequestRejection,
+  rejectRequest,
+} from "@executor-js/sdk/core";
+import { isRequestRejection, recordRequestRejection } from "@executor-js/telemetry/http";
 import { Effect, Option, Schema } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { type HttpApiError, HttpApiMiddleware } from "effect/http-api";
 
 const JsonObject = Schema.Record(Schema.String, Schema.Unknown);
 const noPayload: typeof JsonObject.Type = {};
-const Refusal = Schema.Union([AccountChoiceUnsupported, RequestInvalid]);
 
 /** The app a rejected request names in its path, query or body, and whether it named accounts. */
 const rejectedRequest = Effect.gen(function* () {
@@ -32,22 +37,22 @@ const rejectedRequest = Effect.gen(function* () {
   return { app, accounts: query.has("accounts") || Object.hasOwn(payload, "accounts") };
 });
 
-const reply = (error: typeof Refusal.Type) =>
-  Schema.encodeEffect(Refusal)(error).pipe(
+const refuseChoice = (app: AppId) =>
+  Schema.encodeEffect(AccountChoiceUnsupported)(new AccountChoiceUnsupported({ app })).pipe(
     Effect.map((body) => HttpServerResponse.jsonUnsafe(body, { status: 400 })),
     Effect.orDie,
   );
 
-export const accountChoiceRefusal = HttpRouter.middleware((httpEffect) =>
-  httpEffect.pipe(
-    Effect.catchDefect((defect) =>
-      isRequestRejection(defect)
-        ? Effect.flatMap(rejectedRequest, ({ app, accounts }) =>
-            accounts && Option.isSome(app)
-              ? reply(new AccountChoiceUnsupported({ app: app.value }))
-              : reply(new RequestInvalid()),
-          )
-        : Effect.die(defect),
-    ),
-  ),
+const reject = (error: HttpApiError.HttpApiSchemaError) =>
+  Effect.gen(function* () {
+    if (!isRequestRejection(error)) return yield* Effect.fail(error);
+    const { app, accounts } = yield* rejectedRequest;
+    if (!accounts || Option.isNone(app)) return yield* rejectRequest(error);
+    yield* recordRequestRejection(error);
+    return yield* refuseChoice(app.value);
+  });
+
+export const accountChoiceRejections = HttpApiMiddleware.layerSchemaErrorTransform(
+  RequestRejection,
+  reject,
 );
diff --git a/apps/local/server/src/implementation/account-connections.ts b/apps/local/server/src/implementation/account-connections.ts
index 76d16ddac0..41afa11c4f 100644
--- a/apps/local/server/src/implementation/account-connections.ts
+++ b/apps/local/server/src/implementation/account-connections.ts
@@ -18,7 +18,7 @@ import {
 import { AuthForbidden, PairingUnauthorized } from "../contracts/auth.ts";
 import { OAuthCallbackPath } from "../contracts/dashboard.ts";
 import type { ServerConfig } from "../contracts/config.ts";
-import { localRequest, requestOrigin } from "./auth.ts";
+import { localBearer, localRequest, requestOrigin } from "./auth.ts";
 import { connectOptions, connectionClient } from "./oauth-clients.ts";
 import { executorAppOwner, localOwner } from "./owners.ts";
 import { requireScopedRequirement } from "./app-accounts.ts";
@@ -88,7 +88,7 @@ export const accountConnectHandlers = (
         Effect.gen(function* () {
           const request = yield* localRequest(config.port, config.browserOrigin);
           if (request.headers.origin !== undefined) return yield* new AuthForbidden();
-          if (request.headers.authorization !== `Bearer ${Redacted.value(config.apiKey)}`)
+          if (!localBearer(config, request.headers.authorization))
             return yield* new PairingUnauthorized();
           if (payload.account === managed.account || payload.target.app === managed.app)
             return yield* new ConnectionLinkRejected();
diff --git a/apps/local/server/src/implementation/app-management.ts b/apps/local/server/src/implementation/app-management.ts
index b735d4ec7d..ec0f97978b 100644
--- a/apps/local/server/src/implementation/app-management.ts
+++ b/apps/local/server/src/implementation/app-management.ts
@@ -22,9 +22,15 @@ import {
 import { type App, type AppId, type Executor } from "@executor-js/sdk/core";
 import { localOwner } from "./owners.ts";
 import { HttpRouter, HttpServerRequest } from "effect/http";
-import { Effect, Layer, Redacted } from "effect";
+import { Effect, Layer } from "effect";
 import { Base64 } from "effect/encoding";
-import { localRequest, requestOrigin, type LocalAuth } from "./auth.ts";
+import {
+  localBearer,
+  localCredential,
+  localRequest,
+  requestOrigin,
+  type LocalAuth,
+} from "./auth.ts";
 import type { ServerConfig } from "../contracts/config.ts";
 
 /**
@@ -75,12 +81,13 @@ export const localAppManagement = (
             if (scope !== "local" || request.headers.origin !== undefined)
               return yield* new AppAccessDenied({ reason: "forbidden" });
             const authorization = request.headers.authorization;
-            if (authorization !== `Bearer ${Redacted.value(config.apiKey)}`) {
+            // Git sends the credential as a Basic password; any user name is accepted.
+            if (!localBearer(config, authorization)) {
               if (!authorization?.startsWith("Basic "))
                 return yield* new AppAccessDenied({ reason: "authentication" });
               const decoded = yield* Effect.fromResult(Base64.decodeString(authorization.slice(6)));
               const colon = decoded.indexOf(":");
-              if (colon < 0 || decoded.slice(colon + 1) !== Redacted.value(config.apiKey))
+              if (colon < 0 || !localCredential(config, decoded.slice(colon + 1)))
                 return yield* new AppAccessDenied({ reason: "authentication" });
             }
             return {
diff --git a/apps/local/server/src/implementation/app-ui.ts b/apps/local/server/src/implementation/app-ui.ts
index 1254040dfc..037bee05f5 100644
--- a/apps/local/server/src/implementation/app-ui.ts
+++ b/apps/local/server/src/implementation/app-ui.ts
@@ -23,7 +23,7 @@ import {
   UiUnauthorized,
   type UiOperation,
 } from "apps/ui/contracts";
-import { appDocument, appAsset, appWatchScript, assetPath, storedAppFile } from "apps/ui/serving";
+import { appDocument, appAsset, appFile, assetPath, storedAppFile } from "apps/ui/serving";
 import { receiveBrowserTelemetry } from "@executor-js/telemetry/http";
 import { currentTraceContext, recordRoute } from "@executor-js/telemetry";
 import { Effect, Option, Result, Schema, Stream } from "effect";
@@ -232,6 +232,12 @@ export const appUi = (
     const app = yield* authorize;
     const { target } = yield* appRequest(config.port);
     const version = yield* readVersion(app);
+    // A file needs no accounts.
+    const file = yield* appFile({
+      origin: target.origin,
+      asset: (path) => readAsset(version.build, path),
+    });
+    if (Option.isSome(file)) return file.value;
     const fix = new URL(`/apps/${app.id}`, dashboard);
     fix.searchParams.set("view", "accounts");
     // The page runs with the app's linked accounts and the linked ones; a plain requirement with
@@ -273,7 +279,6 @@ export const appUi = (
       // The page names the user requirements' accounts, as hosted does; the app's stay with it.
       accountIds: resolution.kind === "resolved" ? resolution.accounts.user : undefined,
       accounts: yield* accountNotice,
-      origin: target.origin,
       version: version.id,
       asset: (path) => readAsset(version.build, path),
     });
@@ -291,15 +296,6 @@ export const appUi = (
     ),
     htmlResponse,
   );
-  const watch = authorize.pipe(
-    Effect.as(
-      HttpServerResponse.text(appWatchScript, {
-        contentType: "text/javascript",
-        headers: privateHeaders,
-      }),
-    ),
-    htmlResponse,
-  );
   const authenticated = HttpRouter.middleware((response) =>
     authorize.pipe(
       Effect.result,
@@ -326,5 +322,5 @@ export const appUi = (
       ),
       htmlResponse,
     );
-  return { api: uiHandlers, page, asset, versions, watch, authenticated, telemetry };
+  return { api: uiHandlers, page, asset, versions, authenticated, telemetry };
 };
diff --git a/apps/local/server/src/implementation/atomic-file.ts b/apps/local/server/src/implementation/atomic-file.ts
new file mode 100644
index 0000000000..bc775fd3fb
--- /dev/null
+++ b/apps/local/server/src/implementation/atomic-file.ts
@@ -0,0 +1,40 @@
+/**
+ * Atomic file replacement for the files a data directory keeps: keys, its installation record and
+ * the background service's files. It needs only the platform's file services, so clients such as
+ * Executor desktop can use it without loading key setup.
+ */
+import { Effect, FileSystem, Path } from "effect";
+
+/** Stage, fsync and atomically rename so an interrupted write never leaves a partial file. */
+export const writeAtomically = (
+  platform: string,
+  directory: string,
+  destination: string,
+  contents: string,
+) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const temporary = yield* fs.makeTempDirectoryScoped({
+        directory,
+        prefix: ".bootstrap-",
+      });
+      const staged = path.join(temporary, path.basename(destination));
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const file = yield* fs.open(staged, { flag: "wx", mode: 0o600 });
+          yield* file.writeAll(new TextEncoder().encode(contents));
+          yield* file.sync;
+        }),
+      );
+      // The create mode is masked by umask; set it explicitly as v1 did.
+      yield* fs.chmod(staged, 0o600);
+      yield* fs.rename(staged, destination);
+      // Windows does not allow opening directories as ordinary file handles.
+      if (platform !== "win32") {
+        const parent = yield* fs.open(directory);
+        yield* parent.sync;
+      }
+    }),
+  );
diff --git a/apps/local/server/src/implementation/auth.ts b/apps/local/server/src/implementation/auth.ts
index ee1866bc42..c921732703 100644
--- a/apps/local/server/src/implementation/auth.ts
+++ b/apps/local/server/src/implementation/auth.ts
@@ -155,6 +155,39 @@ export const sessionCookie = (config: Pick<ServerConfig, "port" | "browserOrigin
 export const pairingUrl = (base: string, token: Redacted.Redacted<string>) =>
   Redacted.make(`${base}/#pair=${Redacted.value(token)}`);
 
+/** Compare every byte, so the time taken does not reveal how much of a secret matched. */
+const sameSecret = (supplied: string, secret: Redacted.Redacted<string>) => {
+  const left = new TextEncoder().encode(supplied);
+  const right = new TextEncoder().encode(Redacted.value(secret));
+  let difference = left.length ^ right.length;
+  for (const [index, byte] of right.entries()) difference |= (left[index] ?? 0) ^ byte;
+  return difference === 0;
+};
+type Secrets = ReadonlyArray<Redacted.Redacted<string> | undefined>;
+const oneOf = (supplied: string | undefined, secrets: Secrets) =>
+  supplied !== undefined &&
+  secrets.some((secret) => secret !== undefined && sameSecret(supplied, secret));
+
+/** Whether an `Authorization` header's bearer token is one of `secrets`. */
+export const bearerMatches = (authorization: string | undefined, secrets: Secrets) =>
+  authorization?.startsWith("Bearer ") === true &&
+  oneOf(authorization.slice("Bearer ".length), secrets);
+
+/**
+ * Whether a programmatic client sent a local credential: the API key, or this process's background
+ * service password, which local clients read from the service registration.
+ */
+export const localCredential = (
+  config: Pick<ServerConfig, "apiKey" | "password">,
+  supplied: string | undefined,
+) => oneOf(supplied, [config.apiKey, config.password]);
+
+/** Whether an `Authorization` header carries a local credential as its bearer token. */
+export const localBearer = (
+  config: Pick<ServerConfig, "apiKey" | "password">,
+  authorization: string | undefined,
+) => bearerMatches(authorization, [config.apiKey, config.password]);
+
 /** Reject foreign browser requests and DNS rebinding; allow only top-level OAuth authorization navigation. */
 export const localRequest = (port: number, browserOrigin?: string) =>
   Effect.gen(function* () {
@@ -247,7 +280,7 @@ export const authHandlers = (auth: LocalAuth, config: ServerConfig) => {
         Effect.gen(function* () {
           const request = yield* localRequest(config.port, config.browserOrigin);
           if (request.headers.origin === undefined) {
-            if (request.headers.authorization !== `Bearer ${Redacted.value(config.apiKey)}`)
+            if (!localBearer(config, request.headers.authorization))
               return yield* new PairingUnauthorized();
           } else if (!(yield* auth.valid(request.cookies[name]))) {
             return yield* new AuthForbidden();
diff --git a/apps/local/server/src/implementation/bootstrap.ts b/apps/local/server/src/implementation/bootstrap.ts
index 8bf457579a..f998bed025 100644
--- a/apps/local/server/src/implementation/bootstrap.ts
+++ b/apps/local/server/src/implementation/bootstrap.ts
@@ -14,18 +14,19 @@ import {
 } from "effect";
 import { Hex } from "effect/encoding";
 import { lock } from "proper-lockfile";
+import { config } from "../contracts/config.ts";
+import { dataDirectoryConfig } from "../contracts/service.ts";
 import {
-  config,
-  dataDirectoryConfig,
   keyStorageConfig,
+  keyStorageInvalid,
   type KeyStorage,
-} from "../contracts/config.ts";
-import {
   LocalConfigurationReason,
   LocalCredentialService,
   LocalInstallation as Installation,
 } from "../contracts/auth.ts";
 import { desktopPairing } from "../contracts/startup.ts";
+import { writeAtomically } from "./atomic-file.ts";
+import { readSettings } from "./service-files.ts";
 
 /** Safe startup instructions. Key values are never displayed; native error text is sanitized. */
 export class LocalConfigurationError extends Schema.TaggedError<LocalConfigurationError>()(
@@ -139,6 +140,10 @@ const keyFileUnusable = (
 
 const randomKey = () => Redacted.make(Hex.encode(crypto.getRandomValues(new Uint8Array(32))));
 
+/** The line a first start that saved its keys to keys.json writes on stderr. */
+const keyFileNotice = (keyFile: string, chosen: boolean) =>
+  `${chosen ? "EXECUTOR_KEY_STORAGE=file" : "OS credential store not found"}; keys saved to ${keyFile}`;
+
 /** Hold the directory's bootstrap lock for the current scope. */
 const lockDirectory = (directory: string, message: string) =>
   Effect.gen(function* () {
@@ -153,40 +158,6 @@ const lockDirectory = (directory: string, message: string) =>
     );
   });
 
-/** Stage, fsync and atomically rename so an interrupted write never leaves a partial file. */
-const writeAtomically = (
-  platform: string,
-  directory: string,
-  destination: string,
-  contents: string,
-) =>
-  Effect.scoped(
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const temporary = yield* fs.makeTempDirectoryScoped({
-        directory,
-        prefix: ".bootstrap-",
-      });
-      const staged = path.join(temporary, path.basename(destination));
-      yield* Effect.scoped(
-        Effect.gen(function* () {
-          const file = yield* fs.open(staged, { flag: "wx", mode: 0o600 });
-          yield* file.writeAll(new TextEncoder().encode(contents));
-          yield* file.sync;
-        }),
-      );
-      // The create mode is masked by umask; set it explicitly as v1 did.
-      yield* fs.chmod(staged, 0o600);
-      yield* fs.rename(staged, destination);
-      // Windows does not allow opening directories as ordinary file handles.
-      if (platform !== "win32") {
-        const parent = yield* fs.open(directory);
-        yield* parent.sync;
-      }
-    }),
-  );
-
 /** One installation's OS credential. Construction failures mean the store is absent. */
 const credentialEntry = (id: string) =>
   Effect.gen(function* () {
@@ -292,22 +263,23 @@ const configure = (directory: string, keys: typeof Keys.Type) =>
   });
 
 /** Resolve one profile's keys. Existing data never causes a new credential to be generated. */
+/**
+ * The key storage a new data directory asks for. Servers read it before creating anything, so an
+ * invalid value changes nothing.
+ */
+export const keyStorageSetting = keyStorageConfig.pipe(
+  Effect.mapError(
+    () => new LocalConfigurationError({ reason: "misconfigured", message: keyStorageInvalid }),
+  ),
+);
+
 export const localConfiguration = (platform: string) =>
   Effect.scoped(
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       // Read before touching the directory, so an invalid value changes nothing.
-      const keyStorage = yield* keyStorageConfig.pipe(
-        Effect.mapError(
-          () =>
-            new LocalConfigurationError({
-              reason: "misconfigured",
-              message:
-                'EXECUTOR_KEY_STORAGE must be "file" (keep keys in keys.json) or "os" (OS credential store only), or unset. Nothing was changed.',
-            }),
-        ),
-      );
+      const keyStorage = yield* keyStorageSetting;
       const { directory, marker, keyFile, explicitApi, explicitEncryption } = yield* dataDirectory;
 
       yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
@@ -390,24 +362,23 @@ export const localConfiguration = (platform: string) =>
       }
 
       const generated = () => Keys.make({ apiKey: randomKey(), encryptionKey: randomKey() });
-      const saveKeyFile = (notice: string) =>
+      const saveKeyFile = (chosen: boolean) =>
         Effect.gen(function* () {
           const keys = generated();
           yield* writeFile(keyFile, yield* encodeKeys(keys));
           yield* writeMarker("file");
           // stdout is the desktop readiness protocol; this notice belongs on stderr.
-          yield* Console.error(`${notice}${keyFile}`);
+          yield* Console.error(keyFileNotice(keyFile, chosen));
           return yield* configure(directory, keys);
         });
-      if (Option.contains(keyStorage, "file"))
-        return yield* saveKeyFile("EXECUTOR_KEY_STORAGE=file; keys saved to ");
+      if (Option.contains(keyStorage, "file")) return yield* saveKeyFile(true);
       // Denied access leaves the pending record and no key file, so the next start
       // prompts again and can still fall back if the store turns out to be absent.
       const storeFailed = (failure: StoreFailure) =>
         failure.kind === "denied"
           ? Effect.fail(denied(failure.reason, platform, firstStart))
           : firstStart && Option.isNone(keyStorage)
-            ? saveKeyFile("OS credential store not found; keys saved to ")
+            ? saveKeyFile(false)
             : Effect.fail(unavailable(failure.reason, firstStart));
 
       const store = yield* readCredential(platform, installation.id).pipe(Effect.result);
@@ -441,6 +412,41 @@ export const localConfiguration = (platform: string) =>
     ),
   );
 
+/**
+ * Run `start`, which may start this directory's background server, and repeat the line that server
+ * wrote if its first start saved the keys to keys.json: nothing reads a background server's stderr.
+ * Only the installation record is read, never the keys.
+ */
+export const withKeyFileNotice = <A, E, R>(directory: string, start: Effect.Effect<A, E, R>) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const recorded = readInstallation(path.join(directory, "installation.json")).pipe(
+      Effect.map(Option.map(({ state }) => state)),
+      Effect.orElseSucceed(() => Option.none()),
+    );
+    const before = yield* recorded;
+    const result = yield* start;
+    if (Option.isNone(before) && Option.contains(yield* recorded, "file")) {
+      // The server ran with this environment and its saved `env`, as `ensure` starts it.
+      const env = yield* readSettings(directory).pipe(
+        Effect.map((settings) => settings.env ?? {}),
+        Effect.orElseSucceed(() => ({})),
+      );
+      const base = yield* ConfigProvider.ConfigProvider;
+      const storage = yield* keyStorageConfig.pipe(
+        Effect.provideService(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.fromUnknown(env).pipe(ConfigProvider.orElse(base)),
+        ),
+        Effect.orElseSucceed(() => Option.none()),
+      );
+      yield* Console.error(
+        keyFileNotice(path.join(directory, "keys.json"), Option.contains(storage, "file")),
+      );
+    }
+    return result;
+  });
+
 /**
  * Read the API key a client of one directory's running server sends, such as `executor pair`.
  * Unlike `localConfiguration` it never creates the directory, a record or keys, and takes no
diff --git a/apps/local/server/src/implementation/dashboard.ts b/apps/local/server/src/implementation/dashboard.ts
index ac1c36233f..4907ed869a 100644
--- a/apps/local/server/src/implementation/dashboard.ts
+++ b/apps/local/server/src/implementation/dashboard.ts
@@ -32,7 +32,7 @@ import {
   type ExecutorDatabase,
   type Executor,
 } from "@executor-js/sdk/core";
-import { Effect, Layer, Redacted, Result, Schema, Stream } from "effect";
+import { Effect, Layer, Result, Schema, Stream } from "effect";
 import type { SqlClient } from "effect/sql";
 import { ApprovalResponse, approvalElicitation } from "apps/contracts";
 import {
@@ -42,7 +42,7 @@ import {
 } from "@executor-js/mcp/browser";
 import { HttpServerResponse } from "effect/http";
 import { HttpApiBuilder } from "effect/http-api";
-import { localRequest, requestOrigin, sessionCookie, type LocalAuth } from "./auth.ts";
+import { localBearer, localRequest, requestOrigin, sessionCookie, type LocalAuth } from "./auth.ts";
 import { createCatalog, deployedCopy } from "@executor-js/catalog";
 import type { LocalOwnerMigration } from "@executor-js/app-management/contracts/local-owners";
 import { connectForApp } from "./account-connections.ts";
@@ -92,7 +92,7 @@ export const dashboardAccess = (config: ServerConfig, auth: LocalAuth) =>
       const request = yield* localRequest(config.port, config.browserOrigin).pipe(
         Effect.mapError(() => new DashboardForbidden()),
       );
-      const bearer = request.headers.authorization === `Bearer ${Redacted.value(config.apiKey)}`;
+      const bearer = localBearer(config, request.headers.authorization);
       const session = yield* auth.valid(request.cookies[sessionCookie(config)]);
       if (!bearer && !session) return yield* Effect.fail(new DashboardUnauthorized());
       return (yield* response).pipe(HttpServerResponse.setHeader("cache-control", "no-store"));
@@ -359,7 +359,7 @@ export const dashboard = (
       const request = yield* localRequest(config.port, config.browserOrigin).pipe(
         Effect.mapError(() => new DashboardForbidden()),
       );
-      const bearer = request.headers.authorization === `Bearer ${Redacted.value(config.apiKey)}`;
+      const bearer = localBearer(config, request.headers.authorization);
       const cookie = request.cookies[sessionCookie(config)];
       const authorize: LiveAccess = bearer
         ? Effect.void
diff --git a/apps/local/server/src/implementation/desktop-return.ts b/apps/local/server/src/implementation/desktop-return.ts
new file mode 100644
index 0000000000..c02c85e9d7
--- /dev/null
+++ b/apps/local/server/src/implementation/desktop-return.ts
@@ -0,0 +1,135 @@
+/**
+ * Keep OAuth callbacks for Executor desktop, one authorization at a time. Only states the desktop
+ * said it expects are kept; both lists are bounded and expire, and live only in this process.
+ */
+import { Clock, Duration, Effect, Option, Queue, Redacted, Ref } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { HttpApiBuilder } from "effect/http-api";
+import { PairingUnauthorized } from "../contracts/auth.ts";
+import type { ServerConfig } from "../contracts/config.ts";
+import { OAuthCallbackPath } from "../contracts/dashboard.ts";
+import {
+  DesktopReturnApi,
+  desktopReturnHeader,
+  desktopReturnLifetimeMillis,
+  desktopReturnLimit,
+  desktopReturnWaitMillis,
+} from "../contracts/desktop-return.ts";
+import { localBearer, localRequest } from "./auth.ts";
+
+interface Kept {
+  readonly url: Redacted.Redacted<string>;
+  readonly expiresAt: number;
+}
+
+/** What the system browser shows once its callback is kept for the desktop. */
+const returnPage = () =>
+  HttpServerResponse.text(
+    "<!doctype html><title>Executor</title><p>Return to Executor to finish connecting your account.</p>",
+    {
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "referrer-policy": "no-referrer",
+        "content-security-policy": "default-src 'none'",
+      },
+    },
+  );
+
+export const makeDesktopReturns = (
+  config: Pick<ServerConfig, "port" | "browserOrigin" | "apiKey" | "password">,
+) =>
+  Effect.gen(function* () {
+    const origin = `http://127.0.0.1:${config.port}`;
+    /** Expected states and when each expires, oldest first. */
+    const expected = yield* Ref.make<ReadonlyMap<string, number>>(new Map());
+    const kept = yield* Queue.sliding<Kept>(desktopReturnLimit);
+
+    const authorized = Effect.gen(function* () {
+      const request = yield* localRequest(config.port, config.browserOrigin);
+      if (
+        request.headers.origin !== undefined ||
+        !localBearer(config, request.headers.authorization)
+      )
+        return yield* new PairingUnauthorized();
+    });
+
+    const expect = (state: string) =>
+      Effect.gen(function* () {
+        const now = yield* Clock.currentTimeMillis;
+        yield* Ref.update(expected, (entries) => {
+          const next = new Map([...entries].filter(([, expiresAt]) => expiresAt > now));
+          next.delete(state);
+          // The oldest go to make room for this one; none while there is room.
+          const excess = Math.max(0, next.size - desktopReturnLimit + 1);
+          for (const oldest of [...next.keys()].slice(0, excess)) next.delete(oldest);
+          return next.set(state, now + desktopReturnLifetimeMillis);
+        });
+      });
+
+    /** Whether `state` was expected; it is expected only once. */
+    const claim = (state: string) =>
+      Effect.gen(function* () {
+        const now = yield* Clock.currentTimeMillis;
+        return yield* Ref.modify(expected, (entries) => {
+          const expiresAt = entries.get(state);
+          if (expiresAt === undefined || expiresAt <= now) return [false, entries] as const;
+          const next = new Map(entries);
+          next.delete(state);
+          return [true, next] as const;
+        });
+      });
+
+    const next = Effect.gen(function* () {
+      const taken = yield* Queue.takeAll(kept).pipe(
+        Effect.timeoutOption(Duration.millis(desktopReturnWaitMillis)),
+      );
+      const now = yield* Clock.currentTimeMillis;
+      return {
+        returns: Option.match(taken, {
+          onNone: () => [],
+          onSome: (all) =>
+            all.filter((entry) => entry.expiresAt > now).map((entry) => ({ url: entry.url })),
+        }),
+      };
+    });
+
+    return {
+      handlers: HttpApiBuilder.group(DesktopReturnApi, "desktopReturns", (handlers) =>
+        handlers
+          .handle("expect", ({ payload }) => authorized.pipe(Effect.andThen(expect(payload.state))))
+          .handle("next", () => authorized.pipe(Effect.andThen(next))),
+      ),
+      /**
+       * Serve the provider callback route. A browser callback for an expected state is kept for
+       * the desktop; every other request, and the desktop's own load of a kept one, gets `page`.
+       */
+      callback: <E, R>(page: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) =>
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          if (
+            request.method !== "GET" ||
+            request.headers.host !== new URL(origin).host ||
+            request.headers[desktopReturnHeader] === "1" ||
+            !request.url.startsWith("/") ||
+            !URL.canParse(`${origin}${request.url}`)
+          )
+            return yield* page;
+          const callback = new URL(`${origin}${request.url}`);
+          const state = callback.searchParams.get("state");
+          if (
+            callback.origin !== origin ||
+            callback.pathname !== OAuthCallbackPath ||
+            state === null ||
+            !(yield* claim(state))
+          )
+            return yield* page;
+          const now = yield* Clock.currentTimeMillis;
+          yield* Queue.offer(kept, {
+            url: Redacted.make(callback.href),
+            expiresAt: now + desktopReturnLifetimeMillis,
+          });
+          return returnPage();
+        }),
+    };
+  });
diff --git a/apps/local/server/src/implementation/development.ts b/apps/local/server/src/implementation/development.ts
index a03bd65635..a22f2c8a58 100644
--- a/apps/local/server/src/implementation/development.ts
+++ b/apps/local/server/src/implementation/development.ts
@@ -1,5 +1,5 @@
 /** Scoped Vite adapter shared by browser and desktop development hosts. */
-import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpServer, type IncomingMessage } from "node:http";
 import * as NodeHttpServerRequest from "@effect/platform-node/NodeHttpServerRequest";
 import {
   dashboardDocument,
@@ -14,6 +14,15 @@ import type { ServerConfig } from "../contracts/config.ts";
 import { StartupFailed } from "../contracts/startup.ts";
 import type { LocalWeb } from "../node.ts";
 
+/** Vite's HMR socket path, served on the dashboard's own origin. */
+const hmrPath = "/@vite/hmr";
+
+/** Vite answers only its own subprotocols; any other upgrade would wait on it forever. */
+const isHmrUpgrade = (incoming: IncomingMessage) =>
+  incoming.headers.upgrade?.toLowerCase() === "websocket" &&
+  ["vite-hmr", "vite-ping"].includes(incoming.headers["sec-websocket-protocol"] ?? "") &&
+  new URL(incoming.url ?? "/", "http://localhost").pathname === hmrPath;
+
 /** Options for one development host. Separate hosts keep separate Vite dependency caches. */
 export type DevelopmentWebOptions = {
   /** Vite cache directory relative to the repository root; Vite's default when omitted. */
@@ -25,29 +34,10 @@ export const developmentWeb = (settings: ServerConfig, options: DevelopmentWebOp
   Effect.gen(function* () {
     const path = yield* Path.Path;
     const root = yield* path.fromFileUrl(new URL("../../../web/", import.meta.url));
-    // HMR gets its own loopback listener on a free port, so concurrent checkouts never collide
-    // and Vite upgrades stay separate from the Effect HTTP server upgrade handler.
-    const hmrServer = yield* Effect.acquireRelease(
-      Effect.sync(() => createHttpServer()),
-      (server) =>
-        Effect.sync(() => {
-          server.closeAllConnections();
-          server.close();
-        }),
-    );
-    const socketPort = yield* Effect.callback<number, StartupFailed>((resume) => {
-      const failed = () => resume(Effect.fail(new StartupFailed({ stage: "dev-server" })));
-      hmrServer.once("error", failed);
-      hmrServer.listen({ host: "127.0.0.1", port: 0 }, () => {
-        const address = hmrServer.address();
-        resume(
-          address === null || typeof address === "string"
-            ? Effect.fail(new StartupFailed({ stage: "dev-server" }))
-            : Effect.succeed(address.port),
-        );
-      });
-      return Effect.sync(() => hmrServer.removeListener("error", failed));
-    });
+    // Vite's HMR socket server, fed the upgrades the asset handler takes for `hmrPath`. It never
+    // listens: the browser reaches HMR at its page's own origin, through any proxy in front of
+    // this server, and Vite stays clear of the Effect HTTP server's own upgrade handler.
+    const hmrServer = createHttpServer();
     const vite = yield* Effect.acquireRelease(
       Effect.tryPromise({
         try: () =>
@@ -66,22 +56,29 @@ export const developmentWeb = (settings: ServerConfig, options: DevelopmentWebOp
                 settings.browserOrigin === undefined
                   ? []
                   : [new URL(settings.browserOrigin).hostname],
-              ws: {
-                host: "127.0.0.1",
-                port: socketPort,
-                clientPort: socketPort,
-                protocol: "ws",
-                server: hmrServer,
-              },
+              // With a server and no port or protocol, the client connects to its page's origin.
+              ws: { server: hmrServer, path: hmrPath },
             },
           }),
         catch: () => new StartupFailed({ stage: "dev-server" }),
       }),
       (server) => Effect.promise(() => server.close()),
     );
+    // The socket belongs to Vite once the upgrade is handed over. The handler waits for it to
+    // close, and Effect then writes nothing to a destroyed socket. A WebSocket client sends nothing
+    // before the handshake answer, so the upgrade has no buffered head to pass on.
+    const hmrUpgrade = (incoming: IncomingMessage) =>
+      Effect.callback<HttpServerResponse.HttpServerResponse>((resume) => {
+        const { socket } = incoming;
+        const closed = () => resume(Effect.succeed(HttpServerResponse.empty()));
+        socket.once("close", closed);
+        hmrServer.emit("upgrade", incoming, socket, Buffer.alloc(0));
+        return Effect.sync(() => socket.off("close", closed));
+      });
     const assets = Effect.gen(function* () {
       const request = yield* HttpServerRequest.HttpServerRequest;
       const incoming = NodeHttpServerRequest.toIncomingMessage(request);
+      if (isHmrUpgrade(incoming)) return yield* hmrUpgrade(incoming);
       const response = NodeHttpServerRequest.toServerResponse(request);
       return yield* Effect.callback<HttpServerResponse.HttpServerResponse>((resume) => {
         const cleanup = () => {
diff --git a/apps/local/server/src/implementation/e2e-process.ts b/apps/local/server/src/implementation/e2e-process.ts
index 87d6d5d106..9574c077af 100644
--- a/apps/local/server/src/implementation/e2e-process.ts
+++ b/apps/local/server/src/implementation/e2e-process.ts
@@ -56,6 +56,8 @@ if (process.env.EXECUTOR_ENVIRONMENT === "e2e") {
     });
   }
   if (process.env.EXECUTOR_TEST_STOP_FD === "3") {
+    // The pipe is this process's alone. A server this CLI starts gets no fd3, and would fail here.
+    delete process.env.EXECUTOR_TEST_STOP_FD;
     // Bun reads an inherited descriptor only through createConnection, which uses the descriptor
     // and ignores the port its types require; Node reads one only through a Socket.
     const control =
diff --git a/apps/local/server/src/implementation/launcher.ts b/apps/local/server/src/implementation/launcher.ts
index bb35167951..0dd54f7113 100644
--- a/apps/local/server/src/implementation/launcher.ts
+++ b/apps/local/server/src/implementation/launcher.ts
@@ -1,12 +1,24 @@
-/** Local launcher behavior. Runtime process APIs are supplied only at entry points. */
-import { Config, Console, Effect, Option, Redacted } from "effect";
+/**
+ * `executor`: start or join the background server, pair a browser with it, print where Executor
+ * runs, open the dashboard and exit. `--standalone`, or the service's `disabled` setting, runs a
+ * private server that stays in the foreground until interrupted, or fails once that server stops,
+ * instead; `--server` uses a server that is already running elsewhere. Runtime process APIs are
+ * supplied only at entry points.
+ */
+import { Console, Duration, Effect, Fiber, Option, Redacted } from "effect";
+import { CliError } from "effect/cli";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { localConfiguration } from "./bootstrap.ts";
-import { StartupFailed, type LaunchMode } from "../contracts/startup.ts";
-import { readDesktopBootstrap, startLocalServer } from "../node.ts";
-import { recordServer } from "./server-record.ts";
+import { ServiceFailed } from "../contracts/service.ts";
+import { StartupFailed } from "../contracts/startup.ts";
+import { savedApiKey, withKeyFileNotice } from "./bootstrap.ts";
+import { pairingLink, serverOrigins } from "./pair.ts";
+import { ensure, standalone } from "./service-client.ts";
+import { readSettings, serviceDirectory } from "./service-files.ts";
 import { updateNotice } from "./update-notice.ts";
 
+/** How long a finished command still waits for the daily release check before it exits. */
+const noticeWait = Duration.seconds(2);
+
 const openBrowser = (url: Redacted.Redacted<string>, platform: string) =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
@@ -21,41 +33,81 @@ const openBrowser = (url: Redacted.Redacted<string>, platform: string) =>
   }).pipe(Effect.mapError(() => new StartupFailed({ stage: "browser" })));
 
 /**
- * Start headless/browser/desktop using one server. Pairing with a running server is `pair.ts`.
- * `entry` is the script Node started, which tells the update notice how the CLI was installed.
+ * `--server`: a connection link from a server that runs elsewhere, sent EXECUTOR_API_KEY or the
+ * key saved in the data directory.
  */
-export const launch = (mode: LaunchMode, platform: string, entry?: string) =>
+const viaServer = (server: string, platform: string) =>
   Effect.gen(function* () {
-    const settings = yield* localConfiguration(platform);
-    const bootstrap = mode === "desktop" ? yield* readDesktopBootstrap : undefined;
-    const server = yield* startLocalServer(settings, bootstrap, {
-      product: mode === "desktop" ? "desktop" : "cli",
-    });
-    if (mode === "desktop") {
-      // A desktop parent parses this readiness line before opening its renderer.
-      // Its bootstrap credential came through fd3 and is never echoed here.
-      yield* Console.log(JSON.stringify({ version: 1, url: server.url }));
-    } else {
-      const link = yield* server.issuePairingLink;
-      const origin = settings.browserOrigin ?? server.url;
-      yield* Console.log(
-        `Executor: ${origin}\nMCP: ${origin}/mcp\nConnect (one use, expires in 5 minutes):\n${Redacted.value(link.url)}`,
-      );
-      if (mode === "browser")
-        yield* openBrowser(link.url, platform).pipe(
-          Effect.catch(() => Console.log("Open the connection link above in your browser.")),
-        );
-      // `executor upgrade` reads this record to say that this server needs restarting.
-      yield* recordServer(settings.directory, {
-        pid: process.pid,
-        // What `executor --version` prints; development builds have none.
-        version: Option.getOrUndefined(
-          yield* Config.String("EXECUTOR_BUILD_VERSION").pipe(Config.option),
-        ),
-        url: origin,
-        command: mode === "browser" ? "executor" : "executor serve",
+    if (!/^https?:\/\//u.test(server) || !URL.canParse(server))
+      return yield* new CliError.UserError({
+        cause: `--server must be an http:// or https:// URL, such as http://127.0.0.1:4312, not ${server}.`,
       });
-      yield* Effect.forkScoped(updateNotice(settings.directory, entry));
-    }
-    return yield* Effect.never;
+    const url = server.replace(/\/+$/u, "");
+    const { directory, apiKey, keys } = yield* savedApiKey(platform);
+    return yield* pairingLink({ url, credential: apiKey, directory, keys }).pipe(
+      Effect.catchIf(
+        (error) => error.reason === "no-server",
+        () => Effect.fail(new ServiceFailed({ reason: "unreachable", detail: url })),
+      ),
+    );
+  });
+
+/**
+ * A connection link from this data directory's background server, started or replaced by this
+ * version if needed, or from a private server for this command, with what fails once that private
+ * server stops. The link must point at that server or its HTTPS browser origin.
+ */
+const ownServer = (directory: string, foreground: boolean) =>
+  Effect.gen(function* () {
+    const server = foreground
+      ? yield* standalone
+      : {
+          ...(yield* withKeyFileNotice(directory, ensure(directory, { version: "replace" }))),
+          exited: undefined,
+        };
+    const link = yield* pairingLink({
+      url: server.url,
+      credential: server.password,
+      directory,
+      keys: "registered",
+      origins: serverOrigins(server.url, server.browserOrigin),
+    });
+    return { link, exited: server.exited };
+  });
+
+export interface LaunchOptions {
+  readonly standalone: boolean;
+  readonly server: Option.Option<string>;
+}
+
+/**
+ * Pair a browser with the server this invocation uses. `entry` is the file that started the CLI,
+ * which tells the update notice how it was installed.
+ */
+export const launch = (options: LaunchOptions, platform: string, entry: string | undefined) =>
+  Effect.gen(function* () {
+    if (options.standalone && Option.isSome(options.server))
+      return yield* new CliError.UserError({ cause: "Use --standalone or --server, not both." });
+    const directory = yield* serviceDirectory;
+    // The daily release check runs beside startup; it never fails or holds the command for long.
+    const notice = yield* Effect.forkScoped(updateNotice(directory, entry));
+    const foreground =
+      Option.isNone(options.server) &&
+      (options.standalone || (yield* readSettings(directory)).disabled === true);
+
+    const { link, exited } = Option.isSome(options.server)
+      ? { link: yield* viaServer(options.server.value, platform), exited: undefined }
+      : yield* ownServer(directory, foreground);
+
+    const origin = new URL(Redacted.value(link.url)).origin;
+    yield* Console.log(
+      `Executor: ${origin}\nMCP: ${origin}/mcp\nConnect (one use, expires in 5 minutes):\n${Redacted.value(link.url)}`,
+    );
+    yield* openBrowser(link.url, platform).pipe(
+      Effect.catch(() => Console.log("Open the connection link above in your browser.")),
+    );
+    // A private server lives as long as this command, which fails if it stops first; the
+    // background server outlives it.
+    if (exited !== undefined) return yield* exited;
+    yield* Fiber.join(notice).pipe(Effect.timeout(noticeWait), Effect.ignore);
   });
diff --git a/apps/local/server/src/implementation/mcp.ts b/apps/local/server/src/implementation/mcp.ts
index 7b633f161f..44a66040d0 100644
--- a/apps/local/server/src/implementation/mcp.ts
+++ b/apps/local/server/src/implementation/mcp.ts
@@ -9,7 +9,7 @@ import {
   untargetedLinkRefusal,
   type Grant,
 } from "@executor-js/mcp-auth";
-import { localRequest } from "./auth.ts";
+import { localBearer, localRequest } from "./auth.ts";
 import type { ServerConfig } from "../contracts/config.ts";
 import { LocalMcpUnauthorized, type LocalMcpOAuth } from "./mcp-oauth.ts";
 /** Local access and documentation I/O for the shared MCP implementation. */
@@ -25,7 +25,7 @@ import {
 } from "@executor-js/sdk/core";
 import { appVersion, versionRequirementAccounts } from "./app-accounts.ts";
 import type { SqlClient } from "effect/sql";
-import { Context, Effect, Redacted } from "effect";
+import { Context, Effect } from "effect";
 
 /** The user requirements' linked accounts; the app's are its app links, never shown to agents. */
 const linkedAccountsOf = (
@@ -219,14 +219,13 @@ export const localMcp = (
       if (address === undefined) return oauth.invalidAddress;
       const current = Effect.gen(function* () {
         // The administrative key is full access on the plain URL only; it never enters a connection.
-        const grant =
-          request.headers.authorization === `Bearer ${Redacted.value(config.apiKey)}`
-            ? {
-                id: GrantId.make("local-administrator"),
-                policy: { kind: "all" as const },
-                target: { kind: "mcp" as const, mode: address.mode },
-              }
-            : (yield* oauth.authenticate(new Headers(request.headers))).grant;
+        const grant = localBearer(config, request.headers.authorization)
+          ? {
+              id: GrantId.make("local-administrator"),
+              policy: { kind: "all" as const },
+              target: { kind: "mcp" as const, mode: address.mode },
+            }
+          : (yield* oauth.authenticate(new Headers(request.headers))).grant;
         const refusal = deliveryRefusal(grant, address);
         if (refusal !== undefined) return yield* new GrantForbidden({ refusal });
         return grant;
diff --git a/apps/local/server/src/implementation/pair.ts b/apps/local/server/src/implementation/pair.ts
index 9d243dcde7..065296c2f4 100644
--- a/apps/local/server/src/implementation/pair.ts
+++ b/apps/local/server/src/implementation/pair.ts
@@ -1,65 +1,88 @@
 /** `executor pair`: a client of the running server that reads keys and writes nothing. */
-import { connect } from "node:net";
-import { Console, Effect, Redacted, Schema } from "effect";
+import { Config, Console, Effect, Option, Redacted, Schedule } from "effect";
 import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 import { HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
 import { HttpApiClient } from "effect/http-api";
 import { LocalAuthApi } from "../contracts/auth.ts";
 import { serverPortConfig } from "../contracts/config.ts";
 import { PairFailed } from "../contracts/startup.ts";
-import { LocalConfigurationError, savedApiKey } from "./bootstrap.ts";
+import { LocalConfigurationError } from "./bootstrap.ts";
+import { registered } from "./service-client.ts";
+import { connectionRefused, serviceDirectory } from "./service-files.ts";
 
-/**
- * Whether a TCP connection to the port is refused, which is the only sign that nothing listens on
- * it. Fetch cannot tell: Bun's, which the release executable runs, reports every failed connect as
- * `ConnectionRefused`, including a connection the peer accepted and reset before Bun saw it
- * complete, as happens on Windows. A plain socket keeps the operating system's error under Node
- * and Bun alike.
- */
-const connectionRefused = (port: number) =>
-  Effect.callback<boolean>((resume) => {
-    const socket = connect({ host: "127.0.0.1", port });
-    const settle = (refused: boolean) => {
-      socket.destroy();
-      resume(Effect.succeed(refused));
-    };
-    socket.once("connect", () => settle(false));
-    socket.once("error", (error) => settle(refusedCode(error)));
-    return Effect.sync(() => socket.destroy());
-  });
-const refusedCode = Schema.is(Schema.Struct({ code: Schema.Literal("ECONNREFUSED") }));
 /** A running Executor server answers at once, so a listener that stays silent is something else. */
 const answerWithin = "10 seconds";
 
-/** Print a one-use connection link from the server on EXECUTOR_PORT, sent the directory's key. */
-export const pair = (platform: string) =>
+/** Where a connection link is requested, with the credential the server accepts as its API key. */
+export interface PairingTarget {
+  readonly url: string;
+  readonly credential: Redacted.Redacted<string>;
+  /** The data directory the credential came from, for messages. */
+  readonly directory: string;
+  readonly keys: PairFailed["keys"];
+  /** For a server this CLI started or found registered: the only origins its links may use. */
+  readonly origins?: ReadonlyArray<string>;
+}
+
+/**
+ * The origins a connection link from this CLI's own server may use: its loopback URL's, and its
+ * browser origin when that is an HTTPS origin.
+ */
+export const serverOrigins = (url: string, browserOrigin: string | undefined) => {
+  const secure =
+    browserOrigin !== undefined &&
+    URL.canParse(browserOrigin) &&
+    new URL(browserOrigin).protocol === "https:" &&
+    new URL(browserOrigin).origin === browserOrigin;
+  return [new URL(url).origin, ...(secure ? [browserOrigin] : [])];
+};
+
+/**
+ * Whether the CLI may print and open `link`: an http(s) URL without credentials in it, on one of
+ * `origins` when they are given. A browser opener starts whatever a link names, such as a file.
+ */
+const openable = (link: Redacted.Redacted<string>, origins: ReadonlyArray<string> | undefined) => {
+  const text = Redacted.value(link);
+  if (!URL.canParse(text)) return false;
+  const url = new URL(text);
+  return (
+    (url.protocol === "http:" || url.protocol === "https:") &&
+    url.username === "" &&
+    url.password === "" &&
+    (origins === undefined || origins.includes(url.origin))
+  );
+};
+
+/**
+ * A one-use connection link from `target`, or the PairFailed that says what to correct. The
+ * request carries no Origin header: the API key, not a browser session, authorizes it. A link the
+ * CLI may not open counts as an unexpected response.
+ */
+export const pairingLink = (target: PairingTarget) =>
   Effect.gen(function* () {
-    const port = yield* serverPortConfig.pipe(
-      Effect.mapError(
-        () =>
-          new LocalConfigurationError({
-            reason: "misconfigured",
-            message:
-              "EXECUTOR_PORT must be a port number from 1 to 65535: the port the running server listens on. Nothing was changed.",
-          }),
-      ),
-    );
-    const { directory, apiKey, keys } = yield* savedApiKey(platform);
+    const url = new URL(target.url);
     const failed = (reason: PairFailed["reason"]) =>
-      Effect.fail(new PairFailed({ reason, port, directory, keys }));
+      Effect.fail(
+        new PairFailed({
+          reason,
+          server: url.host,
+          directory: target.directory,
+          keys: target.keys,
+        }),
+      );
     const client = yield* HttpApiClient.make(LocalAuthApi, {
-      baseUrl: `http://127.0.0.1:${port}`,
+      baseUrl: target.url,
       transformClient: (client) =>
-        client.pipe(HttpClient.mapRequest(HttpClientRequest.bearerToken(apiKey))),
+        client.pipe(HttpClient.mapRequest(HttpClientRequest.bearerToken(target.credential))),
     });
-    const link = yield* client.auth.pair().pipe(
+    return yield* client.auth.pair().pipe(
       Effect.timeout(answerWithin),
       Effect.catchTags({
         PairingUnauthorized: () => failed("key-rejected"),
         AuthStorageError: () => failed("storage-unavailable"),
         HttpClientError: (error) =>
           error.reason instanceof HttpClientError.TransportError
-            ? connectionRefused(port).pipe(
+            ? connectionRefused(url).pipe(
                 Effect.timeout(answerWithin),
                 Effect.catchTag("TimeoutError", () => Effect.succeed(false)),
                 Effect.flatMap((refused) => failed(refused ? "no-server" : "unexpected-response")),
@@ -69,10 +92,76 @@ export const pair = (platform: string) =>
         SchemaError: () => failed("unexpected-response"),
         TimeoutError: () => failed("unexpected-response"),
       }),
+      Effect.filterOrElse(
+        (link) => openable(link.url, target.origins),
+        () => failed("unexpected-response"),
+      ),
     );
-    yield* Console.log(Redacted.value(link.url));
   }).pipe(
     // Node's fetch throws outside the request when it writes to a connection the peer has reset
     // on macOS (setTypeOfService EINVAL), which ends the process; node:http reports it as an error.
     Effect.provide(NodeHttpClient.layerNodeHttp),
   );
+
+/** The loopback address on EXECUTOR_PORT, for a supplied key when no server is registered. */
+const portUrl = serverPortConfig.pipe(
+  Effect.map((port) => `http://127.0.0.1:${port}`),
+  Effect.mapError(
+    () =>
+      new LocalConfigurationError({
+        reason: "misconfigured",
+        message:
+          "EXECUTOR_PORT must be a port number from 1 to 65535: the port the running server listens on. Nothing was changed.",
+      }),
+  ),
+);
+
+/** How long `executor pair` waits for a registered server that is not ready. */
+const startingWait = "30 seconds";
+
+/**
+ * Print a one-use connection link from the background server, sent the password it registered.
+ * A supplied EXECUTOR_API_KEY is sent instead, to the registered server or else to EXECUTOR_PORT.
+ * A registered server that is still starting or stopping, or holds the data directory without
+ * answering, is waited for, up to 30 seconds.
+ */
+export const pair = Effect.gen(function* () {
+  const directory = yield* serviceDirectory;
+  const supplied = yield* Config.Redacted("EXECUTOR_API_KEY").pipe(Config.option);
+  const found = yield* registered(directory).pipe(
+    Effect.repeat({
+      while: (found) => Option.isSome(found) && found.value.status !== "ready",
+      schedule: Schedule.spaced("250 millis").pipe(Schedule.upTo({ duration: startingWait })),
+    }),
+  );
+  if (Option.isSome(found) && found.value.status !== "ready")
+    return yield* new PairFailed({
+      reason: found.value.status,
+      server: new URL(found.value.url).host,
+      directory,
+      keys: Option.isSome(supplied) ? "supplied" : "registered",
+    });
+  const service = Option.map(found, ({ status: _status, ...running }) => running);
+  const origins = Option.map(service, ({ url, browserOrigin }) =>
+    serverOrigins(url, browserOrigin),
+  );
+  const target: PairingTarget = Option.isSome(supplied)
+    ? {
+        url: Option.isSome(service) ? service.value.url : yield* portUrl,
+        credential: supplied.value,
+        directory,
+        keys: "supplied",
+        ...(Option.isSome(origins) ? { origins: origins.value } : {}),
+      }
+    : Option.isSome(service)
+      ? {
+          url: service.value.url,
+          credential: service.value.password,
+          directory,
+          keys: "registered",
+          ...(Option.isSome(origins) ? { origins: origins.value } : {}),
+        }
+      : yield* new PairFailed({ reason: "no-server", directory, keys: "registered" });
+  const link = yield* pairingLink(target);
+  yield* Console.log(Redacted.value(link.url));
+});
diff --git a/apps/local/server/src/implementation/process-identity.ts b/apps/local/server/src/implementation/process-identity.ts
new file mode 100644
index 0000000000..72f9707259
--- /dev/null
+++ b/apps/local/server/src/implementation/process-identity.ts
@@ -0,0 +1,337 @@
+/**
+ * Which process a pid names, exactly. Once a process exits, the operating system may give its pid
+ * to another program, so a record that must name one process says more than its pid.
+ *
+ * On Linux and macOS a record holds the start time the operating system keeps for the process and
+ * the boot that time belongs to. Every process is looked up the same way, this one included, so a
+ * process's own record equals what another process reads for it, and two records are compared only
+ * for equality.
+ *
+ * Windows keeps a start time too, but Node and Bun read another process's only by starting a
+ * program such as PowerShell, which takes seconds on a busy machine, longer than a check can wait.
+ * There a process that must be recognised listens on a named pipe for as long as it may be checked
+ * (`holdPipe`), and its record names the pipe. Windows removes a pipe once the last process
+ * listening on it has exited, however it ended, and keeps it while that process is suspended, so
+ * whether the pipe still exists (`pipeHolder`) says whether that process runs, whatever its pid
+ * names now. Nothing here starts a program on Windows.
+ */
+import { createServer } from "node:net";
+import {
+  Duration,
+  Effect,
+  Exit,
+  FileSystem,
+  Option,
+  Predicate,
+  Result,
+  Schema,
+  Stream,
+} from "effect";
+import { Base64Url } from "effect/encoding";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+/**
+ * How long one lookup may take. macOS starts `ps` for a start time and `sysctl` for the boot, which
+ * take milliseconds, and longer on a busy machine.
+ */
+const lookupTimeout = Duration.seconds(10);
+
+/** The operating system could not say when a process started, or which boot this is. */
+export class ProcessLookupFailed extends Schema.TaggedError<ProcessLookupFailed>()(
+  "ProcessLookupFailed",
+  { detail: Schema.String },
+) {}
+
+/** This process could not listen on a named pipe, so other processes cannot tell that it runs. */
+export class PipeUnavailable extends Schema.TaggedError<PipeUnavailable>()("PipeUnavailable", {
+  detail: Schema.String,
+}) {}
+
+/** Signal 0 checks that a process exists; EPERM means it exists under another user. */
+export const processExists = (pid: number) =>
+  Effect.try(() => process.kill(pid, 0)).pipe(
+    Effect.as(true),
+    Effect.catch((error) =>
+      Effect.succeed(
+        Schema.is(Schema.Struct({ cause: Schema.Struct({ code: Schema.Literal("EPERM") }) }))(
+          error,
+        ),
+      ),
+    ),
+  );
+
+const failed = (detail: string) => Effect.fail(new ProcessLookupFailed({ detail }));
+
+/** A lookup program, by its full path, and the directory it runs in. */
+interface Program {
+  readonly command: string;
+  readonly cwd: string;
+}
+
+/** Run one lookup program: its exit code and trimmed standard output. */
+const run = (
+  program: Program,
+  args: ReadonlyArray<string>,
+  env: Readonly<Record<string, string>> = {},
+) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const child = yield* spawner.spawn(
+        ChildProcess.make(program.command, args, {
+          cwd: program.cwd,
+          env: { ...env },
+          extendEnv: true,
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "ignore",
+        }),
+      );
+      const [code, output] = yield* Effect.all(
+        [child.exitCode, child.stdout.pipe(Stream.decodeText(), Stream.mkString)],
+        { concurrency: "unbounded" },
+      );
+      return { code: Number(code), output: output.trim() };
+    }),
+  ).pipe(
+    Effect.timeout(lookupTimeout),
+    Effect.mapError(
+      (cause) => new ProcessLookupFailed({ detail: `${program.command} failed: ${String(cause)}` }),
+    ),
+  );
+
+/**
+ * Linux: field 22 of `/proc/<pid>/stat`, the clock ticks from boot to the process's start. A
+ * zombie has exited, though its pid still shows until its parent collects it.
+ */
+const linuxStarted = (pid: number) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const stat = yield* fs
+      .readFileString(`/proc/${pid}/stat`)
+      .pipe(Effect.mapError((cause) => new ProcessLookupFailed({ detail: String(cause) })));
+    // The command name, field 2, is in parentheses and may hold spaces; field 3 follows it.
+    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const [state, started] = [fields[0], fields[19]];
+    if (state === undefined || started === undefined || !/^\d+$/u.test(started))
+      return yield* failed(`/proc/${pid}/stat could not be read`);
+    return state === "Z" || state === "X" ? Option.none<string>() : Option.some(started);
+  });
+
+/**
+ * macOS: `ps` prints the second the process started, in UTC whatever the user's time zone, so the
+ * same process always reads the same. It prints nothing for a pid no process has.
+ */
+const macStarted = (pid: number) =>
+  Effect.gen(function* () {
+    const { code, output } = yield* run(
+      { command: "/bin/ps", cwd: "/" },
+      ["-o", "stat=", "-o", "lstart=", "-p", String(pid)],
+      { LC_ALL: "C", TZ: "UTC0" },
+    );
+    if (code === 1 && output === "") return Option.none<string>();
+    const match = /^(\S+)\s+(\S.*)$/u.exec(output);
+    if (code !== 0 || match === null) return yield* failed(`ps could not read process ${pid}`);
+    const [, state = "", started = ""] = match;
+    return state.startsWith("Z") ? Option.none<string>() : Option.some(started);
+  });
+
+type LookupServices = FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner;
+
+/**
+ * When the process `pid` started, as its operating system records it, in a form that only this
+ * machine's boot can compare. None when no process has the pid, or only one that has exited. Fails
+ * when the operating system does not say, as when a lookup tool is missing or times out, and on
+ * Windows, which is never asked.
+ */
+export const processStartedAt = (pid: number) =>
+  Effect.gen(function* () {
+    if (!(yield* processExists(pid))) return Option.none<string>();
+    const started: Effect.Effect<
+      Option.Option<string>,
+      ProcessLookupFailed,
+      LookupServices
+    > = process.platform === "linux"
+      ? linuxStarted(pid)
+      : process.platform === "darwin"
+        ? macStarted(pid)
+        : failed(`Process start times are not read on ${process.platform}`);
+    // A process that exits while it is looked up leaves nothing to read.
+    return yield* started.pipe(
+      Effect.catch((error) =>
+        Effect.flatMap(processExists(pid), (alive) =>
+          alive ? Effect.fail(error) : Effect.succeed(Option.none<string>()),
+        ),
+      ),
+    );
+  });
+
+/**
+ * Which boot of which machine this is, as far as a start time needs it. Linux counts start times
+ * from boot, as the reader's time namespace offsets that clock, so this is its boot ID, with the
+ * pid namespace whose pids a record names and the reader's time namespace; kernels before 5.6 have
+ * none. macOS names each boot session with a new UUID. Windows reads no start times.
+ */
+const bootLookup = Effect.gen(function* () {
+  if (process.platform === "linux") {
+    const fs = yield* FileSystem.FileSystem;
+    const read = Effect.mapError((cause) => new ProcessLookupFailed({ detail: String(cause) }));
+    const boot = yield* fs.readFileString("/proc/sys/kernel/random/boot_id").pipe(read);
+    const pids = yield* fs.readLink("/proc/self/ns/pid").pipe(read);
+    const time = yield* fs.readLink("/proc/self/ns/time").pipe(
+      Effect.catchIf(
+        (error) => Predicate.isTagged(error.reason, "NotFound"),
+        () => Effect.succeed("time:none"),
+      ),
+      read,
+    );
+    return `${boot.trim()} ${pids} ${time}`;
+  }
+  if (process.platform === "darwin") {
+    const { code, output } = yield* run({ command: "/usr/sbin/sysctl", cwd: "/" }, [
+      "-n",
+      "kern.bootsessionuuid",
+    ]);
+    if (code !== 0 || output === "") return yield* failed("sysctl did not name this boot");
+    return output;
+  }
+  return yield* failed(`Boots are not identified on ${process.platform}`);
+});
+
+/** This boot, as `bootLookup` reads it. Read once per process; a failed read is tried again. */
+export const bootIdentity = Effect.runSync(
+  Effect.cachedWithTTL(bootLookup, (exit) => (Exit.isSuccess(exit) ? Duration.infinity : 0)),
+);
+
+/**
+ * A process as a record names it: its pid, and on Linux and macOS its start time and boot when
+ * they could be read.
+ */
+export interface RecordedProcess {
+  readonly pid: number;
+  readonly started?: string | undefined;
+  readonly boot?: string | undefined;
+}
+
+/**
+ * This process's start time and boot, or why they could not be read. Read once per process. None
+ * on Windows, where a process is named by the pipe it listens on instead.
+ */
+const ownLookup = Effect.runSync(
+  Effect.cached(
+    Effect.gen(function* () {
+      if (process.platform === "win32") return {};
+      const [started, boot] = yield* Effect.all([processStartedAt(process.pid), bootIdentity], {
+        concurrency: "unbounded",
+      });
+      if (Option.isNone(started))
+        return yield* failed("This process was not found among the running processes");
+      return { started: started.value, boot };
+    }).pipe(Effect.result),
+  ),
+);
+
+/**
+ * This process as it records itself. Read once per process, as `processStartedAt` and
+ * `bootIdentity` read every process, so another process reading it finds the same. Only its pid on
+ * Windows, and when either cannot be read; `ownProcessUnread` says why.
+ */
+export const ownProcess = Effect.map(ownLookup, (lookup): RecordedProcess => ({
+  pid: process.pid,
+  ...(Result.isSuccess(lookup) ? lookup.success : {}),
+}));
+
+/** Why this process could not read its own start time or boot, when it could not. */
+export const ownProcessUnread = Effect.map(ownLookup, Result.getFailure);
+
+/** A pipe name as `holdPipe` chooses it, so a record can name nothing else for `pipeHolder` to open. */
+export const PipeName = Schema.String.check(
+  Schema.isPattern(/^\\\\\.\\pipe\\executor-lock-[\w-]{32}$/u),
+);
+
+/**
+ * Windows: listen on a named pipe with a new random name for the current scope and return that
+ * name, so other processes can tell with `pipeHolder` whether this one still runs. Every connection
+ * is closed at once; nothing is read or written. The pipe never keeps this process running, and the
+ * processes it starts do not inherit it.
+ */
+export const holdPipe = Effect.gen(function* () {
+  const name = `\\\\.\\pipe\\executor-lock-${Base64Url.encode(
+    globalThis.crypto.getRandomValues(new Uint8Array(24)),
+  )}`;
+  yield* Effect.acquireRelease(
+    Effect.callback<ReturnType<typeof createServer>, PipeUnavailable>((resume) => {
+      const server = createServer((connection) => connection.destroy());
+      server.once("error", (cause) =>
+        resume(Effect.fail(new PipeUnavailable({ detail: String(cause) }))),
+      );
+      server.listen(name, () => {
+        server.unref();
+        resume(Effect.succeed(server));
+      });
+    }),
+    (server) =>
+      Effect.callback<void>((resume) => {
+        server.close(() => resume(Effect.void));
+      }),
+  );
+  return name;
+});
+
+/**
+ * Windows: where the process listening on `pipe`, as `holdPipe` chose it, is now. Opening the pipe
+ * connects to it: that succeeds while its process listens, also while it is suspended, until the
+ * connections it has not accepted fill the pipe's few instances, and then fails at once with
+ * EBUSY. Either way it runs. Once that process has exited, also when it was killed, Windows has
+ * removed the pipe, so the name is not found. The pipe is opened rather than read with `stat`,
+ * which now and then finds no pipe while checks overlap although its process listens. `unknown`
+ * for any other failure.
+ */
+export const pipeHolder = (pipe: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* Effect.scoped(fs.open(pipe, { flag: "r" })).pipe(
+      Effect.as<ProcessState>("running"),
+      Effect.catchIf(
+        (error) => Predicate.isTagged(error.reason, "Busy"),
+        () => Effect.succeed<ProcessState>("running"),
+      ),
+      Effect.catchIf(
+        (error) => Predicate.isTagged(error.reason, "NotFound"),
+        () => Effect.succeed<ProcessState>("exited"),
+      ),
+      Effect.orElseSucceed((): ProcessState => "unknown"),
+    );
+  });
+
+/**
+ * Where the process a record names is now:
+ * - `running`: on this boot, its pid runs with the start time it recorded.
+ * - `exited`: on this boot, no process has its pid, or another process does.
+ * - `elsewhere`: it was recorded on another boot or machine, or without its start time, as on
+ *   Windows, so this machine's processes say nothing about it.
+ * - `unknown`: this boot, or the start time of the process its pid now names, cannot be read.
+ *
+ * Only `running` and `exited` are certain; callers treat `elsewhere` and `unknown` alike.
+ * `pipeHolder` gives the same states on Windows.
+ */
+export type ProcessState = "running" | "exited" | "elsewhere" | "unknown";
+
+/** Where the process `recorded` names is now. */
+export const recordedProcess = (
+  recorded: RecordedProcess,
+): Effect.Effect<ProcessState, never, LookupServices> =>
+  Effect.gen(function* () {
+    if (recorded.started === undefined || recorded.boot === undefined) return "elsewhere";
+    // A pid no process has needs no start time, only the boot that says the record is this one's.
+    const exists = yield* processExists(recorded.pid);
+    const boot = yield* bootIdentity.pipe(Effect.option);
+    if (Option.isNone(boot)) return "unknown";
+    if (boot.value !== recorded.boot) return "elsewhere";
+    if (!exists) return "exited";
+    const started = yield* processStartedAt(recorded.pid).pipe(Effect.option);
+    if (Option.isNone(started)) return "unknown";
+    return Option.isSome(started.value) && started.value.value === recorded.started
+      ? "running"
+      : "exited";
+  });
diff --git a/apps/local/server/src/implementation/process-output.ts b/apps/local/server/src/implementation/process-output.ts
new file mode 100644
index 0000000000..e20c605d6e
--- /dev/null
+++ b/apps/local/server/src/implementation/process-output.ts
@@ -0,0 +1,163 @@
+/**
+ * The CLI's console, written through the process's stdout and stderr streams.
+ *
+ * Bun's native `console.log` and `console.error` write a non-blocking pipe once and drop what the
+ * pipe does not take, so the release executable's piped output stopped at 64 KiB. Node queues
+ * pipe writes, and `process.exit` drops the ones still queued. The streams wait for the pipe, and
+ * `teardown` exits once every write the console made has reached it.
+ *
+ * A terminal keeps the runtime's own console, which writes it in full and keeps its formatting,
+ * such as Bun's red errors. `isatty` leaves that process stream unopened: Bun makes a process
+ * stream non-blocking once it exists.
+ *
+ * A reader that closes the pipe early, as `head` does, ends the command quietly. Any other failed
+ * write, such as a full disk, ends it too, is reported once on stderr, and fails the command.
+ * A server keeps serving instead: its clients, not its output's reader, decide when it stops. It
+ * drops what it cannot write and reports any other failed write once on its other stream.
+ */
+import { Console as NodeConsole } from "node:console";
+import { createWriteStream } from "node:fs";
+import { Writable, finished } from "node:stream";
+import { isatty } from "node:tty";
+import { Cause, Effect, Exit, Runtime, type Console } from "effect";
+
+/** After a signal, waits at most this long for the output, since a reader that stopped reading
+ * would otherwise hold up shutdown. */
+const signalDrainMs = 500;
+
+/**
+ * Where the console writes one of the process's descriptors. On Windows a process stream writes a
+ * pipe synchronously, so a reader that stopped reading blocked the whole process at its next log:
+ * a server could neither answer nor stop. There the descriptor is written with the file system's
+ * asynchronous writes, which wait in a worker thread instead. Elsewhere the process stream already
+ * waits for the pipe without blocking.
+ */
+const descriptor = (fd: 1 | 2, stream: () => NodeJS.WriteStream): Writable =>
+  process.platform === "win32" ? createWriteStream("", { fd, autoClose: false }) : stream();
+
+const end = (stream: Writable | undefined, then: () => void) => {
+  if (stream === undefined) return then();
+  finished(stream, () => then());
+  stream.end();
+};
+
+const makeOutput = () => {
+  let closeOutput = () => {};
+  const closed = new Promise<void>((resolve) => {
+    closeOutput = resolve;
+  });
+  /** The first write a process stream refused, other than a reader closing the pipe. */
+  let writeFailure: unknown;
+  /** Whether the command serves until it is stopped, so its output never ends it. */
+  let serving = false;
+
+  const refused = (output: "stdout" | "stderr", error: unknown) => {
+    const readerClosed =
+      typeof error === "object" && error !== null && "code" in error && error.code === "EPIPE";
+    if (!readerClosed && writeFailure === undefined) {
+      writeFailure = error;
+      const message = `Executor could not write its output: ${error instanceof Error ? error.message : String(error)}`;
+      // A command's stdout can be another program's input; a server's is only its log.
+      if (output === "stdout") processConsole.error(message);
+      else if (serving) processConsole.log(message);
+    }
+    if (!serving) closeOutput();
+  };
+
+  /**
+   * Passes each write on and finishes it when the process stream has written it. Once the process
+   * stream refuses a write, the rest are dropped.
+   */
+  const forward = (output: "stdout" | "stderr", target: Writable) => {
+    let failed = false;
+    // The write the process stream has not finished; a failure finishes it too.
+    let pending: (() => void) | undefined;
+    const fail = (error: unknown) => {
+      if (failed) return;
+      failed = true;
+      refused(output, error);
+      pending?.();
+    };
+    target.on("error", fail);
+    return new Writable({
+      decodeStrings: false,
+      write: (chunk, encoding, callback) => {
+        if (failed) return callback();
+        const done = () => {
+          if (pending !== done) return;
+          pending = undefined;
+          callback();
+        };
+        pending = done;
+        try {
+          target.write(chunk, encoding, (error) => {
+            if (error) fail(error);
+            done();
+          });
+        } catch (error) {
+          // Bun throws a failed write to a file, such as /dev/full, instead of reporting it.
+          fail(error);
+        }
+      },
+    });
+  };
+
+  const stdout = isatty(1)
+    ? undefined
+    : forward(
+        "stdout",
+        descriptor(1, () => process.stdout),
+      );
+  const stderr = isatty(2)
+    ? undefined
+    : forward(
+        "stderr",
+        descriptor(2, () => process.stderr),
+      );
+  const toStdout = stdout === undefined ? globalThis.console : new NodeConsole({ stdout });
+  const toStderr = stderr === undefined ? globalThis.console : new NodeConsole({ stdout: stderr });
+  const processConsole: Console.Console = {
+    ...toStdout,
+    assert: toStderr.assert,
+    error: toStderr.error,
+    trace: toStderr.trace,
+    warn: toStderr.warn,
+  };
+
+  /**
+   * runMain's teardown, which exits only once the console's output is written: it ends a failed
+   * or interrupted command with process.exit, which drops output a pipe has not taken yet. A
+   * failed write fails a command that otherwise succeeded.
+   */
+  const teardown: Runtime.Teardown = (exit, onExit) =>
+    Runtime.defaultTeardown(exit, (code) => {
+      let exited = false;
+      const done = () => {
+        if (exited) return;
+        exited = true;
+        clearTimeout(deadline);
+        onExit(writeFailure !== undefined && code === 0 ? 1 : code);
+      };
+      const deadline =
+        Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause)
+          ? setTimeout(done, signalDrainMs)
+          : undefined;
+      // stdout first, so stderr is still open to report a failed write.
+      end(stdout, () => end(stderr, done));
+    });
+
+  return {
+    console: processConsole,
+    /** Completes when a command that is not serving can no longer write its output. */
+    closed: Effect.promise(() => closed),
+    /** Runs a command that serves until it is stopped, which output it cannot write never ends. */
+    serve: <A, E, R>(command: Effect.Effect<A, E, R>) =>
+      Effect.suspend(() => {
+        serving = true;
+        return command;
+      }),
+    teardown,
+  };
+};
+
+export const processOutput = makeOutput();
diff --git a/apps/local/server/src/implementation/server-process.ts b/apps/local/server/src/implementation/server-process.ts
new file mode 100644
index 0000000000..838a21f661
--- /dev/null
+++ b/apps/local/server/src/implementation/server-process.ts
@@ -0,0 +1,535 @@
+/**
+ * `executor serve`: this data directory's Executor server, in one of three modes.
+ *
+ * - `foreground` serves until interrupted and prints how to connect.
+ * - `service` is the background service a client starts detached. It runs with its saved
+ *   settings, prints nothing, and serves until asked to stop.
+ * - `stdio` is a private server for one parent. It prints its URL as one JSON line once ready
+ *   and stops when its standard input closes.
+ *
+ * Every mode listens before anything else and holds the data directory's lock before opening
+ * storage; only a running Executor from before the background service, which holds no lock, is
+ * checked first. Foreground and service servers register in `server.json`, so local clients share
+ * them.
+ * Adapted from OpenCode (MIT, Copyright (c) 2025 opencode).
+ */
+import { homedir } from "node:os";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import {
+  Config,
+  ConfigProvider,
+  Console,
+  Deferred,
+  Effect,
+  Exit,
+  FileSystem,
+  Layer,
+  Option,
+  Redacted,
+  Schedule,
+  Schema,
+  Scope,
+  Stdio,
+  Stream,
+} from "effect";
+import { Base64Url } from "effect/encoding";
+import { HttpClient, HttpClientResponse } from "effect/http";
+import { listenPortConfig } from "../contracts/config.ts";
+import type { LocalConfigurationReason } from "../contracts/auth.ts";
+import {
+  ServiceFailed,
+  ServiceInfo,
+  ServiceRefusal,
+  ServiceRegistration,
+  serviceInfoPath,
+  servicePasswordVariable,
+} from "../contracts/service.ts";
+import { StartupFailed } from "../contracts/startup.ts";
+import {
+  composeLocalServer,
+  listenLocal,
+  localServices,
+  lockDataDirectory,
+  reportStartupFailure,
+  type LocalListener,
+} from "../node.ts";
+import { keyStorageSetting, localConfiguration, LocalConfigurationError } from "./bootstrap.ts";
+import { ownProcess, ownProcessUnread } from "./process-identity.ts";
+import {
+  answersAs,
+  readRegistration,
+  readSettings,
+  refuseEarlierServer,
+  registeredServerRuns,
+  removeRegistration,
+  sameRegistration,
+  serviceChallenge,
+  serviceDirectory,
+  writeRegistration,
+} from "./service-files.ts";
+import { updateNotice } from "./update-notice.ts";
+
+/** How `executor serve` runs: in the foreground, as the background service, or for one parent. */
+export type ServeMode = "foreground" | "service" | "stdio";
+
+/** Another process listens on the port. */
+const inUse = (error: unknown) =>
+  Schema.is(StartupFailed)(error) && error.stage === "listen" && error.code === "EADDRINUSE";
+
+/** The port this server listens on, and whether EXECUTOR_PORT chose it over the `port` setting. */
+interface Listening {
+  readonly port: number;
+  readonly variable: boolean;
+}
+
+const portInUse = (listening: Listening, executor = false) =>
+  new ServiceFailed({
+    reason: "port-in-use",
+    detail: String(listening.port),
+    ...(listening.variable ? { variable: true } : {}),
+    ...(executor ? { executor: true } : {}),
+  });
+
+/** A `--standalone` parent chooses its child's password; it must not stay in the environment. */
+const parentPassword = Config.schema(
+  Schema.Redacted(Schema.String.check(Schema.isMinLength(32))),
+  servicePasswordVariable,
+).pipe(
+  Effect.mapError(
+    () =>
+      new LocalConfigurationError({
+        reason: "misconfigured",
+        message: `\`executor serve --stdio\` needs ${servicePasswordVariable}: a password of at least 32 characters chosen by the process that starts it. Nothing was started.`,
+      }),
+  ),
+);
+
+/**
+ * Who answers on `url`: this directory's registered server, which proves it with the registration's
+ * password, another Executor server, or a program that is not one. `silent` when nothing answers
+ * within a second.
+ */
+const answering = (directory: string, url: string) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const challenge = yield* serviceChallenge;
+    const response = yield* client.get(`${url}${serviceInfoPath}?challenge=${challenge}`);
+    const info = yield* HttpClientResponse.schemaBodyJson(ServiceInfo)(response).pipe(
+      Effect.option,
+    );
+    if (Option.isNone(info)) return "foreign";
+    const registration = yield* readRegistration(directory);
+    return Option.isSome(registration) &&
+      registration.value.url === url &&
+      (yield* answersAs(registration.value, info.value, challenge))
+      ? "registered"
+      : "executor";
+  }).pipe(
+    Effect.timeout("1 second"),
+    Effect.orElseSucceed(() => "silent" as const),
+    Effect.provide(NodeHttpClient.layerNodeHttp),
+  );
+
+/**
+ * Listen in the foreground or for one parent. A port this directory's registered server holds
+ * means the directory is in use, not that another program took the port, also while that server is
+ * too busy or suspended to answer. Only a registration naming this URL can mean that, so a
+ * program on a port no registration names is not probed.
+ */
+const listenOwn = (directory: string, listening: Listening, password: Redacted.Redacted<string>) =>
+  listenLocal({ port: listening.port, password }).pipe(
+    Effect.catchIf(inUse, () =>
+      Effect.gen(function* () {
+        const url = `http://127.0.0.1:${listening.port}`;
+        const registration = yield* readRegistration(directory);
+        if (Option.isNone(registration) || registration.value.url !== url)
+          return yield* portInUse(listening);
+        const answer = yield* answering(directory, url);
+        return yield* answer === "registered" ||
+        (answer === "silent" && (yield* registeredServerRuns(directory, registration.value)))
+          ? new ServiceFailed({ reason: "directory-in-use", detail: directory, url })
+          : portInUse(listening, answer === "executor");
+      }),
+    ),
+  );
+
+/**
+ * Listen as the background service. Clients that race to start it choose the same port, so the
+ * port decides between their servers. One that finds the port taken by another program fails at
+ * once. Otherwise it waits up to 15 seconds: it exits quietly, returning `undefined`, once this
+ * directory's registered server answers there, and takes the port if it comes free. An Executor
+ * server that still holds it then serves another data directory.
+ */
+const listenService = (
+  directory: string,
+  listening: Listening,
+  password: Redacted.Redacted<string>,
+) =>
+  Effect.gen(function* () {
+    const { port } = listening;
+    const scope = yield* Effect.scope;
+    // Each attempt owns its socket, closed when the attempt fails.
+    const attempt = Scope.fork(scope).pipe(
+      Effect.flatMap((child) =>
+        listenLocal({ port, password }).pipe(
+          Scope.provide(child),
+          Effect.onError(() => Scope.close(child, Exit.void)),
+        ),
+      ),
+    );
+    const first = yield* attempt.pipe(
+      Effect.map(Option.some),
+      Effect.catchIf(inUse, () => Effect.succeedNone),
+    );
+    if (Option.isSome(first)) return first.value;
+    const url = `http://127.0.0.1:${port}`;
+    let executor = false;
+    const waited = yield* Effect.gen(function* () {
+      const answer = yield* answering(directory, url);
+      if (answer === "registered") return undefined;
+      // An Executor server that is starting or stopping answers its info route at once.
+      if (answer === "foreign") return yield* portInUse(listening);
+      executor = answer === "executor";
+      yield* Effect.sleep("100 millis");
+      return yield* attempt;
+    }).pipe(Effect.retry({ while: inUse }), Effect.timeoutOption("15 seconds"));
+    if (Option.isNone(waited)) return yield* portInUse(listening, executor);
+    return waited.value;
+  });
+
+/**
+ * What identifies a file: its device, inode, size and modification time, as far as the platform
+ * reports them. None once it cannot be read, as after it was removed.
+ */
+const fileIdentity = (file: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const info = yield* fs.stat(file);
+    return [
+      info.dev,
+      Option.getOrUndefined(info.ino),
+      info.size,
+      Option.getOrUndefined(info.mtime)?.getTime(),
+    ].join(":");
+  }).pipe(Effect.option);
+
+/**
+ * Advertise this server in `server.json` before opening storage, so clients wait for it instead of
+ * starting another. Every 5 seconds it checks that the file still names it and that its executable
+ * is still the file it started from, and stops once either is not.
+ * `group`: this server leads its own process group, as a client starts a background server.
+ */
+const register = (
+  platform: string,
+  directory: string,
+  listener: LocalListener,
+  password: Redacted.Redacted<string>,
+  group: boolean,
+) =>
+  Effect.gen(function* () {
+    const browserOrigin = yield* Config.String("EXECUTOR_BROWSER_ORIGIN").pipe(Config.option);
+    const registration = ServiceRegistration.make({
+      id: listener.id,
+      version: listener.version,
+      url: listener.url,
+      // The same process record the lock holds, so a client can tell this process from another
+      // that is later given its pid.
+      ...(yield* ownProcess),
+      password: Redacted.value(password),
+      ...(group ? { group: true } : {}),
+      ...(Option.isSome(browserOrigin) ? { browserOrigin: browserOrigin.value } : {}),
+    });
+    yield* writeRegistration(platform, directory, registration);
+    yield* Effect.addFinalizer(() =>
+      removeRegistration(directory, registration).pipe(Effect.ignore),
+    );
+    const owned = readRegistration(directory).pipe(
+      Effect.map(
+        (current) =>
+          Option.isSome(current) &&
+          sameRegistration(current.value, registration) &&
+          current.value.password === registration.password,
+      ),
+    );
+    yield* owned.pipe(
+      Effect.repeat({ schedule: Schedule.spaced("5 seconds"), while: (owns) => owns }),
+      Effect.andThen(Effect.logWarning("Local server registration was replaced or removed")),
+      Effect.andThen(listener.stop("registration replaced")),
+      Effect.forkScoped,
+    );
+    // The release executable, or the Node or Bun that runs the CLI, as it was at the start.
+    // `brew upgrade`, `npm i -g` and the install script remove or replace it and the runtime files
+    // beside it without stopping this server, so it stops then and the next client starts the
+    // version installed now. `executor upgrade` stops the server itself first.
+    const fs = yield* FileSystem.FileSystem;
+    const executable = yield* fs.realPath(process.execPath).pipe(Effect.option);
+    const started = Option.isSome(executable)
+      ? yield* fileIdentity(executable.value)
+      : Option.none<string>();
+    const unchanged = Effect.gen(function* () {
+      if (Option.isNone(executable) || Option.isNone(started)) return false;
+      const current = yield* fileIdentity(executable.value);
+      return Option.isSome(current) && current.value === started.value;
+    });
+    yield* unchanged.pipe(
+      Effect.repeat({ schedule: Schedule.spaced("5 seconds"), while: (same) => same }),
+      Effect.andThen(
+        Effect.logWarning("Local server executable was replaced or removed").pipe(
+          Effect.annotateLogs({ executable: process.execPath }),
+        ),
+      ),
+      Effect.andThen(listener.stop("executable replaced")),
+      Effect.forkScoped,
+    );
+  });
+
+/**
+ * Tell the client that started this background or private server why its key setup or data
+ * directory refused to start, as one ServiceRefusal line on stderr. The error's own message follows.
+ */
+const reportRefusal =
+  (mode: ServeMode) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    effect.pipe(
+      Effect.tapError((error) => {
+        const reason: LocalConfigurationReason | undefined = Schema.is(LocalConfigurationError)(
+          error,
+        )
+          ? error.reason
+          : Schema.is(ServiceFailed)(error) && error.reason === "directory-in-use"
+            ? "locked"
+            : undefined;
+        if (mode === "foreground" || reason === undefined) return Effect.void;
+        return Schema.encodeEffect(ServiceRefusal)({ executorService: "refused", reason }).pipe(
+          Effect.flatMap(Console.error),
+          Effect.ignore,
+        );
+      }),
+    );
+
+const inputClosedReason = "standard input closed";
+/** Serve until a parent closes standard input. Its clock control still reads the same input. */
+const inputClosed = Effect.gen(function* () {
+  const stdio = yield* Stdio.Stdio;
+  yield* stdio.stdin.pipe(Stream.runDrain, Effect.ignore);
+  return inputClosedReason;
+});
+
+/**
+ * A data directory whose lock another process holds is in use by the registered server when that
+ * server proves it answers at its URL, or, when nothing answers in time, as from a server that is
+ * hung or suspended, while the registered process still runs. Otherwise the holder is not
+ * registered.
+ */
+const holderUrl = (directory: string) =>
+  Effect.gen(function* () {
+    const registration = yield* readRegistration(directory);
+    if (Option.isNone(registration)) return undefined;
+    const { url } = registration.value;
+    const answer = yield* answering(directory, url);
+    return answer === "registered" ||
+      (answer === "silent" && (yield* registeredServerRuns(directory, registration.value)))
+      ? url
+      : undefined;
+  });
+
+const serve = (
+  options: { readonly mode: ServeMode; readonly platform: string; readonly entry?: string },
+  directory: string,
+  listening: Listening,
+  password: Redacted.Redacted<string>,
+) =>
+  Effect.gen(function* () {
+    // On Linux and macOS the lock and the registration record this process's start time, which
+    // macOS reads with `ps`, so it is read while the server starts listening. Windows records none.
+    yield* Effect.forkScoped(ownProcess);
+    // Diagnostics create the data directory, so a setting that would refuse it is read first. The
+    // client that started this server learns why, as for every other key setup refusal.
+    yield* keyStorageSetting.pipe(reportRefusal(options.mode));
+    // Diagnostics start before listening, so a failure to listen is recorded. The collector runs
+    // in the scope that holds the data directory, and stops before the lock is released.
+    const locked = yield* Deferred.make<Scope.Scope>();
+    const services = yield* Layer.build(
+      // Only a foreground server logs to stderr; a client reads a private server's for its reason.
+      localServices(directory, {
+        stderr: options.mode === "foreground",
+        collectorScope: Deferred.await(locked),
+      }),
+    );
+    return yield* Effect.gen(function* () {
+      // Without its start time this server's lock and registration name only its pid, so another
+      // process takes its lock over only once it is stale, and never signals it. That is said
+      // once, in the diagnostics log and on stderr, which only a foreground server logs to.
+      // Windows reads no start time: the pipe its lock records names this server instead.
+      yield* ownProcessUnread.pipe(
+        Effect.flatMap(
+          Option.match({
+            onNone: () => Effect.void,
+            onSome: (error) =>
+              Effect.logWarning("This server could not read its own start time").pipe(
+                Effect.annotateLogs({ detail: error.detail }),
+                Effect.andThen(
+                  options.mode === "foreground"
+                    ? Effect.void
+                    : Console.error(
+                        `Executor could not read this server's start time (${error.detail}). Another Executor takes over its data directory only 30 seconds after it stops refreshing its lock.`,
+                      ),
+                ),
+              ),
+          }),
+        ),
+        Effect.forkScoped,
+      );
+      // A background server keeps no working directory someone may want to remove.
+      if (options.mode === "service")
+        yield* Effect.try(() => process.chdir(homedir())).pipe(
+          Effect.catch(() =>
+            Effect.logWarning("Background server could not change to the home directory"),
+          ),
+        );
+      // An Executor from before the background service holds no lock, and may hold the port.
+      yield* refuseEarlierServer(directory).pipe(reportRefusal(options.mode));
+      const listener =
+        options.mode === "service"
+          ? yield* listenService(directory, listening, password)
+          : yield* listenOwn(directory, listening, password);
+      if (listener === undefined)
+        return yield* Effect.logInfo("This directory's background server is already running");
+      const held = yield* lockDataDirectory(directory, { port: listener.port }).pipe(
+        Effect.catchIf(
+          (error) => Schema.is(ServiceFailed)(error) && error.reason === "directory-in-use",
+          (error) =>
+            holderUrl(directory).pipe(
+              Effect.flatMap((url) =>
+                Effect.fail(
+                  url === undefined
+                    ? error
+                    : new ServiceFailed({ reason: "directory-in-use", detail: directory, url }),
+                ),
+              ),
+            ),
+        ),
+        reportRefusal(options.mode),
+      );
+      yield* Deferred.succeed(locked, yield* Effect.scope);
+      yield* held.lost.pipe(
+        Effect.andThen(listener.stop("data directory lock lost")),
+        Effect.forkScoped,
+      );
+      if (options.mode !== "stdio")
+        yield* register(
+          options.platform,
+          directory,
+          listener,
+          password,
+          options.mode === "service",
+        );
+      const settings = yield* localConfiguration(options.platform).pipe(
+        reportRefusal(options.mode),
+      );
+      // A development desktop serves the dashboard through Vite. Release bundles define this
+      // variable as "0", which leaves Vite out of them.
+      const web =
+        process.env.EXECUTOR_DESKTOP_DEV === "1"
+          ? yield* Effect.promise(() => import("./development.ts")).pipe(
+              Effect.flatMap(({ developmentWeb }) =>
+                developmentWeb(settings, { cacheDir: ".local/vite-desktop" }),
+              ),
+            )
+          : undefined;
+      const server = yield* composeLocalServer(
+        listener,
+        { ...settings, password },
+        { product: "cli", web },
+      );
+      switch (options.mode) {
+        case "foreground": {
+          const link = yield* server.issuePairingLink;
+          const origin = settings.browserOrigin ?? server.url;
+          yield* Console.log(
+            `Executor: ${origin}\nMCP: ${origin}/mcp\nConnect (one use, expires in 5 minutes):\n${Redacted.value(link.url)}`,
+          );
+          yield* Effect.forkScoped(updateNotice(directory, options.entry));
+          break;
+        }
+        case "stdio":
+          // The parent reads this one line; the password it chose authenticates everything else.
+          // Connection links point at the browser origin, when one is configured.
+          yield* Console.log(
+            JSON.stringify({
+              url: server.url,
+              ...(settings.browserOrigin === undefined
+                ? {}
+                : { browserOrigin: settings.browserOrigin }),
+            }),
+          );
+          break;
+        case "service":
+          break;
+      }
+      const reason = yield* options.mode === "stdio"
+        ? Effect.raceFirst(listener.stopped, inputClosed)
+        : listener.stopped;
+      yield* Effect.logInfo("Local server stopping").pipe(Effect.annotateLogs({ reason }));
+      // The parent passes this through, so its user learns why its private server stopped.
+      if (options.mode === "stdio" && reason !== inputClosedReason)
+        yield* Console.error(`Executor stopped: ${reason}.`);
+    }).pipe(reportStartupFailure, Effect.provideContext(services));
+  });
+
+/**
+ * Run this data directory's server until it stops: interrupted, asked to stop, replaced in
+ * `server.json`, or, for `stdio`, when its parent closes standard input. Every finalizer runs
+ * before this completes. `entry` is the script that started the CLI, for the update notice.
+ */
+export const serveProcess = (options: {
+  readonly mode: ServeMode;
+  readonly platform: string;
+  readonly entry?: string;
+}) =>
+  Effect.gen(function* () {
+    const directory = yield* serviceDirectory;
+    const settings = yield* readSettings(directory);
+    const variable = Option.isSome(yield* Config.String("EXECUTOR_PORT").pipe(Config.option));
+    const port = yield* listenPortConfig(settings.port).pipe(
+      Effect.mapError(
+        () =>
+          new LocalConfigurationError({
+            reason: "misconfigured",
+            message:
+              "EXECUTOR_PORT must be a port number from 0 to 65535, where 0 chooses any free port. Nothing was started.",
+          }),
+      ),
+    );
+    const password =
+      options.mode === "stdio"
+        ? yield* parentPassword
+        : yield* Effect.sync(() =>
+            Redacted.make(Base64Url.encode(globalThis.crypto.getRandomValues(new Uint8Array(32)))),
+          );
+    yield* Effect.sync(() => {
+      // Tools and apps this server runs inherit its environment, which never holds the password.
+      delete process.env[servicePasswordVariable];
+      if (options.mode !== "service") return;
+      // The background server runs with its saved environment. Its data directory stays the
+      // absolute one its client chose, whatever that environment or the working directory say.
+      Object.assign(process.env, settings.env, { EXECUTOR_DATA_DIR: directory });
+      // The client that started it stops reading these pipes once it has started.
+      process.stdout.on("error", () => {});
+      process.stderr.on("error", () => {});
+    });
+    // Configuration read from here on sees the environment as just changed.
+    return yield* Effect.scoped(serve(options, directory, { port, variable }, password)).pipe(
+      Effect.provideServiceEffect(
+        ConfigProvider.ConfigProvider,
+        Effect.sync(() => ConfigProvider.fromEnv()),
+      ),
+      // Every finalizer has run once a server stops. A handle a library left open must not keep
+      // its process running, as one did on Windows after a stop request; the timer holds nothing.
+      Effect.tap(() =>
+        Effect.sync(() => {
+          setTimeout(() => process.exit(), 1_000).unref();
+        }),
+      ),
+    );
+  });
diff --git a/apps/local/server/src/implementation/server-record.ts b/apps/local/server/src/implementation/server-record.ts
deleted file mode 100644
index ff74773f60..0000000000
--- a/apps/local/server/src/implementation/server-record.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * A server started by the CLI records its process, version and command in its data directory while
- * it runs, so `executor upgrade` can say that it still runs the old version and how to restart it.
- */
-import { Effect, FileSystem, Option, Path, Schema } from "effect";
-
-export const ServerRecord = Schema.Struct({
-  pid: Schema.Number,
-  /** The release the server runs; none for development and commit builds. */
-  version: Schema.optional(Schema.String),
-  url: Schema.String,
-  command: Schema.Literals(["executor", "executor serve"]),
-});
-export type ServerRecord = typeof ServerRecord.Type;
-const ServerRecordJson = Schema.fromJsonString(ServerRecord);
-
-const recordFile = (directory: string) =>
-  Effect.map(Path.Path, (path) => path.join(directory, "server.json"));
-
-/** Keep `record` in the data directory for the current scope. Writing it never stops startup. */
-export const recordServer = (directory: string, record: ServerRecord) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const file = yield* recordFile(directory);
-    yield* Effect.acquireRelease(
-      fs.writeFileString(file, Schema.encodeSync(ServerRecordJson)(record)).pipe(Effect.ignore),
-      () => fs.remove(file, { force: true }).pipe(Effect.ignore),
-    );
-  });
-
-/** Signal 0 checks that a process exists; EPERM means it exists under another user. */
-const processExists = (pid: number) =>
-  Effect.try(() => process.kill(pid, 0)).pipe(
-    Effect.as(true),
-    Effect.catch((error) =>
-      Effect.succeed(
-        Schema.is(Schema.Struct({ cause: Schema.Struct({ code: Schema.Literal("EPERM") }) }))(
-          error,
-        ),
-      ),
-    ),
-  );
-
-/** The server recorded in `directory` if its process is still running. */
-export const runningServer = (directory: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const saved = yield* fs
-      .readFileString(yield* recordFile(directory))
-      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(ServerRecordJson)), Effect.option);
-    if (Option.isNone(saved)) return undefined;
-    return (yield* processExists(saved.value.pid)) ? saved.value : undefined;
-  });
diff --git a/apps/local/server/src/implementation/server.ts b/apps/local/server/src/implementation/server.ts
index 4cc615e5e0..986eb0b0a8 100644
--- a/apps/local/server/src/implementation/server.ts
+++ b/apps/local/server/src/implementation/server.ts
@@ -5,7 +5,7 @@ import {
   annotateSkillRead,
 } from "@executor-js/app-templates/executor";
 import { localAppBrowserHandlers } from "./app-browser.ts";
-import { accountChoiceRefusal } from "./account-choice.ts";
+import { accountChoiceRejections } from "./account-choice.ts";
 import { startupPhase } from "./startup-diagnostics.ts";
 import {
   startScheduleWorker,
@@ -44,6 +44,7 @@ import {
   CurrentCaller,
   hostedExecutorOrigin,
   remoteRegistry,
+  requestRejections,
 } from "@executor-js/sdk/core";
 import { filesystemBlobStore, workerdApps } from "@executor-js/sdk/node";
 import { officialCatalogUrl } from "@executor-js/catalog";
@@ -53,7 +54,6 @@ import {
   Layer,
   Option,
   Path,
-  Redacted,
   Ref,
   Result,
   Deferred,
@@ -73,9 +73,11 @@ import { installExecutorApp } from "./executor-app.ts";
 import { localSkills } from "./app-browser.ts";
 import { localMcp } from "./mcp.ts";
 import { dashboard } from "./dashboard.ts";
-import { makeLocalAuth, authHandlers, type LocalAuth } from "./auth.ts";
+import { makeLocalAuth, authHandlers, localBearer, type LocalAuth } from "./auth.ts";
 import { LocalWebhookSetupApi } from "../contracts/webhook-setup.ts";
 import { localWebhookSetupHandlers } from "./webhook-setup.ts";
+import { DesktopReturnApi } from "../contracts/desktop-return.ts";
+import { makeDesktopReturns } from "./desktop-return.ts";
 import { accountConnectHandlers, connectForApp } from "./account-connections.ts";
 import { localOwner, localOwners } from "./owners.ts";
 import { appUi } from "./app-ui.ts";
@@ -91,7 +93,7 @@ import { webFiles } from "./web.ts";
 import { withHostPipeline } from "@executor-js/dashboard-start/in-process";
 import { layerBuildHeader } from "@executor-js/dashboard-start/build-header";
 import { LocalExecutorApi, localManagementDocument } from "../contracts/management.ts";
-import { nativeRepositories } from "@executor-js/app-source/node";
+import { bundledGit, nativeRepositories, systemGit } from "@executor-js/app-source/node";
 import { feedbackDisabled } from "@executor-js/telemetry/product-analytics";
 import { LocalFeedbackApi } from "../contracts/feedback.ts";
 import type { Caller } from "apps/contracts";
@@ -164,7 +166,12 @@ export const localApi = (
           Config.withDefault(hostedExecutorOrigin),
         ),
       );
-      const repositories = nativeRepositories(path.join(directory, "repositories"));
+      // A release names the Git it bundles; a source checkout uses the Git on PATH.
+      const git = Option.match(
+        yield* Config.NonEmptyString("EXECUTOR_GIT_DIRECTORY").pipe(Config.option),
+        { onNone: () => systemGit, onSome: bundledGit },
+      );
+      const repositories = nativeRepositories(path.join(directory, "repositories"), git);
       const server = yield* Scope.Scope;
       const evaluation = yield* declarationConfig;
       // MCP grants are checked again before each event delivery; OAuth starts after the executor.
@@ -275,7 +282,7 @@ export const localApi = (
           // Browser reads use the separate dashboard API; these routes remain programmatic.
           if (request.headers.origin !== undefined)
             return HttpServerResponse.empty({ status: 403 });
-          if (request.headers.authorization !== `Bearer ${Redacted.value(config.apiKey)}`) {
+          if (!localBearer(config, request.headers.authorization)) {
             return HttpServerResponse.empty({ status: 401 });
           }
           const pathname = yield* Effect.try(() =>
@@ -376,7 +383,7 @@ export const localApi = (
             }),
           ),
           // A choice the contract cannot decode is refused as a decoded one is.
-          Layer.provide(accountChoiceRefusal.layer),
+          Layer.provide(accountChoiceRejections),
         ),
         HttpApiBuilder.layer(LocalFeedbackApi).pipe(
           Layer.provide(
@@ -435,7 +442,6 @@ export const localApi = (
         HttpRouter.add("POST", "/_executor/api/telemetry/logs", ui.telemetry("logs")),
         HttpRouter.add("GET", appSignInCallbackPath, signIn.callback),
         HttpRouter.add("GET", "/_executor/version", ui.versions),
-        HttpRouter.add("GET", "/_executor/watch.js", ui.watch),
         HttpRouter.add("GET", "/_executor/assets/:version/*", ui.asset),
         // Keep the GET/HEAD SPA fallback out of host-owned namespaces. Unregistered methods already return 404.
         HttpRouter.add("GET", "/_executor/*", notFound),
@@ -463,6 +469,8 @@ export const localApi = (
         },
       );
       const web = options.web ?? (yield* webFiles);
+      // Executor desktop asks for the callbacks of the OAuth authorizations it opens in a browser.
+      const desktopReturns = yield* makeDesktopReturns(config);
       // Dashboard-host routes never include the app-origin APIs.
       const publicSkills = yield* readExecutorSkills;
       const authoring = yield* localAppManagement(
@@ -477,8 +485,9 @@ export const localApi = (
         layerBuildHeader,
         publishedSkillRoutes(Effect.succeed(publicSkills)),
         HttpApiBuilder.layer(LocalWebhookSetupApi).pipe(
-          Layer.provide(localWebhookSetupHandlers(executor, config, auth)),
+          Layer.provide(localWebhookSetupHandlers(executor, config, auth, wakeWebhookSources)),
         ),
+        HttpApiBuilder.layer(DesktopReturnApi).pipe(Layer.provide(desktopReturns.handlers)),
         HttpRouter.add("*", "/api/webhooks/:appId/:subscriptionId", webhookCallback(executor)),
         authoring,
         options.devtools === undefined ? Layer.empty : options.devtools(auth, config),
@@ -525,12 +534,12 @@ export const localApi = (
         ),
         HttpRouter.add("GET", "/", web.document),
         HttpRouter.add("GET", "/apps", web.document),
-        HttpRouter.add("GET", "/apps/add/custom", web.document),
         HttpRouter.add("GET", "/apps/:app", web.document),
         HttpRouter.add("GET", "/app-auth", signIn.signIn(web.document)),
         HttpRouter.add("GET", "/apps/:app/setup", web.document),
         HttpRouter.add("GET", "/apps/:app/delete", web.document),
-        HttpRouter.add("GET", "/connect", web.document),
+        HttpRouter.add("GET", "/connections", web.document),
+        HttpRouter.add("GET", "/connections/:connection", web.document),
         HttpRouter.add("GET", "/approvals", web.document),
         HttpRouter.add("GET", "/approvals/:run", web.document),
         HttpRouter.add("GET", "/account-connect/:connection", web.document),
@@ -539,17 +548,12 @@ export const localApi = (
         HttpRouter.add("GET", "/accounts/:account/disconnect", web.document),
         // Manual webhook setup links issued to agents open this dashboard page.
         HttpRouter.add("GET", "/webhooks/:app/:subscription", web.document),
-        HttpRouter.add(
-          "GET",
-          OAuthCallbackPath,
-          options.oauthCallback === undefined
-            ? web.document
-            : options.oauthCallback(`http://127.0.0.1:${config.port}`)(web.document),
-        ),
+        HttpRouter.add("GET", OAuthCallbackPath, desktopReturns.callback(web.document)),
         HttpRouter.add("GET", "/favicon.png", web.favicon),
         HttpRouter.add("GET", "/assets/:name", web.asset),
         HttpRouter.add("GET", "*", web.fallback),
-      );
+        // Every product API answers a request its schema rejects with `RequestInvalid`.
+      ).pipe(Layer.provide(requestRejections));
       // Each virtual host needs its own router, not the enclosing server's memoized router service.
       const appHandler = yield* HttpRouter.toHttpEffect(appRoutes).pipe(
         Effect.provideService(Layer.CurrentMemoMap, yield* Layer.makeMemoMap),
diff --git a/apps/local/server/src/implementation/service-client.ts b/apps/local/server/src/implementation/service-client.ts
new file mode 100644
index 0000000000..2b860c4923
--- /dev/null
+++ b/apps/local/server/src/implementation/service-client.ts
@@ -0,0 +1,784 @@
+/**
+ * Find, start and stop the background Executor that serves one data directory, or run a private
+ * server for one command. A client trusts `server.json` only once the server's unauthenticated
+ * info route answers as the registered process. `ensure` starts detached `serve --service`
+ * contenders until one registers; the fixed port and the server lock decide which one serves, and
+ * the others exit. Nothing here installs an OS service or login item.
+ * Adapted from OpenCode (MIT, Copyright (c) 2025 opencode).
+ */
+import { spawn } from "node:child_process";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import {
+  Clock,
+  ConfigProvider,
+  Console,
+  Deferred,
+  Duration,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Option,
+  Path,
+  Redacted,
+  Ref,
+  Schedule,
+  Schema,
+  Stream,
+} from "effect";
+import { Hex } from "effect/encoding";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import {
+  keyStorageConfig,
+  keyStorageInvalid,
+  type LocalConfigurationReason,
+} from "../contracts/auth.ts";
+import {
+  ServiceFailed,
+  ServiceInfo,
+  type ServiceRegistration,
+  ServiceRefusal,
+  serviceInfoPath,
+  servicePasswordVariable,
+  serviceStopPath,
+} from "../contracts/service.ts";
+import { processExists } from "./process-identity.ts";
+import {
+  answersAs,
+  readRegistration,
+  readSettings,
+  refuseEarlierServer,
+  registeredProcess,
+  registeredServerRuns,
+  removeRegistration,
+  sameRegistration,
+  serviceChallenge,
+  serviceVersion,
+} from "./service-files.ts";
+
+const timing = {
+  /** A new server registers within a few hundred milliseconds, so polling is frequent. */
+  poll: Duration.millis(25),
+  /** How long one info or stop request may take. */
+  request: Duration.seconds(2),
+  /** How long a registration that does not answer gets before another contender competes. */
+  spawnDelay: 5_000,
+  /** The delay doubles to this while contenders exit cleanly because another one won. */
+  maxSpawnDelay: 30_000,
+  /** Wall-clock bound on `ensure`; probes run one at a time, so attempts would drift. */
+  deadline: Duration.minutes(2),
+  exitPoll: Duration.millis(50),
+  exitPolls: 100,
+};
+/** Consecutive timeouts after which a registered server counts as hung. */
+const hungAfter = 3;
+/** How much of a failed contender's stderr its error keeps. */
+const stderrLimit = 8 * 1024;
+
+/** A server that answered as the registered process. Its password works as the local API key. */
+export interface RunningService {
+  readonly url: string;
+  readonly version: string;
+  readonly pid: number;
+  readonly password: Redacted.Redacted<string>;
+  /** Where its connection links point instead of `url`, when it has a browser origin. */
+  readonly browserOrigin?: string | undefined;
+}
+
+const running = (registration: ServiceRegistration): RunningService => ({
+  url: registration.url,
+  version: registration.version,
+  pid: registration.pid,
+  password: Redacted.make(registration.password),
+  browserOrigin: registration.browserOrigin,
+});
+
+/**
+ * What the registered address said. `ready`, `starting` and `stopping` proved they are the
+ * registered process. `incompatible` answered without this release's info route. `silent` did not
+ * answer as the registered process: nothing listens, another process answered or could not prove
+ * it is the registered one, or the request timed out.
+ */
+type Answer =
+  | { readonly state: "ready" | "starting" | "stopping" | "incompatible" }
+  | { readonly state: "silent"; readonly timedOut: boolean };
+
+const silent = (timedOut: boolean): Answer => ({ state: "silent", timedOut });
+
+/** The registered process is not there: nothing listens, or another program answered at once. */
+const absent = (answer: Answer) =>
+  answer.state === "incompatible" || (answer.state === "silent" && !answer.timedOut);
+
+/**
+ * Ask the registered address who serves it, trusting only an answer that proves, with a fresh
+ * challenge, that it holds the registration's password. The password itself is never sent.
+ */
+const probe = (registration: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const challenge = yield* serviceChallenge;
+    const response = yield* HttpClient.get(
+      `${registration.url}${serviceInfoPath}?challenge=${challenge}`,
+    );
+    if (response.status !== 200 && response.status !== 503)
+      return { state: "incompatible" } satisfies Answer;
+    const info = yield* response.json.pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(ServiceInfo)),
+      Effect.option,
+    );
+    if (Option.isNone(info)) return { state: "incompatible" } satisfies Answer;
+    // A process that is not the registered one, such as a successor that reused its port or one
+    // that replays what the registered server once answered.
+    if (!(yield* answersAs(registration, info.value, challenge))) return silent(false);
+    return { state: info.value.status } satisfies Answer;
+  }).pipe(
+    Effect.timeout(timing.request),
+    Effect.catchTag("TimeoutError", () => Effect.succeed(silent(true))),
+    Effect.catchTag("HttpClientError", () => Effect.succeed(silent(false))),
+    // node:http destroys an unanswered connection on timeout.
+    Effect.provide(NodeHttpClient.layerNodeHttp),
+  );
+
+/**
+ * The registered server: `ready`, `starting` or `stopping` when it answers as that process, as a
+ * server asked to stop answers until it exits, `unresponsive` when the request timed out while the
+ * registered process still runs, as when it is hung, suspended or too busy to answer, which `stop`
+ * then signals. None when no registered server answers or runs.
+ */
+export const registered = (directory: string) =>
+  Effect.gen(function* () {
+    const registration = yield* readRegistration(directory);
+    if (Option.isNone(registration)) return Option.none();
+    const answer = yield* probe(registration.value);
+    const status =
+      answer.state === "ready" || answer.state === "starting" || answer.state === "stopping"
+        ? answer.state
+        : answer.state === "silent" &&
+            answer.timedOut &&
+            (yield* registeredServerRuns(directory, registration.value))
+          ? ("unresponsive" as const)
+          : undefined;
+    return status === undefined
+      ? Option.none()
+      : Option.some({ ...running(registration.value), status });
+  });
+
+/**
+ * The registered server if it is ready, without starting one. With `version`, only that release.
+ */
+export const discover = (directory: string, options: { readonly version?: string } = {}) =>
+  registered(directory).pipe(
+    Effect.map(
+      Option.flatMap(({ status, ...service }): Option.Option<RunningService> =>
+        status === "ready" && (options.version === undefined || service.version === options.version)
+          ? Option.some(service)
+          : Option.none(),
+      ),
+    ),
+  );
+
+/** Whether `pid` exits within about five seconds. */
+const exits = (pid: number) =>
+  processExists(pid).pipe(
+    Effect.repeat({
+      while: (alive) => alive,
+      schedule: Schedule.spaced(timing.exitPoll).pipe(Schedule.upTo({ times: timing.exitPolls })),
+    }),
+    Effect.map((alive) => !alive),
+  );
+
+/**
+ * Signal the server `registration` names. A server that leads its own process group, as a
+ * background server does, is signalled with that group on POSIX, so the telemetry collector and
+ * app runtimes it started end with it instead of running on against its data directory. A
+ * foreground server shares its terminal's group, so only its process is signalled.
+ */
+const signal = (registration: ServiceRegistration, name: "SIGTERM" | "SIGKILL") => {
+  const { pid } = registration;
+  const one = Effect.try(() => process.kill(pid, name));
+  return (
+    registration.group === true && process.platform !== "win32"
+      ? Effect.try(() => process.kill(-pid, name)).pipe(Effect.catch(() => one))
+      : one
+  ).pipe(Effect.ignore);
+};
+
+/** Ask the server to shut down; a server that does not answer is signalled instead. */
+const requestStop = (registration: ServiceRegistration) =>
+  HttpClient.execute(
+    HttpClientRequest.post(`${registration.url}${serviceStopPath}`).pipe(
+      HttpClientRequest.bearerToken(Redacted.make(registration.password)),
+    ),
+  ).pipe(
+    Effect.timeout(timing.request),
+    Effect.ignore,
+    Effect.provide(NodeHttpClient.layerNodeHttp),
+  );
+
+/**
+ * Stop the server `registration` names, then remove the registration if it still names it.
+ * Escalation follows the process that was asked to stop, not the file, which a successor may
+ * already have replaced. Only a process that proves it is the registered one is sent the password
+ * in a stop request. One that times out, as a hung server does, is signalled without it. Each
+ * signal, SIGTERM and then SIGKILL, goes only to a pid that `registeredProcess` finds still the
+ * server's: on Linux and macOS one that runs on this boot with the start time the server
+ * registered, on Windows one the data directory's lock names whose pipe is still open. Once no
+ * process has the pid, or it is not the server's, the server has exited and escalation ends with
+ * its registration removed. When that cannot be told, it is neither signalled nor forgotten:
+ * stopping fails and the registration stays. One that is not there is waited for but never
+ * signalled, and the password is not sent to whatever listens there.
+ */
+const terminate = (directory: string, registration: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const current = yield* readRegistration(directory);
+    if (Option.isNone(current) || !sameRegistration(current.value, registration)) return;
+    const answer = yield* probe(registration);
+    const { pid } = registration;
+    /** Whether escalation ends with `name`: the server has exited, or exits after it. */
+    const endsWith = (name: "SIGTERM" | "SIGKILL") =>
+      Effect.gen(function* () {
+        if (!(yield* processExists(pid))) return true;
+        const state = yield* registeredProcess(directory, registration);
+        if (state === "exited") return true;
+        if (state !== "running") return false;
+        yield* signal(registration, name);
+        return yield* exits(pid);
+      });
+    if (absent(answer)) yield* exits(pid);
+    else {
+      const proven = answer.state !== "silent";
+      if (proven) yield* requestStop(registration);
+      if (
+        (!proven || !(yield* exits(pid))) &&
+        !(yield* endsWith("SIGTERM")) &&
+        !(yield* endsWith("SIGKILL"))
+      )
+        return yield* new ServiceFailed({ reason: "stop-failed", detail: String(pid) });
+    }
+    yield* removeRegistration(directory, registration);
+  });
+
+/** Stop the registered background server, if any. */
+export const stop = (directory: string) =>
+  Effect.gen(function* () {
+    const registration = yield* readRegistration(directory);
+    if (Option.isSome(registration)) yield* terminate(directory, registration.value);
+  });
+
+/** Node options that change how the entry script loads, which a copy of this CLI needs too. */
+const nodeOptions = (execArgv: ReadonlyArray<string>) =>
+  execArgv.flatMap((option, index) => {
+    if (index > 0 && execArgv[index - 1] === "--conditions") return [];
+    if (option === "--conditions") {
+      const value = execArgv[index + 1];
+      return value === undefined ? [] : [option, value];
+    }
+    if (option.startsWith("--conditions=") || option.startsWith("--disable-warning="))
+      return [option];
+    return [
+      "--experimental-ffi",
+      "--use-system-ca",
+      "--enable-source-maps",
+      "--no-addons",
+      "--no-warnings",
+    ].includes(option)
+      ? [option]
+      : [];
+  });
+
+/**
+ * The command that runs this CLI again. A release executable runs itself; Node or Bun runs the
+ * entry script it started with.
+ */
+export const selfCommand = Effect.gen(function* () {
+  const path = yield* Path.Path;
+  const runtime = path.basename(process.execPath, path.extname(process.execPath)).toLowerCase();
+  if (runtime !== "node" && runtime !== "nodejs" && runtime !== "bun")
+    return [process.execPath] as const;
+  const entry = process.argv[1];
+  if (entry === undefined)
+    return yield* new ServiceFailed({
+      reason: "start-failed",
+      detail: "Executor could not tell which script started it, so it cannot start a server.",
+    });
+  const script = path.resolve(entry);
+  return runtime === "bun"
+    ? ([process.execPath, script] as const)
+    : ([process.execPath, ...nodeOptions(process.execArgv), script] as const);
+});
+
+/**
+ * The environment a server this client starts runs with. EXECUTOR_API_KEY and
+ * EXECUTOR_ENCRYPTION_KEY together supply a data directory's keys. One without the other is a
+ * client's credential, which the client sends as its bearer; the server would refuse to start
+ * with half a key pair, so neither is passed on.
+ */
+const serverEnvironment = (
+  env: Readonly<Record<string, string | undefined>>,
+): Record<string, string | undefined> => {
+  if (env.EXECUTOR_API_KEY !== undefined && env.EXECUTOR_ENCRYPTION_KEY !== undefined)
+    return { ...env };
+  const { EXECUTOR_API_KEY: _apiKey, EXECUTOR_ENCRYPTION_KEY: _encryptionKey, ...rest } = env;
+  return rest;
+};
+
+const startFailed = (detail: string, configuration?: LocalConfigurationReason) =>
+  new ServiceFailed({
+    reason: "start-failed",
+    detail,
+    ...(configuration === undefined ? {} : { configuration }),
+  });
+
+/** A failed server's output without its refusal line, and the reason that line gave. */
+const refused = (output: string) => {
+  const lines = output.split("\n");
+  const reasons = lines.flatMap((line) =>
+    Option.toArray(Schema.decodeUnknownOption(ServiceRefusal)(line.trim())),
+  );
+  const text = lines
+    .filter((line) => Option.isNone(Schema.decodeUnknownOption(ServiceRefusal)(line.trim())))
+    .join("\n")
+    .trim();
+  return { text, configuration: reasons[0]?.reason };
+};
+
+/** One detached start attempt and the end of what it wrote to stderr. */
+interface Contender {
+  readonly pid: number | undefined;
+  /** The attempt exited, or could not start. */
+  readonly finished: () => boolean;
+  /** It exited with code 0, which a contender does when another server won. */
+  readonly clean: () => boolean;
+  readonly failure: () => ServiceFailed | undefined;
+  /** Stop keeping its output, but keep draining it so the server never blocks on stderr. */
+  readonly release: () => void;
+  /** Ask the attempt to exit with SIGTERM, unless it already has. */
+  readonly terminate: () => void;
+  /** Completes once its process has exited, or could not start. */
+  readonly exited: Effect.Effect<void>;
+}
+
+/**
+ * Start one detached `serve --service`. Node's spawner is used directly because Effect's keeps a
+ * piped stream referenced, which would hold this command open for as long as the server runs.
+ * Here the child and its stderr are unreferenced: the command exits when its own work is done.
+ */
+const startContender = (
+  command: ReadonlyArray<string>,
+  directory: string,
+  env: Readonly<Record<string, string | undefined>>,
+) =>
+  Effect.try({
+    try: (): Contender => {
+      const [executable = "", ...args] = command;
+      const child = spawn(executable, args, {
+        cwd: directory,
+        env,
+        detached: true,
+        windowsHide: true,
+        stdio: ["ignore", "ignore", "pipe"],
+      });
+      const decoder = new TextDecoder();
+      let output = "";
+      let error: ServiceFailed | undefined;
+      let closed = false;
+      const exited = Deferred.makeUnsafe<void>();
+      const keep = (chunk: Uint8Array) => {
+        output = (output + decoder.decode(chunk, { stream: true })).slice(-stderrLimit);
+      };
+      child.stderr.on("data", keep);
+      if ("unref" in child.stderr && typeof child.stderr.unref === "function") child.stderr.unref();
+      child.once("error", (cause) => {
+        error = startFailed(`Executor could not run ${executable}: ${cause.message}`);
+        Deferred.doneUnsafe(exited, Effect.void);
+      });
+      child.once("exit", () => {
+        Deferred.doneUnsafe(exited, Effect.void);
+      });
+      child.once("close", () => {
+        closed = true;
+      });
+      child.unref();
+      const ended = () =>
+        child.exitCode !== null
+          ? `exited with code ${child.exitCode}`
+          : `ended by ${child.signalCode}`;
+      return {
+        pid: child.pid,
+        finished: () => error !== undefined || closed,
+        clean: () => child.exitCode === 0,
+        failure: () => {
+          if (error !== undefined) return error;
+          if ((child.exitCode === null || child.exitCode === 0) && child.signalCode === null)
+            return undefined;
+          const { text, configuration } = refused(output);
+          return startFailed(text === "" ? `The server ${ended()}.` : text, configuration);
+        },
+        release: () => {
+          child.stderr.off("data", keep);
+          child.stderr.resume();
+          output = "";
+        },
+        // Node signals nothing once it has seen the child exit, so a reused pid is never hit.
+        terminate: () => {
+          child.kill("SIGTERM");
+        },
+        exited: Deferred.await(exited),
+      };
+    },
+    catch: (cause) =>
+      startFailed(`Executor could not start ${command[0] ?? "itself"}: ${String(cause)}`),
+  });
+
+/**
+ * One `ensure` call's start attempts. At most two run at once: one candidate and one that
+ * competes if the first stalls before taking the server lock. The first failure is kept, and no
+ * replacement starts after it, so a crash is reported instead of retried until the deadline.
+ */
+const contenderPool = () => {
+  const contenders = new Set<Contender>();
+  let failure: ServiceFailed | undefined;
+  let spawnDelay = timing.spawnDelay;
+  let lastSpawn = 0;
+  return {
+    failure: () => failure,
+    /** A registered server answered, so the next attempt waits the base delay again. */
+    answered: () => {
+      spawnDelay = timing.spawnDelay;
+    },
+    /** The server `pid` is being replaced: forget its attempt, finished ones and their failure. */
+    evict: (pid: number) => {
+      for (const contender of contenders)
+        if (contender.pid === pid || contender.finished()) {
+          contender.release();
+          contenders.delete(contender);
+        }
+      failure = undefined;
+      lastSpawn = 0;
+    },
+    /** Let the next attempt start without waiting. */
+    recruitNow: (now: number) => {
+      lastSpawn = now - spawnDelay;
+    },
+    /** Collect finished attempts; the kept failure once none is left running. */
+    reap: () => {
+      const finished = [...contenders].filter((contender) => contender.finished());
+      failure ??= finished
+        .map((contender) => contender.failure())
+        .find((found) => found !== undefined);
+      if (finished.some((contender) => contender.clean()))
+        spawnDelay = Math.min(spawnDelay * 2, timing.maxSpawnDelay);
+      for (const contender of finished) contenders.delete(contender);
+      return contenders.size === 0 ? failure : undefined;
+    },
+    /** A registration that has not answered yet gets one spawn delay before an attempt competes. */
+    shouldRecruit: (registered: boolean, now: number) => {
+      if (lastSpawn === 0 && registered) lastSpawn = now;
+      return failure === undefined && contenders.size < 2 && now - lastSpawn >= spawnDelay;
+    },
+    add: (contender: Contender, now: number) => {
+      contenders.add(contender);
+      lastSpawn = now;
+    },
+    /**
+     * `ensure` is done with its attempts. Each one that is not the registered server `pid` is
+     * still before or at listening, so it is asked to exit; left running, it could take the port
+     * once that server stops and register as a background server no client asked for.
+     */
+    dismiss: (pid: number | undefined) => {
+      for (const contender of contenders) {
+        contender.release();
+        if (contender.pid !== pid) contender.terminate();
+      }
+    },
+  };
+};
+
+/** Why `ensure` is starting a server; `previous` is the version it replaces. */
+export interface ServiceStart {
+  readonly version: string;
+  readonly previous?: string;
+}
+
+/** What a command says on stderr while it starts or replaces the background server. */
+export const announceStart = (start: ServiceStart) =>
+  Console.error(
+    start.previous === undefined
+      ? "Starting background Executor..."
+      : `Restarting background Executor (running ${start.previous}, this is ${start.version})...`,
+  );
+
+/**
+ * A ready background server for `directory`, started if needed. `replace` stops a server that runs
+ * another version and starts this one; `ignore` uses whatever runs. A contender is never killed for
+ * being slow; a registered server that times out three probes in a row is. Once this returns, every
+ * contender it started that is not the registered server is asked to exit.
+ */
+export const ensure = (
+  directory: string,
+  options: {
+    readonly version: "replace" | "ignore";
+    readonly onStart?: (start: ServiceStart) => Effect.Effect<void>;
+    /**
+     * Runs as each start attempt begins, with its process ID and an effect that completes once it
+     * has exited. A caller that may itself be ended before `ensure` is done, so `ensure` never asks
+     * the attempts to exit, can use it to end them.
+     */
+    readonly onAttempt?: (attempt: {
+      readonly pid: number;
+      readonly exited: Effect.Effect<void>;
+    }) => Effect.Effect<void>;
+    /**
+     * The program that runs `serve --service`, as `selfCommand` names it, and the version its
+     * servers report. This CLI and its own version by default. `env`, when given, replaces this
+     * process's environment as the one servers start with; the saved `env` setting and the data
+     * directory still apply on top, and a lone EXECUTOR_API_KEY or EXECUTOR_ENCRYPTION_KEY is
+     * still left out.
+     */
+    readonly program?: {
+      readonly command: ReadonlyArray<string>;
+      readonly version: string;
+      readonly env?: Readonly<Record<string, string | undefined>>;
+    };
+  },
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const version = options.program?.version ?? (yield* serviceVersion);
+    const onStart = options.onStart ?? announceStart;
+    const pool = contenderPool();
+    let timeouts:
+      | { readonly registration: ServiceRegistration; readonly count: number }
+      | undefined;
+    let announced = false;
+    const announce = (previous?: string) =>
+      Effect.suspend(() => {
+        if (announced) return Effect.void;
+        announced = true;
+        return onStart(previous === undefined ? { version } : { version, previous });
+      });
+    const recruit = Effect.gen(function* () {
+      const settings = yield* readSettings(directory);
+      const env = serverEnvironment({
+        ...(options.program?.env ?? process.env),
+        ...settings.env,
+        EXECUTOR_DATA_DIR: directory,
+      });
+      // The server refuses an invalid key storage setting before it creates anything, so it is
+      // checked here first, before the data directory is created for it to start in.
+      yield* keyStorageConfig.pipe(
+        Effect.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromEnvRecord(env)),
+        Effect.mapError(() => startFailed(keyStorageInvalid, "misconfigured")),
+      );
+      yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+      const command = options.program?.command ?? (yield* selfCommand);
+      return yield* startContender([...command, "serve", "--service"], directory, env);
+    });
+
+    const attempt = Effect.gen(function* () {
+      const now = yield* Clock.currentTimeMillis;
+      const found = yield* readRegistration(directory);
+      const answer = Option.isSome(found) ? yield* probe(found.value) : silent(false);
+      // A registered process that has exited, as after a crash, no longer answers: forget its
+      // registration and start a server at once, also when its pid now names another program or
+      // it ran on another boot. One that may still run gets a spawn delay to finish stopping.
+      const stale =
+        Option.isSome(found) &&
+        absent(answer) &&
+        !(yield* registeredServerRuns(directory, found.value));
+      if (stale) yield* removeRegistration(directory, found.value);
+      const registration = stale ? Option.none<ServiceRegistration>() : found;
+      if (Option.isSome(registration) && answer.state === "silent" && answer.timedOut) {
+        const count =
+          timeouts !== undefined && sameRegistration(timeouts.registration, registration.value)
+            ? timeouts.count + 1
+            : 1;
+        timeouts = { registration: registration.value, count };
+        if (count >= hungAfter) {
+          yield* announce();
+          yield* terminate(directory, registration.value);
+          pool.evict(registration.value.pid);
+          pool.recruitNow(now);
+          timeouts = undefined;
+        }
+      } else timeouts = undefined;
+
+      if (Option.isSome(registration) && answer.state !== "silent") {
+        pool.answered();
+        // A server that was asked to stop is going away, so it is waited for, not stopped or
+        // joined; one starts once its registration is gone.
+        if (answer.state === "stopping") return Option.none<RunningService>();
+        if (options.version === "replace" && registration.value.version !== version) {
+          yield* announce(registration.value.version);
+          yield* stop(directory).pipe(Effect.ignore);
+          pool.evict(registration.value.pid);
+          return Option.none<RunningService>();
+        }
+        if (answer.state === "incompatible")
+          return yield* startFailed(
+            `${registration.value.url} does not answer as an Executor server for ${directory}. Run \`executor service restart\` to replace it.`,
+          );
+        return answer.state === "ready"
+          ? Option.some(running(registration.value))
+          : Option.none<RunningService>();
+      }
+
+      const failed = pool.reap();
+      if (failed !== undefined) return yield* failed;
+      if (pool.shouldRecruit(Option.isSome(registration), now)) {
+        // An Executor from before the background service holds no lock; another server would
+        // open its databases too.
+        yield* refuseEarlierServer(directory);
+        yield* announce();
+        const contender = yield* recruit;
+        pool.add(contender, now);
+        if (contender.pid !== undefined && options.onAttempt !== undefined)
+          yield* options.onAttempt({ pid: contender.pid, exited: contender.exited });
+      }
+      return Option.none<RunningService>();
+    });
+
+    const found = yield* attempt.pipe(
+      Effect.repeat({
+        until: Option.isSome,
+        schedule: Schedule.spaced(timing.poll).pipe(Schedule.upTo({ duration: timing.deadline })),
+      }),
+      // The server found keeps running, or else whichever one registered meanwhile.
+      Effect.onExit((exit) =>
+        Effect.gen(function* () {
+          const server =
+            Exit.isSuccess(exit) && Option.isSome(exit.value)
+              ? exit.value.value.pid
+              : Option.getOrUndefined(yield* readRegistration(directory))?.pid;
+          yield* Effect.sync(() => pool.dismiss(server));
+        }),
+      ),
+    );
+    if (Option.isNone(found))
+      return yield* pool.failure() ?? new ServiceFailed({ reason: "start-timeout", detail: "" });
+    return found.value;
+  });
+
+/** The readiness line a `serve --stdio` child prints on stdout. */
+const StandaloneReady = Schema.fromJsonString(
+  Schema.Struct({ url: Schema.String, browserOrigin: Schema.optional(Schema.String) }),
+);
+/** How long a private server gets to stop once its stdin closes, before it is killed. */
+const standaloneStop = Duration.seconds(5);
+
+/** This command's private server did not start; `detail` is what it said, if anything. */
+const privateFailed = (detail: string, configuration?: LocalConfigurationReason) =>
+  new ServiceFailed({
+    reason: "start-failed",
+    detail,
+    standalone: true,
+    ...(configuration === undefined ? {} : { configuration }),
+  });
+
+/**
+ * A private server for this command's scope: `serve --stdio` on a free port, with a password
+ * only this process knows. The child stops when its stdin closes, so it ends with this process
+ * even if the scope never closes. When the scope closes, its stdin is closed first and it gets a
+ * few seconds to stop before it is killed, which on Windows ends it without any cleanup. Its
+ * stderr is kept until it is ready, so a failure states the child's own reason, and passed through
+ * from then on. `exited` fails once the child stops on its own, saying how it ended.
+ */
+export const standalone = Effect.gen(function* () {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const [executable, ...args] = yield* selfCommand.pipe(
+    Effect.mapError((error) => privateFailed(error.detail)),
+  );
+  const password = yield* Effect.sync(() =>
+    Redacted.make(Hex.encode(crypto.getRandomValues(new Uint8Array(32)))),
+  );
+  const closing = yield* Deferred.make<void>();
+  const child = yield* spawner
+    .spawn(
+      ChildProcess.make(executable, [...args, "serve", "--stdio"], {
+        env: serverEnvironment({
+          ...process.env,
+          EXECUTOR_PORT: "0",
+          [servicePasswordVariable]: Redacted.value(password),
+        }),
+        extendEnv: false,
+        // Nothing is written; the stream ends, closing the child's stdin, once `closing` completes.
+        stdin: Stream.fromEffectDrain(Deferred.await(closing)),
+        stdout: "pipe",
+        stderr: "pipe",
+        killSignal: "SIGTERM",
+        forceKillAfter: "3 seconds",
+      }),
+    )
+    .pipe(
+      Effect.mapError((cause) =>
+        privateFailed(`Executor could not start ${executable}: ${cause.message}`),
+      ),
+    );
+  const ready = yield* Deferred.make<typeof StandaloneReady.Type, ServiceFailed>();
+  // What the child wrote on stderr while it started; none once it is ready and passed through.
+  const held = yield* Ref.make(Option.some(""));
+  const show = (text: string) => (text === "" ? Effect.void : Console.error(text));
+  const stderr = yield* child.stderr.pipe(
+    Stream.decodeText(),
+    Stream.splitLines,
+    Stream.runForEach((line) =>
+      Ref.modify(held, (kept) =>
+        Option.isSome(kept)
+          ? [Effect.void, Option.some(`${kept.value}${line}\n`.slice(-stderrLimit))]
+          : [Console.error(line), kept],
+      ).pipe(Effect.flatten),
+    ),
+    Effect.ignore,
+    Effect.forkScoped,
+  );
+  // Keep reading stdout after readiness so a later write never fails with EPIPE.
+  yield* child.stdout.pipe(
+    Stream.decodeText(),
+    Stream.splitLines,
+    Stream.runForEach((line) =>
+      Option.match(Schema.decodeUnknownOption(StandaloneReady)(line), {
+        onNone: () => Effect.void,
+        onSome: (line) =>
+          Ref.getAndSet(held, Option.none()).pipe(
+            Effect.flatMap((kept) => show(Option.getOrElse(kept, () => "").trimEnd())),
+            Effect.andThen(Deferred.succeed(ready, line)),
+          ),
+      }),
+    ),
+    Effect.ignore,
+    // Once stdout ends, the rest of stderr follows within moments.
+    Effect.ensuring(
+      Fiber.join(stderr).pipe(
+        Effect.timeout("2 seconds"),
+        Effect.ignore,
+        Effect.andThen(Ref.get(held)),
+        Effect.flatMap((kept) => {
+          const { text, configuration } = refused(Option.getOrElse(kept, () => ""));
+          return Deferred.fail(
+            ready,
+            privateFailed(text === "" ? "It exited before it was ready." : text, configuration),
+          );
+        }),
+      ),
+    ),
+    Effect.forkScoped,
+  );
+  // Registered last, so it runs first: the readers above still drain the child while it stops.
+  yield* Effect.addFinalizer(() =>
+    Deferred.succeed(closing, undefined).pipe(
+      Effect.andThen(child.exitCode.pipe(Effect.timeout(standaloneStop), Effect.ignore)),
+    ),
+  );
+  const { url, browserOrigin } = yield* Deferred.await(ready);
+  const exited = child.exitCode.pipe(
+    Effect.map((code) => `exit code ${code}`),
+    Effect.orElseSucceed(() => "ended by a signal"),
+    Effect.flatMap((detail) => Effect.fail(new ServiceFailed({ reason: "exited", detail }))),
+  );
+  return {
+    url,
+    password,
+    ...(browserOrigin === undefined ? {} : { browserOrigin }),
+    exited,
+  };
+});
diff --git a/apps/local/server/src/implementation/service-files.ts b/apps/local/server/src/implementation/service-files.ts
new file mode 100644
index 0000000000..f203dc235b
--- /dev/null
+++ b/apps/local/server/src/implementation/service-files.ts
@@ -0,0 +1,483 @@
+/**
+ * The background service's files in a data directory: the running server's registration, the lock
+ * it holds and the settings it starts with. Servers, clients and the desktop share these readers
+ * and the lock rule, so all agree on the contract.
+ */
+import { stat } from "node:fs/promises";
+import { connect } from "node:net";
+import { hostname } from "node:os";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import { Clock, Config, Console, Deferred, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { HttpClient, HttpClientResponse } from "effect/http";
+import { lock, type LockOptions } from "proper-lockfile";
+import { BrowserSession } from "../contracts/auth.ts";
+import {
+  dataDirectoryConfig,
+  EarlierServerRecord,
+  ServiceFailed,
+  type ServiceInfo,
+  ServiceRegistration,
+  ServiceSettingInvalid,
+  ServiceSettings,
+  serviceLockFile,
+  serviceRegistrationFile,
+  serviceSettingsFile,
+} from "../contracts/service.ts";
+import { writeAtomically } from "./atomic-file.ts";
+import {
+  holdPipe,
+  ownProcess,
+  PipeName,
+  pipeHolder,
+  processExists,
+  type ProcessState,
+  type RecordedProcess,
+  recordedProcess,
+} from "./process-identity.ts";
+
+/** What a server reports as its version; development builds share one. */
+export const serviceVersion = Config.String("EXECUTOR_BUILD_VERSION").pipe(
+  Config.withDefault("0.0.0-dev"),
+);
+
+/** The absolute data directory this process uses. */
+export const serviceDirectory = Effect.gen(function* () {
+  const path = yield* Path.Path;
+  return path.resolve(yield* dataDirectoryConfig);
+});
+
+const RegistrationJson = Schema.fromJsonString(ServiceRegistration);
+const EarlierJson = Schema.fromJsonString(EarlierServerRecord);
+const SettingsJson = Schema.fromJsonString(ServiceSettings);
+
+/**
+ * Whether a TCP connection to `url` is refused, which is the only sign that nothing listens on
+ * it. Fetch cannot tell: Bun's, which the release executable runs, reports every failed connect as
+ * `ConnectionRefused`, including a connection the peer accepted and reset before Bun saw it
+ * complete, as happens on Windows. A plain socket keeps the operating system's error under Node
+ * and Bun alike.
+ */
+export const connectionRefused = (url: URL) =>
+  Effect.callback<boolean>((resume) => {
+    const socket = connect({
+      host: url.hostname.replace(/^\[(.*)\]$/u, "$1"),
+      port: Number(url.port || (url.protocol === "https:" ? 443 : 80)),
+    });
+    const settle = (refused: boolean) => {
+      socket.destroy();
+      resume(Effect.succeed(refused));
+    };
+    socket.once("connect", () => settle(false));
+    socket.once("error", (error) => settle(refusedCode(error)));
+    return Effect.sync(() => socket.destroy());
+  });
+const refusedCode = Schema.is(Schema.Struct({ code: Schema.Literal("ECONNREFUSED") }));
+
+/**
+ * How long a `.server.lock` whose owner this machine cannot check, as one without an owner, still
+ * counts as held after its last refresh.
+ */
+export const serviceLockStale = 30_000;
+/**
+ * Who holds a data directory's `.server.lock`, written inside it, so it always describes that lock:
+ * the holder's process, as `ownProcess` records it, on Windows the pipe it listens on while it
+ * holds the lock, and its host, which a pipe belongs to, and for messages, for a server, its
+ * loopback port.
+ */
+const ServiceLockOwner = Schema.fromJsonString(
+  Schema.Struct({
+    pid: Schema.Int.check(Schema.isGreaterThan(0)),
+    started: Schema.optional(Schema.String),
+    boot: Schema.optional(Schema.String),
+    pipe: Schema.optional(PipeName),
+    host: Schema.String,
+    port: Schema.optional(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65535 }))),
+  }),
+);
+type ServiceLockOwner = typeof ServiceLockOwner.Type;
+
+/** Whether two records name the same process. */
+const sameProcess = (left: RecordedProcess, right: RecordedProcess) =>
+  left.pid === right.pid && left.started === right.started && left.boot === right.boot;
+
+const sameOwner = (left: ServiceLockOwner, right: ServiceLockOwner) =>
+  sameProcess(left, right) &&
+  left.pipe === right.pipe &&
+  left.host === right.host &&
+  left.port === right.port;
+
+/**
+ * Where the process a lock's owner names is now. On Windows its pipe says, when this host recorded
+ * it; one another host recorded says nothing here. Elsewhere its start time does.
+ */
+const ownerProcess = (owner: ServiceLockOwner) =>
+  owner.pipe === undefined
+    ? recordedProcess(owner)
+    : process.platform === "win32" && owner.host === hostname()
+      ? pipeHolder(owner.pipe)
+      : Effect.succeed<ProcessState>("elsewhere");
+
+/** The owner recorded in the server lock `lock`, if it is readable. */
+const readLockOwner = (lock: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* fs
+      .readFileString(path.join(lock, "owner.json"))
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(ServiceLockOwner)), Effect.option);
+  });
+
+/** Whether the server lock `lock` was last refreshed more than `serviceLockStale` ago. */
+const lockStale = (lock: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const refreshed = Option.getOrUndefined((yield* fs.stat(lock)).mtime)?.getTime() ?? 0;
+    return refreshed < (yield* Clock.currentTimeMillis) - serviceLockStale;
+  });
+
+/**
+ * Whether the held server lock `lock` was abandoned. A lock whose owner can be checked is held,
+ * however stale its time, while that owner runs, as a suspended or sleeping server does: on Linux
+ * and macOS while its pid runs on this boot with the start time it recorded, on Windows while the
+ * pipe it recorded exists. It is abandoned at once when that process has exited, as after a crash,
+ * also when its pid now names another program. A lock with no readable owner may be in the middle
+ * of being taken, and one owned on another boot or machine, recorded without a start time or pipe,
+ * or whose owner's start time, this boot or its pipe cannot be read now, cannot be checked here, so
+ * those count as held until they are 30 seconds stale.
+ */
+const lockAbandoned = (lock: string) =>
+  Effect.gen(function* () {
+    const owner = yield* readLockOwner(lock);
+    const state = Option.isSome(owner) ? yield* ownerProcess(owner.value) : "elsewhere";
+    if (state === "running") return false;
+    if (state === "exited") return true;
+    return yield* lockStale(lock);
+  }).pipe(Effect.orElseSucceed(() => false));
+
+/**
+ * Hold `<directory>/.server.lock` for the current scope. PGlite allows one process per database,
+ * so no server opens storage without this lock, whatever port it listens on, and the desktop holds
+ * it while it moves or resets the data. `owner.json` inside the lock records the holder's process,
+ * host and, for a server, which passes it, the `port` it listens on. On Windows the holder listens
+ * on a pipe for as long as it holds the lock, and `owner.json` names it: the pipe holds nothing
+ * in the directory open, so the directory can still be renamed while the lock is held. `fs` is the
+ * file system proper-lockfile uses, for a lock that moves with its directory.
+ *
+ * A lock another process holds fails with `directory-in-use` unless `lockAbandoned` says it was
+ * abandoned, as by a crashed or killed server, decided once while holding
+ * `.server.lock.takeover`, so two processes never both replace it. `lost` completes if another
+ * process takes it over or it is removed, as proper-lockfile notices at its next refresh, so a
+ * server stops instead of sharing its databases. `held` says at once whether the lock is still
+ * this process's: not lost, and `owner.json` still holds the record this process wrote.
+ */
+export const lockDataDirectory = (
+  directory: string,
+  holder: { readonly port?: number; readonly fs?: LockOptions["fs"] } = {},
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const file = path.join(directory, serviceLockFile);
+    const ownerFile = path.join(file, "owner.json");
+    const lost = yield* Deferred.make<void>();
+    const inUse = () => new ServiceFailed({ reason: "directory-in-use", detail: directory });
+    // proper-lockfile keeps one lock per path in a process. Key setup's lock already uses the
+    // directory's, so these are keyed by their own files.
+    const take = (lockfile: string, stale: number, onCompromised: () => void) =>
+      Effect.tryPromise({
+        try: () =>
+          lock(lockfile, {
+            realpath: false,
+            lockfilePath: lockfile,
+            retries: 0,
+            stale,
+            onCompromised,
+            ...(holder.fs === undefined ? {} : { fs: holder.fs }),
+          }),
+        catch: inUse,
+      });
+    const attempt = take(file, serviceLockStale, () => {
+      Deferred.doneUnsafe(lost, Effect.void);
+    });
+    const takeOver = Effect.scoped(
+      Effect.gen(function* () {
+        yield* Effect.acquireRelease(
+          take(`${file}.takeover`, 5_000, () => {}),
+          (release) => Effect.tryPromise(() => release()).pipe(Effect.ignore),
+        );
+        if (!(yield* lockAbandoned(file))) return yield* inUse();
+        // The abandoned lock is renamed aside in one step, then removed. Another starter's first
+        // attempt removes a stale lock only while it is empty, so it cannot replace this one
+        // halfway through its removal and lose its new lock to it.
+        const aside = `${file}.abandoned`;
+        yield* fs.remove(aside, { recursive: true, force: true }).pipe(Effect.mapError(inUse));
+        yield* fs.rename(file, aside).pipe(Effect.mapError(inUse));
+        yield* fs.remove(aside, { recursive: true }).pipe(Effect.ignore);
+        return yield* attempt;
+      }),
+    );
+    // Listening first, the pipe closes only after the release below: once `owner.json` is gone, a
+    // lock without an owner counts as held, so no other process can take it over while it is
+    // released. A holder without a pipe records none, and others fall back to the 30-second rule.
+    const pipe =
+      process.platform === "win32"
+        ? yield* holdPipe.pipe(
+            Effect.tapError((error) =>
+              Effect.logWarning(
+                "This process could not listen on its lock pipe, so another process takes over its data directory only 30 seconds after it stops refreshing its lock",
+              ).pipe(Effect.annotateLogs({ detail: error.detail })),
+            ),
+            Effect.option,
+          )
+        : Option.none<string>();
+    // The record this process writes. The release compares the whole record, so a host name
+    // change cannot disown it.
+    const owner: ServiceLockOwner = {
+      ...(yield* ownProcess),
+      ...(Option.isSome(pipe) ? { pipe: pipe.value } : {}),
+      host: hostname(),
+      ...(holder.port === undefined ? {} : { port: holder.port }),
+    };
+    // An owner that could not be written leaves the lock to proper-lockfile alone, which still
+    // reports a takeover through `lost`.
+    let written = false;
+    const held = Effect.gen(function* () {
+      if (yield* Deferred.isDone(lost)) return false;
+      if (!written) return true;
+      const current = yield* fs
+        .readFileString(ownerFile)
+        .pipe(Effect.flatMap(Schema.decodeUnknownEffect(ServiceLockOwner)), Effect.option);
+      return Option.isSome(current) && sameOwner(current.value, owner);
+    });
+    yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+    yield* Effect.acquireRelease(
+      attempt.pipe(Effect.catch(() => takeOver)),
+      // The owner goes first, since only an empty lock directory can be released. A lock taken
+      // over is no longer this process's, and neither is the owner inside it, so both are removed
+      // only while the lock is still held.
+      (release) =>
+        Effect.gen(function* () {
+          if (!(yield* held)) return;
+          yield* fs.remove(ownerFile).pipe(Effect.ignore);
+          yield* Effect.tryPromise(() => release()).pipe(Effect.ignore);
+        }),
+    );
+    // Without an owner the lock still holds; only a crash then waits for it to go stale. Writing
+    // the owner changes the lock's time, which proper-lockfile would take for a takeover, so the
+    // time it recorded is restored. It reads Node's millisecond time, which rounds a time the
+    // platform's stat truncates, as for a lock taken without setting its time, after another lock.
+    yield* Effect.gen(function* () {
+      const set = yield* Effect.tryPromise(() => stat(file)).pipe(Effect.map(({ mtime }) => mtime));
+      yield* fs.writeFileString(ownerFile, yield* Schema.encodeEffect(ServiceLockOwner)(owner), {
+        mode: 0o600,
+      });
+      written = true;
+      yield* fs.utimes(file, set, set);
+    }).pipe(Effect.ignore);
+    return { lost: Deferred.await(lost), held };
+  });
+
+/**
+ * Where the server `registration` names is now, in `directory`. On Linux and macOS its pid and the
+ * start time it registered say. Windows records no start time; there the server is the process that
+ * holds the directory's lock: it runs while the lock's owner names its pid and that owner's pipe
+ * exists, and has exited once no process has its pid, its pipe is gone, or another process holds
+ * the lock. Its state is not known while its pid runs and the lock names no owner, as while a
+ * server stopping slowly has released its lock or one could not write its owner, nor when the owner
+ * that names it recorded no pipe or its pipe cannot be read.
+ */
+export const registeredProcess = (directory: string, registration: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const state = yield* recordedProcess(registration);
+    if (state === "running" || state === "exited" || process.platform !== "win32") return state;
+    const path = yield* Path.Path;
+    const owner = yield* readLockOwner(path.join(directory, serviceLockFile));
+    if (Option.isNone(owner))
+      return (yield* processExists(registration.pid)) ? "unknown" : "exited";
+    if (owner.value.pid !== registration.pid) return "exited";
+    return yield* ownerProcess(owner.value);
+  });
+
+/**
+ * Whether the server `registration` names may still run in `directory`, as `registeredProcess`
+ * tells. Never for a process that has exited, also when its pid now names another program. One
+ * this machine cannot check, as one registered on another boot or whose start time, this boot or
+ * pipe cannot be read now, runs while it holds the directory's lock and refreshed it within
+ * `serviceLockStale`, the rule the lock falls back to.
+ */
+export const registeredServerRuns = (directory: string, registration: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const state = yield* registeredProcess(directory, registration);
+    if (state === "running" || state === "exited") return state === "running";
+    const path = yield* Path.Path;
+    const lock = path.join(directory, serviceLockFile);
+    const owner = yield* readLockOwner(lock);
+    return (
+      Option.isSome(owner) &&
+      sameProcess(owner.value, registration) &&
+      !(yield* lockStale(lock).pipe(Effect.orElseSucceed(() => true)))
+    );
+  });
+
+/** Whether two registrations describe the same server process. */
+export const sameRegistration = (left: ServiceRegistration, right: ServiceRegistration) =>
+  left.id === right.id &&
+  left.pid === right.pid &&
+  left.url === right.url &&
+  left.version === right.version;
+
+/** The registered server, if any. A missing or unreadable file means none is registered. */
+export const readRegistration = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* fs
+      .readFileString(path.join(directory, serviceRegistrationFile))
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(RegistrationJson)), Effect.option);
+  });
+
+/**
+ * The base64url HMAC-SHA256 of `challenge` keyed with a server's password: what a server answers on
+ * its info route to prove it is the process a registration names.
+ */
+export const serviceProof = (password: string, challenge: string) =>
+  Effect.promise(async () => {
+    const encoder = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(password),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"],
+    );
+    const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(challenge));
+    return Base64Url.encode(new Uint8Array(signature));
+  });
+
+/** A fresh nonce for one info request. */
+export const serviceChallenge = Effect.sync(() =>
+  Base64Url.encode(globalThis.crypto.getRandomValues(new Uint8Array(24))),
+);
+
+/**
+ * Whether `info`, the answer to `challenge`, comes from the process `registration` names: it
+ * reports that process and proves it holds the registration's password.
+ */
+export const answersAs = (
+  registration: ServiceRegistration,
+  info: ServiceInfo,
+  challenge: string,
+) =>
+  Effect.gen(function* () {
+    if (
+      info.pid !== registration.pid ||
+      info.id !== registration.id ||
+      info.version !== registration.version ||
+      info.proof === undefined
+    )
+      return false;
+    return info.proof === (yield* serviceProof(registration.password, challenge));
+  });
+
+/**
+ * Whether an Executor answers its session route at `url`, as every Executor 2 server does. Only a
+ * refused connection or an answer that is not Executor's is a no: one that does not answer in
+ * time may be an Executor that is busy.
+ */
+const executorAnswers = (url: string) =>
+  HttpClient.get(`${url}/auth/session`).pipe(
+    Effect.flatMap(HttpClientResponse.schemaBodyJson(BrowserSession)),
+    Effect.as(true),
+    Effect.timeout("2 seconds"),
+    Effect.catchTag("TimeoutError", () => Effect.succeed(true)),
+    Effect.orElseSucceed(() => false),
+    Effect.provide(NodeHttpClient.layerNodeHttp),
+  );
+
+/**
+ * Fail with `directory-in-use` while an Executor from before the background service runs with this
+ * data directory, as its `server.json` names it. It holds no lock, so only its record shows that.
+ * Such a server wrote its record once it answered, so a record whose process runs while nothing
+ * answers as Executor at its URL was left by one that was killed, and its pid now belongs to
+ * another program: it is ignored, saying so on stderr, until a server replaces it.
+ */
+export const refuseEarlierServer = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const file = path.join(directory, serviceRegistrationFile);
+    const record = yield* fs
+      .readFileString(file)
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(EarlierJson)), Effect.option);
+    if (Option.isNone(record) || !(yield* processExists(record.value.pid))) return;
+    const { pid, url } = record.value;
+    // Only a loopback record can be checked from here; one naming a browser origin may sit behind
+    // a proxy this host cannot reach, so it counts as running.
+    const { hostname: host } = new URL(url);
+    if ((host === "127.0.0.1" || host === "localhost") && !(yield* executorAnswers(url)))
+      return yield* Console.error(
+        `Ignoring ${file}: it names process ${pid}, but no Executor answers at ${url}.`,
+      );
+    return yield* new ServiceFailed({
+      reason: "directory-in-use",
+      detail: directory,
+      url,
+      earlier: pid,
+    });
+  });
+
+/** Replace the registration atomically with mode 0600. */
+export const writeRegistration = (
+  platform: string,
+  directory: string,
+  registration: ServiceRegistration,
+) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const encoded = yield* Schema.encodeEffect(RegistrationJson)(registration);
+    yield* writeAtomically(
+      platform,
+      directory,
+      path.join(directory, serviceRegistrationFile),
+      encoded,
+    );
+  });
+
+/** Remove the registration only while it still names `registration`, never a successor's. */
+export const removeRegistration = (directory: string, registration: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const current = yield* readRegistration(directory);
+    if (Option.isNone(current) || !sameRegistration(current.value, registration)) return;
+    yield* fs.remove(path.join(directory, serviceRegistrationFile), { force: true });
+  });
+
+/** The background service settings; none saved means defaults. */
+export const readSettings = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const file = path.join(directory, serviceSettingsFile);
+    const text = yield* fs.readFileString(file).pipe(Effect.option);
+    if (Option.isNone(text)) return {} satisfies ServiceSettings;
+    return yield* Schema.decodeUnknownEffect(SettingsJson)(text.value).pipe(
+      Effect.mapError(
+        () =>
+          new ServiceSettingInvalid({
+            message: `${file} is not valid. Fix it or remove it, then try again.`,
+          }),
+      ),
+    );
+  });
+
+/** Save the settings atomically with mode 0600, creating the data directory if needed. */
+export const writeSettings = (platform: string, directory: string, settings: ServiceSettings) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+    const encoded = yield* Schema.encodeEffect(SettingsJson)(settings);
+    yield* writeAtomically(platform, directory, path.join(directory, serviceSettingsFile), encoded);
+  });
diff --git a/apps/local/server/src/implementation/service-settings.ts b/apps/local/server/src/implementation/service-settings.ts
new file mode 100644
index 0000000000..338b2ac1ed
--- /dev/null
+++ b/apps/local/server/src/implementation/service-settings.ts
@@ -0,0 +1,174 @@
+/**
+ * `executor service …`: start, stop and inspect the background server, and change the settings it
+ * starts with. Changing a setting saves it, then stops the running server, so whichever client
+ * starts it next, even at once, starts it with the new one.
+ * Adapted from OpenCode (MIT, Copyright (c) 2025 opencode).
+ */
+import { Console, Effect, Option } from "effect";
+import {
+  ServiceSettingInvalid,
+  type ServiceSettingKey,
+  type ServiceSettings,
+} from "../contracts/service.ts";
+import { withKeyFileNotice } from "./bootstrap.ts";
+import { ensure, registered, stop } from "./service-client.ts";
+import { readSettings, serviceDirectory, writeSettings } from "./service-files.ts";
+
+const invalid = (message: string) =>
+  new ServiceSettingInvalid({ message: `${message} Nothing was changed.` });
+
+/** `executor service start`: start the background server, or find it running, and print its URL. */
+export const serviceStart = Effect.gen(function* () {
+  const directory = yield* serviceDirectory;
+  const service = yield* withKeyFileNotice(directory, ensure(directory, { version: "ignore" }));
+  yield* Console.log(service.url);
+});
+
+export const serviceStop = Effect.gen(function* () {
+  yield* stop(yield* serviceDirectory);
+});
+
+/**
+ * `executor service restart`: this CLI's version starts in place of whatever ran, including a
+ * server of another version that another client, such as the desktop, started meanwhile.
+ */
+export const serviceRestart = Effect.gen(function* () {
+  const directory = yield* serviceDirectory;
+  yield* stop(directory);
+  const service = yield* ensure(directory, { version: "replace" });
+  yield* Console.log(service.url);
+});
+
+/** What `executor service status` prints before the URL in each state of the registered server. */
+const statusPrefix = {
+  ready: "",
+  starting: "starting ",
+  stopping: "stopping ",
+  unresponsive: "not responding ",
+};
+
+/**
+ * The registered server's URL, version and process, `starting …` while it boots, `stopping …` until
+ * it exits once asked to stop, `not responding …` while it holds the data directory without
+ * answering, or `stopped`.
+ */
+export const serviceStatus = Effect.gen(function* () {
+  const service = yield* registered(yield* serviceDirectory);
+  yield* Console.log(
+    Option.match(service, {
+      onNone: () => "stopped",
+      onSome: ({ url, version, pid, status }) =>
+        `${statusPrefix[status]}${url} (version ${version}, process ${pid})`,
+    }),
+  );
+});
+
+/** Print every setting as JSON, or one setting's value; an unset value prints nothing. */
+export const serviceGet = (input: {
+  readonly key: Option.Option<ServiceSettingKey>;
+  readonly name: Option.Option<string>;
+}) =>
+  Effect.gen(function* () {
+    const settings = yield* readSettings(yield* serviceDirectory);
+    if (Option.isNone(input.key)) return yield* Console.log(JSON.stringify(settings, null, 2));
+    const key = input.key.value;
+    if (key !== "env" && Option.isSome(input.name))
+      return yield* invalid(`Usage: executor service get ${key}.`);
+    const value =
+      key === "port"
+        ? settings.port?.toString()
+        : key === "disabled"
+          ? String(settings.disabled ?? false)
+          : Option.isSome(input.name)
+            ? settings.env?.[input.name.value]
+            : JSON.stringify(settings.env ?? {}, null, 2);
+    if (value !== undefined) yield* Console.log(value);
+  });
+
+/** `settings` with one setting changed, once its value has been checked. */
+const changed = (
+  settings: ServiceSettings,
+  key: ServiceSettingKey,
+  value: string,
+  envValue: Option.Option<string>,
+): Effect.Effect<ServiceSettings, ServiceSettingInvalid> => {
+  if (key !== "env" && Option.isSome(envValue))
+    return Effect.fail(invalid(`Usage: executor service set ${key} <value>.`));
+  switch (key) {
+    case "port": {
+      const port = Number(value);
+      return /^\d{1,5}$/u.test(value) && port >= 1 && port <= 65_535
+        ? Effect.succeed({ ...settings, port })
+        : Effect.fail(invalid(`The port must be a whole number from 1 to 65535, not ${value}.`));
+    }
+    case "disabled":
+      return value === "true" || value === "false"
+        ? Effect.succeed({ ...settings, disabled: value === "true" })
+        : Effect.fail(invalid(`disabled must be true or false, not ${value}.`));
+    case "env":
+      if (Option.isNone(envValue))
+        return Effect.fail(invalid("Usage: executor service set env <name> <value>."));
+      return value === "" || value.includes("=")
+        ? Effect.fail(invalid(`${value} is not an environment variable name.`))
+        : Effect.succeed({ ...settings, env: { ...settings.env, [value]: envValue.value } });
+  }
+};
+
+/**
+ * Save one setting. The value is checked before anything changes, and the new settings are saved
+ * before the running server stops. Turning the service back on needs no stop.
+ */
+export const serviceSet = (
+  platform: string,
+  input: {
+    readonly key: ServiceSettingKey;
+    readonly value: string;
+    readonly envValue: Option.Option<string>;
+  },
+) =>
+  Effect.gen(function* () {
+    const directory = yield* serviceDirectory;
+    const next = yield* changed(
+      yield* readSettings(directory),
+      input.key,
+      input.value,
+      input.envValue,
+    );
+    yield* writeSettings(platform, directory, next);
+    if (input.key !== "disabled" || next.disabled === true) yield* stop(directory);
+  });
+
+/** Remove one setting, then stop the running server unless that only turns the service on. */
+export const serviceUnset = (
+  platform: string,
+  input: { readonly key: ServiceSettingKey; readonly name: Option.Option<string> },
+) =>
+  Effect.gen(function* () {
+    if (input.key !== "env" && Option.isSome(input.name))
+      return yield* invalid(`Usage: executor service unset ${input.key}.`);
+    const directory = yield* serviceDirectory;
+    const settings = yield* readSettings(directory);
+    switch (input.key) {
+      case "disabled": {
+        const { disabled: _disabled, ...others } = settings;
+        return yield* writeSettings(platform, directory, others);
+      }
+      case "port": {
+        const { port: _port, ...others } = settings;
+        yield* writeSettings(platform, directory, others);
+        return yield* stop(directory);
+      }
+      case "env": {
+        if (Option.isNone(input.name))
+          return yield* invalid("Usage: executor service unset env <name>.");
+        const { [input.name.value]: _removed, ...env } = settings.env ?? {};
+        const { env: _env, ...others } = settings;
+        yield* writeSettings(
+          platform,
+          directory,
+          Object.keys(env).length === 0 ? others : { ...others, env },
+        );
+        return yield* stop(directory);
+      }
+    }
+  });
diff --git a/apps/local/server/src/implementation/standalone-install.ts b/apps/local/server/src/implementation/standalone-install.ts
index 0f00a175a2..3c60744975 100644
--- a/apps/local/server/src/implementation/standalone-install.ts
+++ b/apps/local/server/src/implementation/standalone-install.ts
@@ -3,7 +3,8 @@
  * `<root>/versions/<version>/`, with `<root>/current` pointing at the version in use and
  * `<root>/previous` at the one before it. `<root>` is `~/.executor/v2/runtime` unless the person
  * chose another directory. A command on PATH starts `current/executor`, so switching `current`
- * switches every later start; a running process keeps the files it started from.
+ * switches every later start. A switch removes older versions, so a process still running from
+ * one loses its files: `executor upgrade` stops the background server first.
  *
  * Release archives come from the public release and are checked against its SHA256SUMS before
  * anything is unpacked.
@@ -25,6 +26,13 @@ export interface StandaloneInstall {
 
 const executableName = (platform: string) => (platform === "win32" ? "executor.exe" : "executor");
 
+/** The executable of one installed version. */
+export const versionExecutable = (install: StandaloneInstall, version: string, platform: string) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    return path.join(install.root, "versions", version, executableName(platform));
+  });
+
 /**
  * The standalone install that `executable` belongs to, or none when it was installed another way.
  * Launcher symlinks resolve to the version directory, so the real path shows the layout.
@@ -108,10 +116,17 @@ const link = (root: string, name: "current" | "previous", version: string, platf
   });
 
 /**
- * Make `version` current and remember the version it replaces as previous. Versions other than
- * these two are removed; one still running, which Windows keeps open, stays until a later switch.
+ * Make `version` current and remember the version it replaces as previous. Other versions are
+ * removed, except those in `running`: versions a background server still runs from, because it
+ * could not be stopped. A removal Windows refuses, as for an open executable, is retried at a
+ * later switch.
  */
-export const switchVersion = (install: StandaloneInstall, version: string, platform: string) =>
+export const switchVersion = (
+  install: StandaloneInstall,
+  version: string,
+  platform: string,
+  running: ReadonlyArray<string>,
+) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -119,7 +134,7 @@ export const switchVersion = (install: StandaloneInstall, version: string, platf
     const replaced = Option.getOrElse(current, () => install.version);
     yield* link(install.root, "current", version, platform);
     if (replaced !== version) yield* link(install.root, "previous", replaced, platform);
-    const keep = new Set([version, replaced]);
+    const keep = new Set([version, replaced, ...running]);
     const versions = path.join(install.root, "versions");
     for (const name of yield* fs.readDirectory(versions))
       if (!keep.has(name))
@@ -169,9 +184,11 @@ export const installVersion = (
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      // GitHub answers each release download with a redirect to the file, so the status is
+      // checked on the response the redirects end at.
       const client = (yield* HttpClient.HttpClient).pipe(
-        HttpClient.filterStatusOk,
         HttpClient.followRedirects(5),
+        HttpClient.filterStatusOk,
       );
       const base = `${yield* downloadBase}/executor@${version}`;
       const file = releaseArchive(version, platform, arch);
@@ -237,7 +254,7 @@ export const installVersion = (
       const destination = path.join(versions, version);
       yield* fs.remove(destination, { recursive: true, force: true });
       yield* fs.rename(unpacked, destination);
-      const reported = yield* reportedVersion(path.join(destination, executableName(platform)));
+      const reported = yield* reportedVersion(yield* versionExecutable(install, version, platform));
       if (reported !== `executor v${version}`) {
         yield* fs.remove(destination, { recursive: true, force: true }).pipe(Effect.ignore);
         return yield* failed(
diff --git a/apps/local/server/src/implementation/upgrade.ts b/apps/local/server/src/implementation/upgrade.ts
index d99f511060..2674522c27 100644
--- a/apps/local/server/src/implementation/upgrade.ts
+++ b/apps/local/server/src/implementation/upgrade.ts
@@ -2,8 +2,9 @@
  * `executor upgrade`: install a newer release the way this copy was installed. A standalone install
  * downloads the release archive, checks it, and switches to it, keeping the version it replaced for
  * `--rollback`. An npm-family install runs its package manager, after checking that the release's
- * launcher supports this Node. Either way it runs only on request, confirms the new command works,
- * and says when a running server still uses the old version. It never restarts a server.
+ * launcher supports this Node. Either way it runs only on request and confirms the new command
+ * works. Both replace the files a running background server uses, so that server is stopped first
+ * and started again on the new version afterwards, or on this one if the upgrade fails.
  */
 import {
   compareReleaseVersions,
@@ -15,6 +16,7 @@ import {
   Console,
   Duration,
   Effect,
+  Exit,
   Option,
   Path,
   Ref,
@@ -26,14 +28,16 @@ import {
 import { Prompt } from "effect/cli";
 import { HttpClient, HttpClientResponse } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { dataDirectoryConfig } from "../contracts/config.ts";
 import { UpgradeFailed } from "../contracts/startup.ts";
-import { runningServer } from "./server-record.ts";
+import { discover, ensure, registered, stop } from "./service-client.ts";
+import { serviceDirectory } from "./service-files.ts";
 import {
   installVersion,
   linkedVersion,
+  type StandaloneInstall,
   standaloneInstall,
   switchVersion,
+  versionExecutable,
 } from "./standalone-install.ts";
 import {
   currentRelease,
@@ -180,18 +184,31 @@ const runStreaming = (command: string, args: ReadonlyArray<string>, platform: st
     }),
   );
 
-/** Start `executor --version` the way a shell would, through PATH. */
-const installedVersion = (platform: string) =>
+/** How to start the installed `executor`: through PATH, or a standalone version's executable. */
+type Installed = (args: ReadonlyArray<string>) => {
+  readonly command: string;
+  readonly args: ReadonlyArray<string>;
+};
+
+/** `executor` the way a shell would start it, through PATH. */
+const onPath =
+  (platform: string): Installed =>
+  (args) =>
+    throughShell(platform, "executor", args);
+
+/** Run the installed `executor` with `args` to exit, with its output captured. */
+const runInstalled = (
+  installed: Installed,
+  args: ReadonlyArray<string>,
+  timeout: Duration.Input,
+  env: Readonly<Record<string, string>> = {},
+) =>
   Effect.scoped(
     Effect.gen(function* () {
       const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const shell = throughShell(platform, "executor", ["--version"]);
+      const { command, args: argv } = installed(args);
       const child = yield* spawner.spawn(
-        ChildProcess.make(shell.command, shell.args, {
-          extendEnv: true,
-          stdout: "pipe",
-          stderr: "pipe",
-        }),
+        ChildProcess.make(command, argv, { extendEnv: true, env, stdout: "pipe", stderr: "pipe" }),
       );
       const [code, stdout, stderr] = yield* Effect.all(
         [
@@ -200,7 +217,7 @@ const installedVersion = (platform: string) =>
           child.stderr.pipe(Stream.decodeText(), Stream.mkString),
         ],
         { concurrency: "unbounded" },
-      ).pipe(Effect.timeout(Duration.seconds(60)));
+      ).pipe(Effect.timeout(timeout));
       return { code: Number(code), stdout: stdout.trim(), stderr: stderr.trim() };
     }),
   );
@@ -229,15 +246,153 @@ const confirm = (
     if (!accepted) return yield* failed("cancelled", "Upgrade cancelled. Nothing was changed.");
   });
 
-/** Say when a server from this data directory still runs another version. */
-const restartNotice = (target: string) =>
+/** The version a development build's server reports. It runs from a checkout, not an install. */
+const developmentVersion = "0.0.0-dev";
+
+/** Say when the background server for this data directory still runs another version. */
+const restartNotice = (directory: string, target: string) =>
   Effect.gen(function* () {
-    const path = yield* Path.Path;
-    const server = yield* runningServer(path.resolve(yield* dataDirectoryConfig));
-    if (server !== undefined && server.version !== target)
-      yield* Console.log(
-        `The Executor server at ${server.url} (process ${server.pid}) is still running ${server.version === undefined ? "a development build" : `v${server.version}`}. Stop it, then start it again with \`${server.command}\` to use v${target}.`,
+    const service = yield* discover(directory);
+    if (Option.isNone(service) || service.value.version === target) return;
+    const running =
+      service.value.version === developmentVersion
+        ? "a development build"
+        : `v${service.value.version}`;
+    yield* Console.log(
+      `The background Executor still runs ${running}. It switches to v${target} the next time you run \`executor\`, or now with \`executor service restart\`.`,
+    );
+  });
+
+/**
+ * What became of this data directory's background server before an upgrade replaced files:
+ * nothing to stop, stopped, or still running because it did not stop.
+ */
+type Paused =
+  | { readonly state: "none" }
+  | { readonly state: "stopped" }
+  | { readonly state: "running"; readonly pid: number; readonly message: string };
+
+/**
+ * Stop the background server, which may run from the files an upgrade is about to replace or
+ * remove. A development build's server runs from its checkout and keeps running.
+ */
+const pauseService = (directory: string) =>
+  Effect.gen(function* () {
+    const service = yield* registered(directory);
+    if (Option.isNone(service) || service.value.version === developmentVersion)
+      return { state: "none" } satisfies Paused;
+    yield* Console.log(
+      `Stopping the background Executor (v${service.value.version}) until the upgrade is done.`,
+    );
+    return yield* stop(directory).pipe(
+      Effect.as<Paused>({ state: "stopped" }),
+      Effect.catch((error) =>
+        Effect.succeed<Paused>({
+          state: "running",
+          pid: service.value.pid,
+          message: error.message,
+        }),
+      ),
+    );
+  });
+
+/**
+ * Run `change` with the background server paused. If it fails or is interrupted after the server
+ * stopped, this CLI, which the failed change left in place, starts the server again.
+ */
+const whilePaused = <A, E, R>(directory: string, paused: Paused, change: Effect.Effect<A, E, R>) =>
+  paused.state !== "stopped"
+    ? change
+    : change.pipe(
+        Effect.onExit((exit) =>
+          Exit.isSuccess(exit)
+            ? Effect.void
+            : ensure(directory, { version: "ignore" }).pipe(
+                Effect.asVoid,
+                Effect.catch(() =>
+                  Console.error(
+                    "The background Executor stopped for the upgrade and could not start again. Start it with `executor service start`.",
+                  ),
+                ),
+              ),
+        ),
+      );
+
+/**
+ * After a successful upgrade, start the background server it stopped with the new version's own
+ * `executor service start`, and say whether it runs that version. A server that was not stopped
+ * gets the restart notice instead. A release from before the background service, which a rollback
+ * or a downgrade can install, has no `executor service`: it refuses `service status`, which every
+ * later release answers, and its server runs in the foreground instead.
+ */
+const resumeService = (directory: string, paused: Paused, installed: Installed, version: string) =>
+  Effect.gen(function* () {
+    if (paused.state !== "stopped") return yield* restartNotice(directory, version);
+    const environment = { EXECUTOR_DATA_DIR: directory };
+    const started = yield* runInstalled(
+      installed,
+      ["service", "start"],
+      Duration.minutes(3),
+      environment,
+    ).pipe(Effect.result);
+    const service = yield* discover(directory);
+    if (Option.isSome(service))
+      return service.value.version === version
+        ? yield* Console.log(`Restarted the background Executor on v${version}.`)
+        : yield* restartNotice(directory, version);
+    const status = yield* runInstalled(
+      installed,
+      ["service", "status"],
+      Duration.seconds(30),
+      environment,
+    ).pipe(Effect.result);
+    if (Result.isSuccess(status) && status.success.code !== 0)
+      return yield* Console.error(
+        `v${version} predates the background Executor, so the one stopped for the upgrade was not started again. Run \`executor serve\`, or \`executor\` to also open the dashboard, and keep it running while your agents use Executor.`,
       );
+    const output =
+      Result.isSuccess(started) && started.success.code !== 0 && started.success.stderr !== ""
+        ? `\n${lastLines(started.success.stderr, 20)}`
+        : "";
+    yield* Console.error(
+      `The background Executor stopped for the upgrade and did not start again on v${version}.${output}\nStart it with \`executor service start\`.`,
+    );
+  });
+
+/** A standalone install's version, started from its own executable. */
+const versionInstalled = (install: StandaloneInstall, version: string, platform: string) =>
+  Effect.map(versionExecutable(install, version, platform), (command): Installed => (args) => ({
+    command,
+    args,
+  }));
+
+/**
+ * Switch a standalone install to `version` with the background server paused. A server that did
+ * not stop keeps the version it runs from installed.
+ */
+const switchPaused = (
+  directory: string,
+  install: StandaloneInstall,
+  version: string,
+  platform: string,
+) =>
+  Effect.gen(function* () {
+    const paused = yield* pauseService(directory);
+    if (paused.state === "running") yield* Console.error(paused.message);
+    yield* whilePaused(
+      directory,
+      paused,
+      Effect.gen(function* () {
+        const running = yield* registered(directory);
+        yield* switchVersion(
+          install,
+          version,
+          platform,
+          Option.toArray(Option.map(running, (service) => service.version)),
+        );
+      }),
+    );
+    return paused;
   });
 
 /** Switch a standalone install back to the version it ran before its last upgrade. */
@@ -265,11 +420,17 @@ const rollback = (options: UpgradeOptions, host: UpgradeHost) =>
       options.yes,
       undefined,
     );
-    yield* switchVersion(install.value, previous.value, host.platform);
+    const directory = yield* serviceDirectory;
+    const paused = yield* switchPaused(directory, install.value, previous.value, host.platform);
     yield* Console.log(
       `Switched Executor from v${current} back to v${previous.value}. Run executor upgrade --rollback again to return to v${current}.`,
     );
-    yield* restartNotice(previous.value);
+    yield* resumeService(
+      directory,
+      paused,
+      yield* versionInstalled(install.value, previous.value, host.platform),
+      previous.value,
+    );
   });
 
 export const upgrade = (options: UpgradeOptions, host: UpgradeHost) =>
@@ -392,11 +553,17 @@ export const upgrade = (options: UpgradeOptions, host: UpgradeHost) =>
         `Downloading Executor v${target} for ${host.platform}/${host.arch} into ${install.value.root}`,
       );
       yield* installVersion(install.value, target, host.platform, host.arch);
-      yield* switchVersion(install.value, target, host.platform);
+      const directory = yield* serviceDirectory;
+      const paused = yield* switchPaused(directory, install.value, target, host.platform);
       yield* Console.log(
         `Upgraded Executor from v${current.value} to v${target}. v${current.value} stays installed: run executor upgrade --rollback to switch back.`,
       );
-      yield* restartNotice(target);
+      yield* resumeService(
+        directory,
+        paused,
+        yield* versionInstalled(install.value, target, host.platform),
+        target,
+      );
       return;
     }
 
@@ -432,42 +599,66 @@ export const upgrade = (options: UpgradeOptions, host: UpgradeHost) =>
         undefined,
       );
 
-    yield* Console.log(`Upgrading Executor v${current.value} to v${target}: ${command}`);
-    const installed = yield* runStreaming(method, installArgs(method, target), host.platform).pipe(
-      Effect.mapError(() =>
-        failed(
-          "install-failed",
-          `${method} could not be started. Check that it is installed and on your PATH, or choose another with --method. Nothing was changed.`,
-        ),
-      ),
-    );
-    if (installed.code !== 0)
+    // The package manager replaces the files the background server runs from; Windows would refuse
+    // to replace its running executable.
+    const directory = yield* serviceDirectory;
+    const paused = yield* pauseService(directory);
+    if (paused.state === "running")
       return yield* failed(
-        "install-failed",
-        [
-          `${method} exited with code ${installed.code} and did not install Executor v${target}.`,
-          ...(installed.stderr.trim() === ""
-            ? []
-            : [`${method} reported:`, lastLines(installed.stderr, 40)]),
-          `Fix the problem it reports, then run executor upgrade again, or run: ${command}`,
-        ].join("\n"),
+        "service-running",
+        `${paused.message} ${method} would replace the files it runs from, so Executor v${target} was not installed. End process ${paused.pid}, then run executor upgrade again. Nothing was changed.`,
       );
+    yield* Console.log(`Upgrading Executor v${current.value} to v${target}: ${command}`);
+    yield* whilePaused(
+      directory,
+      paused,
+      Effect.gen(function* () {
+        const installed = yield* runStreaming(
+          method,
+          installArgs(method, target),
+          host.platform,
+        ).pipe(
+          Effect.mapError(() =>
+            failed(
+              "install-failed",
+              `${method} could not be started. Check that it is installed and on your PATH, or choose another with --method. Nothing was changed.`,
+            ),
+          ),
+        );
+        if (installed.code !== 0)
+          return yield* failed(
+            "install-failed",
+            [
+              `${method} exited with code ${installed.code} and did not install Executor v${target}.`,
+              ...(installed.stderr.trim() === ""
+                ? []
+                : [`${method} reported:`, lastLines(installed.stderr, 40)]),
+              `Fix the problem it reports, then run executor upgrade again, or run: ${command}`,
+            ].join("\n"),
+          );
 
-    const verify = (detail: string) =>
-      failed(
-        "verify-failed",
-        `${method} installed Executor v${target}, but ${detail} Run \`${host.platform === "win32" ? "where.exe executor" : "type -a executor"}\` to see which executable your shell starts, or reinstall with: ${command}`,
-      );
-    const check = yield* installedVersion(host.platform).pipe(Effect.result);
-    if (Result.isFailure(check)) return yield* verify("`executor --version` could not be started.");
-    if (check.success.code !== 0)
-      return yield* verify(
-        `\`executor --version\` failed with code ${check.success.code}${check.success.stderr === "" ? "." : `:\n${lastLines(check.success.stderr, 20)}\n`}`,
-      );
-    if (check.success.stdout !== `executor v${target}`)
-      return yield* verify(
-        `\`executor --version\` printed "${check.success.stdout}". Another installation may come first on your PATH.`,
-      );
+        const verify = (detail: string) =>
+          failed(
+            "verify-failed",
+            `${method} installed Executor v${target}, but ${detail} Run \`${host.platform === "win32" ? "where.exe executor" : "type -a executor"}\` to see which executable your shell starts, or reinstall with: ${command}`,
+          );
+        const check = yield* runInstalled(
+          onPath(host.platform),
+          ["--version"],
+          Duration.seconds(60),
+        ).pipe(Effect.result);
+        if (Result.isFailure(check))
+          return yield* verify("`executor --version` could not be started.");
+        if (check.success.code !== 0)
+          return yield* verify(
+            `\`executor --version\` failed with code ${check.success.code}${check.success.stderr === "" ? "." : `:\n${lastLines(check.success.stderr, 20)}\n`}`,
+          );
+        if (check.success.stdout !== `executor v${target}`)
+          return yield* verify(
+            `\`executor --version\` printed "${check.success.stdout}". Another installation may come first on your PATH.`,
+          );
+      }),
+    );
     yield* Console.log(`Upgraded Executor from v${current.value} to v${target}.`);
-    yield* restartNotice(target);
+    yield* resumeService(directory, paused, onPath(host.platform), target);
   });
diff --git a/apps/local/server/src/implementation/webhook-setup.ts b/apps/local/server/src/implementation/webhook-setup.ts
index d5d6a0c234..21e86a05ed 100644
--- a/apps/local/server/src/implementation/webhook-setup.ts
+++ b/apps/local/server/src/implementation/webhook-setup.ts
@@ -1,5 +1,5 @@
 /** Reuse local pairing sessions for secret exchange; link generation does not reveal setup fields. */
-import { Effect, Layer, Redacted } from "effect";
+import { Effect, Layer } from "effect";
 import { HttpApiBuilder } from "effect/http-api";
 import { HttpServerResponse } from "effect/http";
 import type { Executor } from "@executor-js/sdk/core";
@@ -7,12 +7,13 @@ import type { ServerConfig } from "../contracts/config.ts";
 import { LocalWebhookSetupApi, WebhookSetupAccess } from "../contracts/webhook-setup.ts";
 import { AuthForbidden, PairingUnauthorized } from "../contracts/auth.ts";
 import { DashboardUnauthorized } from "../contracts/dashboard.ts";
-import { localRequest, requestOrigin, sessionCookie, type LocalAuth } from "./auth.ts";
+import { localBearer, localRequest, requestOrigin, sessionCookie, type LocalAuth } from "./auth.ts";
 /** Each secret operation requires a current paired dashboard session and same-origin writes. */
 export const localWebhookSetupHandlers = (
   executor: Executor,
   config: ServerConfig,
   auth: LocalAuth,
+  wakeWebhookSources: Effect.Effect<void>,
 ) => {
   const access = Layer.succeed(WebhookSetupAccess, (response) =>
     Effect.gen(function* () {
@@ -36,7 +37,7 @@ export const localWebhookSetupHandlers = (
           const request = yield* localRequest(config.port, config.browserOrigin);
           if (
             request.headers.origin !== undefined ||
-            request.headers.authorization !== `Bearer ${Redacted.value(config.apiKey)}`
+            !localBearer(config, request.headers.authorization)
           )
             return yield* new PairingUnauthorized();
           yield* executor.webhookSetup.read(params);
@@ -52,8 +53,11 @@ export const localWebhookSetupHandlers = (
     HttpApiBuilder.group(LocalWebhookSetupApi, "webhookSetup", (handlers) =>
       handlers
         .handle("read", ({ params }) => executor.webhookSetup.read(params))
+        // A finished setup is new intent for the webhook source waiting on it.
         .handle("complete", ({ params, payload }) =>
-          executor.webhookSetup.complete({ ...params, ...payload }),
+          executor.webhookSetup
+            .complete({ ...params, ...payload })
+            .pipe(Effect.tap(() => wakeWebhookSources)),
         )
         .handle("remove", ({ params }) => executor.webhooks.remove(params))
         .handle("confirmRemoval", ({ params }) => executor.webhooks.confirmRemoval(params)),
diff --git a/apps/local/server/src/index.ts b/apps/local/server/src/index.ts
index 264eb9eedc..f96c30b08e 100644
--- a/apps/local/server/src/index.ts
+++ b/apps/local/server/src/index.ts
@@ -1,4 +1,4 @@
 /** Local server composition for CLI and desktop hosts. Importing this package opens no resources. */
 export { ServerConfig, config } from "./contracts/config.ts";
 export { localApi } from "./implementation/server.ts";
-export { DesktopBootstrap, ServerReady, LocalAuthApi } from "./contracts/auth.ts";
+export { LocalAuthApi } from "./contracts/auth.ts";
diff --git a/apps/local/server/src/main.ts b/apps/local/server/src/main.ts
index 94e72680b7..c220dd3fb8 100644
--- a/apps/local/server/src/main.ts
+++ b/apps/local/server/src/main.ts
@@ -1,9 +1,11 @@
-/** Headless entry retained for local process supervisors; shares the CLI's server lifecycle. */
+/** Headless entry retained for local process supervisors; serves like `executor serve`. */
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { Effect } from "effect";
-import { launch } from "./implementation/launcher.ts";
+import { serveProcess } from "./implementation/server-process.ts";
 
 NodeRuntime.runMain(
-  Effect.scoped(launch("headless", process.platform)).pipe(Effect.provide(NodeServices.layer)),
+  Effect.scoped(serveProcess({ mode: "foreground", platform: process.platform })).pipe(
+    Effect.provide(NodeServices.layer),
+  ),
 );
diff --git a/apps/local/server/src/node.ts b/apps/local/server/src/node.ts
index 6abf167adf..1d96373d37 100644
--- a/apps/local/server/src/node.ts
+++ b/apps/local/server/src/node.ts
@@ -1,117 +1,254 @@
-import { ScheduleHostReady } from "@executor-js/sdk/scheduling";
-/** Node composition edge shared by the CLI and a future desktop child process. */
-import { createReadStream } from "node:fs";
+/**
+ * Node composition edge shared by the CLI's foreground, background and private servers.
+ *
+ * A local server binds its port first and answers its service routes at once. It then takes its
+ * data directory's lifetime lock, and only then opens storage and composes the product. Every
+ * other request answers 503 until the product is ready, and again once it starts closing.
+ */
 import { createServer } from "node:http";
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import * as NodeStream from "@effect/platform-node/NodeStream";
-import { localTelemetry } from "@executor-js/telemetry/local";
-import { Deferred, Effect, Layer, Schema } from "effect";
-import { HttpRouter, HttpServer } from "effect/http";
-import { DesktopBootstrap } from "./contracts/auth.ts";
-import type { LocalServerOptions } from "./contracts/server.ts";
-export type {
-  LocalHttpMiddleware,
-  LocalOAuthCallback,
-  LocalServerOptions,
-  LocalWeb,
-} from "./contracts/server.ts";
+import { ScheduleHostReady } from "@executor-js/sdk/scheduling";
+import { localTelemetry, type LocalTelemetryOptions } from "@executor-js/telemetry/local";
+import { Deferred, Effect, Layer, Option, Redacted, Ref, Schema, Scope } from "effect";
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { NetAddress } from "effect/net";
+import { AuthForbidden } from "./contracts/auth.ts";
 import type { ServerConfig } from "./contracts/config.ts";
+import type { LocalServerOptions } from "./contracts/server.ts";
+export type { LocalServerOptions, LocalWeb } from "./contracts/server.ts";
+import {
+  ServiceChallenge,
+  ServiceFailed,
+  ServiceInfo,
+  serviceInfoPath,
+  serviceStopPath,
+} from "./contracts/service.ts";
 import { StartupFailed } from "./contracts/startup.ts";
-import { makeLocalAuth, pairingUrl } from "./implementation/auth.ts";
+import { bearerMatches, localRequest, makeLocalAuth, pairingUrl } from "./implementation/auth.ts";
 import { localApi } from "./implementation/server.ts";
+import { lockDataDirectory, serviceProof, serviceVersion } from "./implementation/service-files.ts";
 import { startupPhase } from "./implementation/startup-diagnostics.ts";
 
-/** Consume the parent's private fd3 envelope, bounded in size and time, and parse before use. */
-export const readDesktopBootstrap = NodeStream.toString(
-  () => createReadStream("", { fd: 3, autoClose: true }),
-  { maxBytes: 4096, onError: () => new StartupFailed({ stage: "desktop-bootstrap" }) },
-).pipe(
-  Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(DesktopBootstrap))),
-  Effect.timeoutOrElse({
-    duration: 5_000,
-    orElse: () => Effect.fail(new StartupFailed({ stage: "desktop-bootstrap" })),
-  }),
-  Effect.mapError(() => new StartupFailed({ stage: "desktop-bootstrap" })),
-);
+/**
+ * The process services every request runs with: Node's platform and HTTP support, and telemetry.
+ * Build them before listening, so a failure to listen still reaches the diagnostics file.
+ */
+export const localServices = (directory: string, options: LocalTelemetryOptions = {}) =>
+  Layer.mergeAll(
+    localTelemetry(directory, "executor-local", options).pipe(Layer.provide(NodeServices.layer)),
+    NodeHttpServer.layerHttpServices,
+  );
+export type LocalServices = Layer.Success<ReturnType<typeof localServices>>;
 
-/** Start one scoped loopback server. Its actual port and auth store belong to this lifetime. */
-export const startLocalServer = (
-  settings: ServerConfig,
-  bootstrap: DesktopBootstrap | undefined,
-  options: LocalServerOptions,
-) =>
+/** The composed product's request handler, served behind the service routes. */
+export type LocalHandler = Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  unknown,
+  HttpServerRequest.HttpServerRequest | Scope.Scope | LocalServices
+>;
+
+const noStore = { "cache-control": "no-store" };
+const unavailable = () =>
+  HttpServerResponse.empty({ status: 503, headers: { ...noStore, "retry-after": "1" } });
+const forbidden = () => Effect.succeed(HttpServerResponse.empty({ status: 403 }));
+const at = (url: string, path: string) => url === path || url.startsWith(`${path}?`);
+
+/**
+ * Listen on 127.0.0.1:`port` for the current scope and serve the service routes at once.
+ * `GET /api/service` needs no credential, and proves this process knows `password` when asked with
+ * a challenge; `POST /api/service/stop` needs `password` as a bearer, so a server without one
+ * cannot be stopped over HTTP. Both refuse browsers.
+ */
+export const listenLocal = (options: {
+  readonly port: number;
+  readonly password: Redacted.Redacted<string> | undefined;
+}) =>
   Effect.gen(function* () {
-    const telemetry = yield* Layer.build(
-      localTelemetry(settings.directory, "executor-local").pipe(Layer.provide(NodeServices.layer)),
+    const id = globalThis.crypto.randomUUID();
+    const version = yield* serviceVersion;
+    const product = yield* Ref.make(Option.none<LocalHandler>());
+    const stopping = yield* Deferred.make<string>();
+    /** The product started closing, however the server was ended, as by an interrupt. */
+    const closing = yield* Ref.make(false);
+    const socket = yield* Effect.sync(() => createServer());
+    const server = yield* NodeHttpServer.make(() => socket, {
+      host: "127.0.0.1",
+      port: options.port,
+      gracefulShutdownTimeout: 1_000,
+    }).pipe(startupPhase("listen"));
+    if (!NetAddress.isInetAddressV4(server.address))
+      return yield* new StartupFailed({ stage: "listen" });
+    const port = server.address.port;
+    // The Host check refuses DNS rebinding, and every browser request carries an Origin.
+    const loopback = localRequest(port).pipe(
+      Effect.filterOrFail(
+        (request) => request.headers.origin === undefined,
+        () => new AuthForbidden(),
+      ),
     );
-    return yield* Effect.gen(function* () {
-      yield* Effect.logInfo("Starting local server");
-      yield* Effect.addFinalizer(() => Effect.logInfo("Local server stopped"));
-      const auth = yield* makeLocalAuth(globalThis.crypto, settings.directory).pipe(
-        startupPhase("authentication"),
+    const info = Effect.gen(function* () {
+      const request = yield* loopback;
+      // A server asked to stop, which can take seconds, is going away: it is not starting again.
+      const status =
+        (yield* Deferred.isDone(stopping)) || (yield* Ref.get(closing))
+          ? "stopping"
+          : Option.isSome(yield* Ref.get(product))
+            ? "ready"
+            : "starting";
+      const ready = status === "ready";
+      const challenge = Schema.decodeUnknownOption(ServiceChallenge)(
+        new URL(request.url, "http://127.0.0.1").searchParams.get("challenge"),
       );
-      if (bootstrap !== undefined) yield* auth.issue(bootstrap.token);
-      const socket = yield* Effect.sync(() => createServer());
-      const ready = yield* Deferred.make<void>();
-      let port = settings.port;
-      const routes = Layer.unwrap(
-        Effect.gen(function* () {
-          const server = yield* HttpServer.HttpServer;
-          if (server.address._tag !== "InetAddressV4")
-            return yield* new StartupFailed({ stage: "listen" });
-          port = server.address.port;
-          return localApi({ ...settings, port }, globalThis.crypto, auth, {
-            ...options,
-            platform: { os: process.platform, arch: process.arch },
-          });
+      const proof =
+        Option.isSome(challenge) && options.password !== undefined
+          ? { proof: yield* serviceProof(Redacted.value(options.password), challenge.value) }
+          : {};
+      return HttpServerResponse.jsonUnsafe(
+        ServiceInfo.make({
+          id,
+          version,
+          pid: process.pid,
+          status,
+          ...proof,
         }),
+        {
+          status: ready ? 200 : 503,
+          headers: ready ? noStore : { ...noStore, "retry-after": "1" },
+        },
       );
-      // Close active connections before the adapter's final shutdown. Requests receive
-      // cancellation through Effect; an idle MCP stream cannot hold the process open.
-      const listener = Layer.unwrap(
-        Layer.build(
-          NodeHttpServer.layer(() => socket, {
-            host: "127.0.0.1",
-            port: settings.port,
-            gracefulShutdownTimeout: 1_000,
-          }),
-        ).pipe(startupPhase("listen"), Effect.map(Layer.succeedContext)),
-      );
-      yield* Layer.build(
-        HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
-          Layer.provide(listener),
-          Layer.provide(Layer.succeed(ScheduleHostReady, Deferred.await(ready))),
-          Layer.provide(NodeServices.layer),
-          Layer.provide(Layer.succeedContext(telemetry)),
-        ),
-      ).pipe(startupPhase("composition"));
-      yield* Deferred.succeed(ready, undefined);
-      yield* Effect.addFinalizer(() => Effect.sync(() => socket.closeAllConnections()));
-      const url = `http://127.0.0.1:${port}`;
-      yield* Effect.logInfo("Local server ready").pipe(
-        Effect.annotateLogs({ url, diagnostics: `${settings.directory}/diagnostics` }),
-      );
-      return {
-        url,
-        issuePairingLink: auth.issue().pipe(
-          Effect.map(({ token, expiresAt }) => ({
-            url: pairingUrl(settings.browserOrigin ?? url, token),
-            expiresAt,
-          })),
-        ),
-      };
-    }).pipe(
-      startupPhase("composition"),
-      Effect.tapError((error) =>
-        Effect.logError("Local server startup failed").pipe(
-          Effect.annotateLogs({
+    }).pipe(Effect.catchTag("AuthForbidden", forbidden));
+    const stop = Effect.gen(function* () {
+      const request = yield* loopback;
+      if (!bearerMatches(request.headers.authorization, [options.password]))
+        return HttpServerResponse.empty({ status: 401, headers: noStore });
+      // The request's scope closes once the response is written; stopping first could drop it.
+      yield* Effect.addFinalizer(() => Deferred.succeed(stopping, "stop requested"));
+      return HttpServerResponse.empty({ status: 202, headers: noStore });
+    }).pipe(Effect.catchTag("AuthForbidden", forbidden));
+    yield* HttpServer.serveEffect(
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (
+          at(request.url, serviceInfoPath) &&
+          (request.method === "GET" || request.method === "HEAD")
+        )
+          return yield* info;
+        if (at(request.url, serviceStopPath) && request.method === "POST") return yield* stop;
+        const handler = yield* Ref.get(product);
+        return Option.isSome(handler) ? yield* handler.value : unavailable();
+      }),
+    ).pipe(Effect.provideService(HttpServer.HttpServer, server));
+    return {
+      /** Unique to this server process; a registration names it. */
+      id,
+      version,
+      port,
+      url: `http://127.0.0.1:${port}`,
+      /** Serve every other request through `handler` until the current scope starts closing. */
+      ready: (handler: LocalHandler) =>
+        Effect.gen(function* () {
+          yield* Ref.set(product, Option.some(handler));
+          // Close active connections before the adapter's final shutdown. Requests receive
+          // cancellation through Effect; an idle MCP stream cannot hold the process open.
+          yield* Effect.addFinalizer(() =>
+            Ref.set(closing, true).pipe(
+              Effect.andThen(Ref.set(product, Option.none())),
+              Effect.andThen(Effect.sync(() => socket.closeAllConnections())),
+            ),
+          );
+        }),
+      /** Ask this server to shut down, as the stop route does. */
+      stop: (reason: string) => Deferred.succeed(stopping, reason).pipe(Effect.asVoid),
+      /** Completes with the reason once something asks this server to shut down. */
+      stopped: Deferred.await(stopping),
+    };
+  });
+export type LocalListener = Effect.Success<ReturnType<typeof listenLocal>>;
+
+/** Hold the data directory's `.server.lock` for the current scope, by the rule every holder uses. */
+export { lockDataDirectory };
+
+/**
+ * Open storage and compose the product behind `listener`. The caller holds the data directory, and
+ * `settings` carry its keys; the listener supplies the port.
+ */
+export const composeLocalServer = (
+  listener: LocalListener,
+  settings: ServerConfig,
+  options: LocalServerOptions,
+) =>
+  Effect.gen(function* () {
+    yield* Effect.logInfo("Starting local server");
+    yield* Effect.addFinalizer(() => Effect.logInfo("Local server stopped"));
+    const config = { ...settings, port: listener.port };
+    const auth = yield* makeLocalAuth(globalThis.crypto, config.directory).pipe(
+      startupPhase("authentication"),
+    );
+    const ready = yield* Deferred.make<void>();
+    const handler = yield* HttpRouter.toHttpEffect(
+      localApi(config, globalThis.crypto, auth, {
+        ...options,
+        platform: { os: process.platform, arch: process.arch },
+      }),
+    ).pipe(Effect.provideService(ScheduleHostReady, Deferred.await(ready)));
+    yield* listener.ready(handler);
+    yield* Deferred.succeed(ready, undefined);
+    yield* Effect.logInfo("Local server ready").pipe(
+      Effect.annotateLogs({ url: listener.url, diagnostics: `${config.directory}/diagnostics` }),
+    );
+    return {
+      url: listener.url,
+      issuePairingLink: auth.issue().pipe(
+        Effect.map(({ token, expiresAt }) => ({
+          url: pairingUrl(config.browserOrigin ?? listener.url, token),
+          expiresAt,
+        })),
+      ),
+    };
+  }).pipe(startupPhase("composition"));
+
+/** Record a failed start in diagnostics: its stage and known system code, never its detail. */
+export const reportStartupFailure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.tapError((error) => {
+      const annotations = Schema.is(StartupFailed)(error)
+        ? {
             "startup.stage": error.stage,
             "error.type": "StartupFailed",
             ...(error.code === undefined ? {} : { "error.code": error.code }),
-          }),
-        ),
-      ),
-      Effect.provideContext(telemetry),
+          }
+        : Schema.is(ServiceFailed)(error) && error.reason === "port-in-use"
+          ? { "startup.stage": "listen", "error.type": "ServiceFailed", "error.code": "EADDRINUSE" }
+          : Schema.is(ServiceFailed)(error) && error.reason === "directory-in-use"
+            ? { "startup.stage": "lock", "error.type": "ServiceFailed" }
+            : undefined;
+      return annotations === undefined
+        ? Effect.void
+        : Effect.logError("Local server startup failed").pipe(Effect.annotateLogs(annotations));
+    }),
+  );
+
+/**
+ * Start one private, unregistered loopback server whose configuration is already resolved, as
+ * the development entry does. It still listens first and holds the data directory's lock.
+ * `stopped` completes with the reason once it must stop, as when another server took its lock.
+ */
+export const startLocalServer = (settings: ServerConfig, options: LocalServerOptions) =>
+  Effect.gen(function* () {
+    const locked = yield* Deferred.make<Scope.Scope>();
+    const services = yield* Layer.build(
+      localServices(settings.directory, { collectorScope: Deferred.await(locked) }),
     );
+    return yield* Effect.gen(function* () {
+      const listener = yield* listenLocal({ port: settings.port, password: undefined });
+      const held = yield* lockDataDirectory(settings.directory, { port: listener.port });
+      yield* Deferred.succeed(locked, yield* Effect.scope);
+      yield* held.lost.pipe(
+        Effect.andThen(listener.stop("data directory lock lost")),
+        Effect.forkScoped,
+      );
+      const server = yield* composeLocalServer(listener, settings, options);
+      return { ...server, stopped: listener.stopped };
+    }).pipe(reportStartupFailure, Effect.provideContext(services));
   });
diff --git a/apps/local/web/src/contracts/app-accounts.ts b/apps/local/web/src/contracts/app-accounts.ts
index 4ef521df0b..6a37b53169 100644
--- a/apps/local/web/src/contracts/app-accounts.ts
+++ b/apps/local/web/src/contracts/app-accounts.ts
@@ -6,8 +6,9 @@
 import { hydrated } from "@executor-js/ui/contracts/http";
 import { acknowledge, acknowledgedQuery } from "@executor-js/ui/contracts/mutations";
 import { Data, Effect } from "effect";
-import { Atom } from "effect/reactivity";
-import type { AccountId, AccountScope, AppId, VersionId } from "@executor-js/sdk";
+import { Atom, type AtomRegistry } from "effect/reactivity";
+import { withCheckedApps } from "@executor-js/ui/contracts/dashboard";
+import type { AccountHealth, AccountId, AccountScope, AppId, VersionId } from "@executor-js/sdk";
 import { DashboardClient, overviewAtom } from "./api.ts";
 import { refreshAppDiscovery } from "./app-discovery.ts";
 
@@ -62,6 +63,16 @@ const liveChoices = Atom.family((key: RequirementKey) => followInventory(choices
 export const requirementChoicesAtom = (key: ConstructorParameters<typeof RequirementKey>[0]) =>
   liveChoices(new RequirementKey({ app: key.app, scope: key.scope, requirement: key.requirement }));
 
+/** Show a check's results in the app's links as soon as it finishes, then read them again. */
+export const acknowledgeLinkChecks = (
+  get: { readonly registry: AtomRegistry.AtomRegistry },
+  app: AppId,
+  health: AccountHealth,
+) => {
+  for (const list of [appLinks(app), userLinks(app)])
+    acknowledge(get, list, (rows) => rows.map((row) => withCheckedApps(row, health)));
+};
+
 /** Read an app's links again, as after a connection for one of its requirements links an account. */
 export const refreshAppLinks = (
   get: Atom.FnContext | Atom.AtomContext,
diff --git a/apps/local/web/src/contracts/errors.ts b/apps/local/web/src/contracts/errors.ts
index 8e56c54909..d6fe0aec09 100644
--- a/apps/local/web/src/contracts/errors.ts
+++ b/apps/local/web/src/contracts/errors.ts
@@ -81,6 +81,8 @@ const errorMessage = Match.type<DashboardError>().pipe(
     RegistryError: (error) => message("Public app unavailable", registryErrorMessage(error)),
     AppAccessDenied: () =>
       message("Action unavailable", "You do not have permission to change this app."),
+    FullListingNameRequired: (error) =>
+      message(error.title, `${error.description} ${error.recovery.action}`),
     ConnectionLinkRejected: () =>
       message("This connection link is invalid", "Ask your agent for a new connection link."),
     AccountConnectionNotFound: () =>
diff --git a/apps/local/web/src/contracts/navigation.ts b/apps/local/web/src/contracts/navigation.ts
index dce5df9786..1d909a046b 100644
--- a/apps/local/web/src/contracts/navigation.ts
+++ b/apps/local/web/src/contracts/navigation.ts
@@ -55,7 +55,7 @@ export function localPageTitle(pathname: string): string {
   if (section === "account-connect") return "Connect account";
   if (section === "api" && item === "oauth") return "Connecting account";
   if (section === "apps") {
-    if (item === "add") return action === "custom" ? "Add custom app" : "Add app";
+    if (item === "add") return "App catalog";
     if (action === "delete") return "Delete app";
     if (action === "setup") return "Accounts";
     return item ? "App" : "Apps";
diff --git a/apps/local/web/src/contracts/schedules.ts b/apps/local/web/src/contracts/schedules.ts
index 61c42d3631..c4b9e59f2c 100644
--- a/apps/local/web/src/contracts/schedules.ts
+++ b/apps/local/web/src/contracts/schedules.ts
@@ -117,8 +117,10 @@ const runsQuery = pollingQuery(runsSource, steadyPolling);
 /** Join safe run metadata with app names; keep either read failure visible. */
 export const pendingApprovalsAtom = DashboardClient.runtime.atom((get) =>
   Effect.gen(function* () {
-    const runs = yield* get.result(runsQuery);
-    const inventory = yield* get.result(overviewAtom);
+    // App names come from the inventory; read it alongside the runs rather than after them.
+    const [runs, inventory] = yield* Effect.all([get.result(runsQuery), get.result(overviewAtom)], {
+      concurrency: "unbounded",
+    });
     return runs.map((run): ApprovalListItem => ({
       run,
       app: {
diff --git a/apps/local/web/src/implementation/app.tsx b/apps/local/web/src/implementation/app.tsx
index 2260a60ff3..6b2d2515db 100644
--- a/apps/local/web/src/implementation/app.tsx
+++ b/apps/local/web/src/implementation/app.tsx
@@ -9,7 +9,7 @@ import {
   UserCircleIcon,
   LaptopIcon,
   PackageIcon,
-  Plug01Icon,
+  ConnectIcon,
   Shield01Icon,
 } from "@hugeicons/core-free-icons";
 import { overviewAtom } from "../contracts/api.ts";
@@ -22,6 +22,7 @@ import { Failure } from "./components/common.tsx";
 import { LocalDashboard } from "./dashboard-bindings.tsx";
 import { DashboardShell } from "@executor-js/ui/dashboard/shell";
 import { publicDocsBaseUrl } from "@executor-js/ui/contracts/documentation";
+import { documentBuild } from "@executor-js/dashboard-start/document-build";
 import { NameAccountDialog } from "./pages/name-account-dialog.tsx";
 import { OwnerMigrationBanner } from "./owner-migration.tsx";
 
@@ -113,6 +114,10 @@ function Connect({
   );
 }
 
+/** A release names its version; a server started without one, such as development, names none. */
+const buildLabel = (build: string | undefined) =>
+  build === undefined || build === "development" ? "Development" : `v${build}`;
+
 function Dashboard() {
   const section = useMatches({ select: (matches) => matches.at(-1)?.staticData.section });
   const result = useAtomValue(overviewAtom);
@@ -146,14 +151,14 @@ function Dashboard() {
             Apps{Option.isSome(data) && <span>{data.value.apps.length}</span>}
           </Link>
           <Link
-            to="/connect"
+            to="/connections"
             className={cn(
               section === "connect" &&
                 "active [.sidebar_nav_a&]:bg-accent [.sidebar_nav_a&]:text-foreground",
             )}
           >
-            <HugeiconsIcon icon={Plug01Icon} strokeWidth={2} aria-hidden size={16} />
-            Connect
+            <HugeiconsIcon icon={ConnectIcon} strokeWidth={2} aria-hidden size={16} />
+            Connections
           </Link>
           <Link
             to="/accounts"
@@ -181,7 +186,7 @@ function Dashboard() {
       footer={
         <div className="sidebar-build flex items-center justify-between gap-1.5 py-0 px-[10px] max-[740px]:p-0">
           <span className="sidebar-version text-[10px] opacity-75 max-[740px]:hidden">
-            Development
+            {buildLabel(documentBuild())}
           </span>
         </div>
       }
diff --git a/apps/local/web/src/implementation/components/add-app.tsx b/apps/local/web/src/implementation/components/add-app.tsx
new file mode 100644
index 0000000000..051e7ea8fb
--- /dev/null
+++ b/apps/local/web/src/implementation/components/add-app.tsx
@@ -0,0 +1,37 @@
+import { Link, useNavigate } from "@tanstack/react-router";
+import type { DeployedApp } from "@executor-js/sdk";
+import {
+  MakeYourOwn as SharedMakeYourOwn,
+  AddAppMenu as SharedMenu,
+} from "@executor-js/ui/dashboard/add-app";
+import { dashboardAtoms } from "../../contracts/dashboard-bindings.ts";
+import { Failure } from "./common.tsx";
+
+/** Custom MCP imports open the new app, at its account setup when it needs one. */
+function useAddAppDialogs() {
+  const navigate = useNavigate();
+  return {
+    mutation: dashboardAtoms.importCustom,
+    Failure,
+    onInstalled: (app: DeployedApp) =>
+      navigate({
+        to: Object.keys(app.requirements.accounts).length ? "/apps/$appId/setup" : "/apps/$appId",
+        params: { appId: app.id },
+      }),
+  };
+}
+
+/** Apps' Add app menu: make your own app or browse the catalog page. */
+export function AddAppMenu() {
+  return (
+    <SharedMenu
+      {...useAddAppDialogs()}
+      catalog={(content) => <Link to="/apps/add">{content}</Link>}
+    />
+  );
+}
+
+/** The catalog page's button and link to making your own app. */
+export function MakeYourOwn({ appearance }: { readonly appearance?: "link" | "button" }) {
+  return <SharedMakeYourOwn appearance={appearance} {...useAddAppDialogs()} />;
+}
diff --git a/apps/local/web/src/implementation/pages/app-accounts.tsx b/apps/local/web/src/implementation/pages/app-accounts.tsx
index 656b403b7c..fe59261656 100644
--- a/apps/local/web/src/implementation/pages/app-accounts.tsx
+++ b/apps/local/web/src/implementation/pages/app-accounts.tsx
@@ -1,7 +1,7 @@
 import { useContext, useState } from "react";
 import { RegistryContext } from "@effect/atom-react";
 import { AtomRegistry } from "effect/reactivity";
-import { Effect } from "effect";
+import { Effect, Exit } from "effect";
 import {
   accountAtom,
   accountUsageAtom,
@@ -9,6 +9,7 @@ import {
   disconnectAccountAtom,
 } from "../../contracts/accounts.ts";
 import {
+  acknowledgeLinkChecks,
   linkAccountAtom,
   requirementChoicesAtom,
   unlinkAccountAtom,
@@ -63,7 +64,11 @@ export function AppAccounts({
     registry.set(check, undefined);
     return Effect.runPromiseExit(
       AtomRegistry.getResult(registry, check, { suspendOnWaiting: true }),
-    );
+    ).then((exit) => {
+      // The rows show the results before the check settles, so they never fall back to the old ones.
+      if (Exit.isSuccess(exit)) acknowledgeLinkChecks({ registry }, app.id, exit.value);
+      return exit;
+    });
   };
   const unused = useUnusedAccountPrompt({
     usage: accountUsageAtom,
diff --git a/apps/local/web/src/implementation/pages/app-detail.tsx b/apps/local/web/src/implementation/pages/app-detail.tsx
index 078de8906f..c7ab33dcad 100644
--- a/apps/local/web/src/implementation/pages/app-detail.tsx
+++ b/apps/local/web/src/implementation/pages/app-detail.tsx
@@ -9,7 +9,13 @@ import {
 import { appBrowserBindings } from "../../contracts/app-browser.ts";
 import { AppSchedules } from "@executor-js/ui/dashboard/schedules";
 import { scheduleBindings } from "../../contracts/schedules.ts";
-import { allResults, QueryResult, QueryView, useQuery } from "@executor-js/ui/dashboard/context";
+import {
+  allResults,
+  QueryResult,
+  QueryView,
+  usePreload,
+  useQuery,
+} from "@executor-js/ui/dashboard/context";
 import {
   missingRequirements,
   requirementAccounts,
@@ -97,6 +103,7 @@ export function AppDetailPage({
     shouldBlockFn: () => skillDirty && !window.confirm("Discard your unsaved changes?"),
     enableBeforeUnload: skillDirty,
   });
+  usePreload(appAtom(id), appLinksAtom(id), userLinksAtom(id));
   const query = useQuery(appAtom(id));
   const appLinks = useQuery(appLinksAtom(id));
   const userLinks = useQuery(userLinksAtom(id));
diff --git a/apps/local/web/src/implementation/pages/app-tools.tsx b/apps/local/web/src/implementation/pages/app-tools.tsx
index bec30843d4..06bf126508 100644
--- a/apps/local/web/src/implementation/pages/app-tools.tsx
+++ b/apps/local/web/src/implementation/pages/app-tools.tsx
@@ -70,12 +70,13 @@ export function AppTools(props: AppToolsProps) {
       return (
         <AccountReconnect app={props.app.id} accounts={readiness.accounts} status="Needs sign-in" />
       );
+    // A sign-in that expired or must be renewed by hand is `reconnect` above.
     case "rejected":
       return (
         <AccountReconnect
           app={props.app.id}
           accounts={readiness.accounts}
-          status="Sign-in rejected"
+          status="Credentials refused"
         />
       );
     case "unavailable":
diff --git a/apps/local/web/src/implementation/pages/apps.tsx b/apps/local/web/src/implementation/pages/apps.tsx
index 1c0be1a7a5..d173672615 100644
--- a/apps/local/web/src/implementation/pages/apps.tsx
+++ b/apps/local/web/src/implementation/pages/apps.tsx
@@ -3,6 +3,7 @@ import { dashboardAtoms } from "../../contracts/dashboard-bindings.ts";
 import { AppsPage as SharedPage } from "@executor-js/ui/dashboard/apps";
 import { Button } from "@executor-js/ui/components/button";
 import { Link } from "@tanstack/react-router";
+import { AddAppMenu } from "../components/add-app.tsx";
 /** Local product supplies its own action and typed route. */
 export function AppsPage() {
   return (
@@ -11,14 +12,10 @@ export function AppsPage() {
       Failure={Failure}
       connect={
         <Button asChild variant="outline">
-          <Link to="/connect">Connect your agent</Link>
-        </Button>
-      }
-      action={
-        <Button asChild>
-          <Link to="/apps/add">Add app</Link>
+          <Link to="/connections">Connect your agent</Link>
         </Button>
       }
+      action={<AddAppMenu />}
     />
   );
 }
diff --git a/apps/local/web/src/implementation/pages/catalog.tsx b/apps/local/web/src/implementation/pages/catalog.tsx
index b0ddcfd68b..891ca700f9 100644
--- a/apps/local/web/src/implementation/pages/catalog.tsx
+++ b/apps/local/web/src/implementation/pages/catalog.tsx
@@ -2,7 +2,7 @@ import { Failure } from "../components/common.tsx";
 import { dashboardAtoms } from "../../contracts/dashboard-bindings.ts";
 import { Link } from "@tanstack/react-router";
 import { CatalogPage as Catalog } from "@executor-js/ui/dashboard/catalog";
-import { Button } from "@executor-js/ui/components/button";
+import { MakeYourOwn } from "../components/add-app.tsx";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { ArrowLeft02Icon } from "@hugeicons/core-free-icons";
 
@@ -32,13 +32,8 @@ export function CatalogPage() {
           Apps
         </Link>
       }
-      action={
-        <div className="flex gap-2">
-          <Button variant="outline" asChild>
-            <Link to="/apps/add/custom">Connect a service</Link>
-          </Button>
-        </div>
-      }
+      action={<MakeYourOwn appearance="button" />}
+      create={<MakeYourOwn />}
     />
   );
 }
diff --git a/apps/local/web/src/implementation/pages/connect-account.tsx b/apps/local/web/src/implementation/pages/connect-account.tsx
index 0116d5b4ce..95a8c8600e 100644
--- a/apps/local/web/src/implementation/pages/connect-account.tsx
+++ b/apps/local/web/src/implementation/pages/connect-account.tsx
@@ -15,9 +15,8 @@ import {
   submitConnectionAtom,
   cancelConnectionAtom,
 } from "../../contracts/account-connections.ts";
-import { faviconUrl } from "@executor-js/ui/contracts/icons";
 import { Button } from "@executor-js/ui/components/button";
-import { ConnectionLinkFailure } from "../components/common.tsx";
+import { ConnectionLinkFailure, ProviderIcon } from "../components/common.tsx";
 import { AccountForm } from "@executor-js/ui/dashboard/account-form";
 import { LinkOAuthFields } from "./oauth-fields.tsx";
 
@@ -83,7 +82,6 @@ function ConnectionForm({
   const submit = useAtomSet(submitConnectionAtom, { mode: "promiseExit" });
   const cancel = useAtomSet(cancelConnectionAtom, { mode: "promiseExit" });
   const refresh = useAtomRefresh(connectionDetailsAtom);
-  const icon = faviconUrl(providerDisplayUrl(connection.provider.definition), 32);
   if (state.status !== "pending")
     return (
       <div className="account-connect-result py-[24px] px-0 text-center [&_>_svg]:[margin:0_auto_18px] [&_p]:text-[13px] [&_p]:text-muted-foreground">
@@ -113,8 +111,12 @@ function ConnectionForm({
     );
   return (
     <>
-      <header className="account-connect-heading mb-7 [&_>_img]:w-9 [&_>_img]:h-9 [&_>_img]:mb-4.5">
-        {icon && <img src={icon} alt="" referrerPolicy="no-referrer" />}
+      <header className="account-connect-heading mb-7 [&_>_.provider-icon]:mb-4.5">
+        <ProviderIcon
+          name={connection.provider.definition.name}
+          url={providerDisplayUrl(connection.provider.definition)}
+          large
+        />
         <h1 className="text-[22px] font-semibold tracking-[-0.035em] leading-[1.35] [&>span]:text-muted-foreground [&>span]:text-[13px] [&>span]:font-mono [&>span]:font-normal [&>span]:ml-[8px] [&>span]:align-middle">
           Connect {connection.provider.definition.name}
         </h1>
diff --git a/apps/local/web/src/implementation/pages/connect-agent.tsx b/apps/local/web/src/implementation/pages/connect-agent.tsx
deleted file mode 100644
index 8e40e5a413..0000000000
--- a/apps/local/web/src/implementation/pages/connect-agent.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-import { QueryView } from "@executor-js/ui/dashboard/context";
-import { McpInstallInstructions } from "@executor-js/ui/dashboard/connect";
-import { ScopedConnectionsPage } from "@executor-js/ui/dashboard/scoped-connections";
-import { ConnectionToolPicker } from "@executor-js/ui/dashboard/connection-tool-picker";
-import { overviewAtom, toolListAtom } from "../../contracts/api.ts";
-import { mcpInstallationAtom } from "../../contracts/mcp.ts";
-import {
-  mcpConnectionsAtom,
-  revokeMcpConnectionAtom,
-  saveMcpConnectionAtom,
-} from "../../contracts/mcp-connections.ts";
-import { Failure, LoadingRows } from "../components/common.tsx";
-
-/** This instance's full-access URL and the operator's scoped connections. */
-export function ConnectAgentPage() {
-  return (
-    <ScopedConnectionsPage
-      query={overviewAtom}
-      connections={mcpConnectionsAtom}
-      save={saveMcpConnectionAtom}
-      revoke={revokeMcpConnectionAtom}
-      Failure={Failure}
-      renderTools={({ app, names, onChange }) => (
-        <ConnectionToolPicker
-          query={toolListAtom({
-            app: app.id,
-            version: app.activeVersion,
-          })}
-          Failure={Failure}
-          names={names}
-          onChange={onChange}
-        />
-      )}
-      installation={
-        <QueryView
-          query={mcpInstallationAtom}
-          Failure={Failure}
-          pending={<LoadingRows count={3} />}
-        >
-          {(data) => (
-            <McpInstallInstructions endpoint={data.endpoint}>
-              Keep the local server running while your agent uses Executor.
-            </McpInstallInstructions>
-          )}
-        </QueryView>
-      }
-    />
-  );
-}
diff --git a/apps/local/web/src/implementation/pages/connections.tsx b/apps/local/web/src/implementation/pages/connections.tsx
new file mode 100644
index 0000000000..75a74d0cbb
--- /dev/null
+++ b/apps/local/web/src/implementation/pages/connections.tsx
@@ -0,0 +1,97 @@
+import { Link, useNavigate } from "@tanstack/react-router";
+import { Button } from "@executor-js/ui/components/button";
+import { McpInstallInstructions } from "@executor-js/ui/dashboard/connect";
+import { QueryView } from "@executor-js/ui/dashboard/context";
+import { ConnectionToolPicker } from "@executor-js/ui/dashboard/connection-tool-picker";
+import {
+  ScopedConnectionPage,
+  ScopedConnectionsPage,
+  type ConnectionLinkProps,
+  type ConnectTarget,
+} from "@executor-js/ui/dashboard/scoped-connections";
+import { overviewAtom, toolListAtom } from "../../contracts/api.ts";
+import { mcpInstallationAtom } from "../../contracts/mcp.ts";
+import {
+  mcpConnectionsAtom,
+  revokeMcpConnectionAtom,
+  saveMcpConnectionAtom,
+} from "../../contracts/mcp-connections.ts";
+import { Failure, LoadingRows } from "../components/common.tsx";
+
+function ConnectionLink({ connection, className, children }: ConnectionLinkProps) {
+  return connection === undefined ? (
+    <Link to="/connections" className={className}>
+      {children}
+    </Link>
+  ) : (
+    <Link
+      to="/connections/$connectionId"
+      params={{ connectionId: connection }}
+      className={className}
+    >
+      {children}
+    </Link>
+  );
+}
+
+const renderInstallation = (target: ConnectTarget) =>
+  target.apps === undefined ? (
+    <McpInstallInstructions endpoint={target.url}>
+      Executor keeps running in the background until you stop it. After you restart your computer,
+      run <code>executor</code> or <code>executor service start</code> again.
+    </McpInstallInstructions>
+  ) : (
+    <McpInstallInstructions
+      endpoint={target.url}
+      next="show me which apps and tools this connection can use"
+    />
+  );
+
+const bindings = {
+  query: overviewAtom,
+  connections: mcpConnectionsAtom,
+  save: saveMcpConnectionAtom,
+  revoke: revokeMcpConnectionAtom,
+  Failure,
+  ConnectionLink,
+  renderInstallation,
+};
+
+/** This instance's full-access URL and the operator's scoped connections. */
+export function ConnectionsPage() {
+  return (
+    <QueryView query={mcpInstallationAtom} Failure={Failure} pending={<LoadingRows count={4} />}>
+      {(installation) => <ScopedConnectionsPage {...bindings} endpoint={installation.endpoint} />}
+    </QueryView>
+  );
+}
+
+/** One scoped connection, or `new` to create one. */
+export function ConnectionPage({ connectionId }: { readonly connectionId: string }) {
+  const navigate = useNavigate();
+  return (
+    <ScopedConnectionPage
+      {...bindings}
+      connectionId={connectionId}
+      onCreated={(connection) =>
+        void navigate({ to: "/connections/$connectionId", params: { connectionId: connection } })
+      }
+      onRevoked={() => void navigate({ to: "/connections" })}
+      renderConnectAccount={(app) => (
+        <Button type="button" variant="ghost" size="sm" className="text-xs" asChild>
+          <Link to="/apps/$appId/setup" params={{ appId: app.id }}>
+            Connect account
+          </Link>
+        </Button>
+      )}
+      renderTools={({ app, names, onChange }) => (
+        <ConnectionToolPicker
+          query={toolListAtom({ app: app.id, version: app.activeVersion })}
+          Failure={Failure}
+          names={names}
+          onChange={onChange}
+        />
+      )}
+    />
+  );
+}
diff --git a/apps/local/web/src/implementation/pages/custom-app.tsx b/apps/local/web/src/implementation/pages/custom-app.tsx
deleted file mode 100644
index 21238cb6b4..0000000000
--- a/apps/local/web/src/implementation/pages/custom-app.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import { HugeiconsIcon } from "@hugeicons/react";
-import { ArrowLeft02Icon } from "@hugeicons/core-free-icons";
-import { CustomAppForm } from "@executor-js/ui/dashboard/custom-app";
-import { Link, useNavigate } from "@tanstack/react-router";
-import { dashboardAtoms } from "../../contracts/dashboard-bindings.ts";
-import { Failure } from "../components/common.tsx";
-
-/** Add a remote MCP server by URL; other services are set up with the user's agent. */
-export function CustomAppPage() {
-  const navigate = useNavigate();
-  return (
-    <div className="page setup-page w-full shrink-0 [padding:24px_24px_48px] my-0 mx-auto max-[1000px]:[padding:20px_20px_40px] max-w-212.5 max-[740px]:[padding:18px_max(16px,_env(safe-area-inset-right))_max(32px,_env(safe-area-inset-bottom))_max(16px,_env(safe-area-inset-left))]">
-      <Link
-        to="/apps/add"
-        className="back-link inline-flex gap-1.5 items-center text-[12px] text-muted-foreground mb-4.25 hover:text-foreground max-[740px]:min-h-11 max-[740px]:inline-flex max-[740px]:items-center max-[740px]:-mt-2 max-[740px]:mb-3"
-      >
-        <HugeiconsIcon icon={ArrowLeft02Icon} strokeWidth={2} aria-hidden size={14} />
-        All apps
-      </Link>
-      <div className="page-heading gap-4 flex justify-between items-center min-h-12 mb-4.5 [&_p]:text-muted-foreground [&_p]:text-[13px] [&_p]:mt-1.25 [&_>_div]:min-w-0 [&_>_div]:wrap-anywhere max-[740px]:items-start max-[740px]:mb-4.5 max-[740px]:[&_p]:leading-[1.6] max-[740px]:[&_>_[data-slot='button']]:mt-0.25 max-[740px]:[.setup-page_&]:min-h-0">
-        <h1 className="text-[22px] font-semibold tracking-[-0.035em] leading-[1.35] [&>span]:text-muted-foreground [&>span]:text-[13px] [&>span]:font-mono [&>span]:font-normal [&>span]:ml-[8px] [&>span]:align-middle">
-          Connect a service
-        </h1>
-      </div>
-      <CustomAppForm
-        mutation={dashboardAtoms.importCustom}
-        Failure={Failure}
-        onInstalled={(app) =>
-          navigate({
-            to: Object.keys(app.requirements.accounts).length
-              ? "/apps/$appId/setup"
-              : "/apps/$appId",
-            params: { appId: app.id },
-          })
-        }
-      />
-    </div>
-  );
-}
diff --git a/apps/local/web/src/implementation/routeTree.gen.ts b/apps/local/web/src/implementation/routeTree.gen.ts
index a41f790629..1fd357b762 100644
--- a/apps/local/web/src/implementation/routeTree.gen.ts
+++ b/apps/local/web/src/implementation/routeTree.gen.ts
@@ -12,13 +12,14 @@ import { Route as rootRouteImport } from './routes/__root'
 import { Route as DashboardRouteImport } from './routes/_dashboard'
 import { Route as AppAuthRouteImport } from './routes/app-auth'
 import { Route as DashboardInventoryRouteImport } from './routes/_dashboard._inventory'
-import { Route as DashboardConnectRouteImport } from './routes/_dashboard.connect'
+import { Route as DashboardConnectionsRouteImport } from './routes/_dashboard.connections'
 import { Route as AccountConnectConnectionIdRouteImport } from './routes/account-connect.$connectionId'
 import { Route as McpAuthorizeRouteImport } from './routes/mcp.authorize'
 import { Route as DashboardInventoryIndexRouteImport } from './routes/_dashboard._inventory.index'
 import { Route as DashboardInventorySplatRouteImport } from './routes/_dashboard._inventory.$'
 import { Route as DashboardApprovalsIndexRouteImport } from './routes/_dashboard.approvals.index'
 import { Route as DashboardApprovalsRunIdRouteImport } from './routes/_dashboard.approvals.$runId'
+import { Route as DashboardConnectionsConnectionIdRouteImport } from './routes/_dashboard.connections_.$connectionId'
 import { Route as McpApproveRequestIdRouteImport } from './routes/mcp.approve.$requestId'
 import { Route as DashboardInventoryAccountsIndexRouteImport } from './routes/_dashboard._inventory.accounts.index'
 import { Route as DashboardInventoryAppsIndexRouteImport } from './routes/_dashboard._inventory.apps.index'
@@ -28,7 +29,6 @@ import { Route as DashboardWebhooksAppIdSubscriptionIdRouteImport } from './rout
 import { Route as DashboardInventoryApiOauthCallbackRouteImport } from './routes/_dashboard._inventory.api.oauth.callback'
 import { Route as DashboardInventoryAppsAppIdDeleteRouteImport } from './routes/_dashboard._inventory.apps.$appId_.delete'
 import { Route as DashboardInventoryAppsAppIdSetupRouteImport } from './routes/_dashboard._inventory.apps.$appId_.setup'
-import { Route as DashboardInventoryAppsAddCustomRouteImport } from './routes/_dashboard._inventory.apps.add_.custom'
 
 const DashboardRoute = DashboardRouteImport.update({
   id: '/_dashboard',
@@ -43,9 +43,9 @@ const DashboardInventoryRoute = DashboardInventoryRouteImport.update({
   id: '/_inventory',
   getParentRoute: () => DashboardRoute,
 } as any)
-const DashboardConnectRoute = DashboardConnectRouteImport.update({
-  id: '/connect',
-  path: '/connect',
+const DashboardConnectionsRoute = DashboardConnectionsRouteImport.update({
+  id: '/connections',
+  path: '/connections',
   getParentRoute: () => DashboardRoute,
 } as any)
 const AccountConnectConnectionIdRoute =
@@ -79,6 +79,12 @@ const DashboardApprovalsRunIdRoute = DashboardApprovalsRunIdRouteImport.update({
   path: '/approvals/$runId',
   getParentRoute: () => DashboardRoute,
 } as any)
+const DashboardConnectionsConnectionIdRoute =
+  DashboardConnectionsConnectionIdRouteImport.update({
+    id: '/connections_/$connectionId',
+    path: '/connections/$connectionId',
+    getParentRoute: () => DashboardRoute,
+  } as any)
 const McpApproveRequestIdRoute = McpApproveRequestIdRouteImport.update({
   id: '/mcp/approve/$requestId',
   path: '/mcp/approve/$requestId',
@@ -132,21 +138,16 @@ const DashboardInventoryAppsAppIdSetupRoute =
     path: '/apps/$appId/setup',
     getParentRoute: () => DashboardInventoryRoute,
   } as any)
-const DashboardInventoryAppsAddCustomRoute =
-  DashboardInventoryAppsAddCustomRouteImport.update({
-    id: '/apps/add_/custom',
-    path: '/apps/add/custom',
-    getParentRoute: () => DashboardInventoryRoute,
-  } as any)
 
 export interface FileRoutesByFullPath {
   '/': typeof DashboardInventoryIndexRoute
   '/app-auth': typeof AppAuthRoute
-  '/connect': typeof DashboardConnectRoute
+  '/connections': typeof DashboardConnectionsRoute
   '/account-connect/$connectionId': typeof AccountConnectConnectionIdRoute
   '/mcp/authorize': typeof McpAuthorizeRoute
   '/$': typeof DashboardInventorySplatRoute
   '/approvals/$runId': typeof DashboardApprovalsRunIdRoute
+  '/connections/$connectionId': typeof DashboardConnectionsConnectionIdRoute
   '/mcp/approve/$requestId': typeof McpApproveRequestIdRoute
   '/approvals/': typeof DashboardApprovalsIndexRoute
   '/apps/$appId': typeof DashboardInventoryAppsAppIdRoute
@@ -157,16 +158,16 @@ export interface FileRoutesByFullPath {
   '/api/oauth/callback': typeof DashboardInventoryApiOauthCallbackRoute
   '/apps/$appId/delete': typeof DashboardInventoryAppsAppIdDeleteRoute
   '/apps/$appId/setup': typeof DashboardInventoryAppsAppIdSetupRoute
-  '/apps/add/custom': typeof DashboardInventoryAppsAddCustomRoute
 }
 export interface FileRoutesByTo {
   '/': typeof DashboardInventoryIndexRoute
   '/app-auth': typeof AppAuthRoute
-  '/connect': typeof DashboardConnectRoute
+  '/connections': typeof DashboardConnectionsRoute
   '/account-connect/$connectionId': typeof AccountConnectConnectionIdRoute
   '/mcp/authorize': typeof McpAuthorizeRoute
   '/$': typeof DashboardInventorySplatRoute
   '/approvals/$runId': typeof DashboardApprovalsRunIdRoute
+  '/connections/$connectionId': typeof DashboardConnectionsConnectionIdRoute
   '/mcp/approve/$requestId': typeof McpApproveRequestIdRoute
   '/approvals': typeof DashboardApprovalsIndexRoute
   '/apps/$appId': typeof DashboardInventoryAppsAppIdRoute
@@ -177,18 +178,18 @@ export interface FileRoutesByTo {
   '/api/oauth/callback': typeof DashboardInventoryApiOauthCallbackRoute
   '/apps/$appId/delete': typeof DashboardInventoryAppsAppIdDeleteRoute
   '/apps/$appId/setup': typeof DashboardInventoryAppsAppIdSetupRoute
-  '/apps/add/custom': typeof DashboardInventoryAppsAddCustomRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/_dashboard': typeof DashboardRouteWithChildren
   '/app-auth': typeof AppAuthRoute
   '/_dashboard/_inventory': typeof DashboardInventoryRouteWithChildren
-  '/_dashboard/connect': typeof DashboardConnectRoute
+  '/_dashboard/connections': typeof DashboardConnectionsRoute
   '/account-connect/$connectionId': typeof AccountConnectConnectionIdRoute
   '/mcp/authorize': typeof McpAuthorizeRoute
   '/_dashboard/_inventory/$': typeof DashboardInventorySplatRoute
   '/_dashboard/approvals/$runId': typeof DashboardApprovalsRunIdRoute
+  '/_dashboard/connections_/$connectionId': typeof DashboardConnectionsConnectionIdRoute
   '/mcp/approve/$requestId': typeof McpApproveRequestIdRoute
   '/_dashboard/_inventory/': typeof DashboardInventoryIndexRoute
   '/_dashboard/approvals/': typeof DashboardApprovalsIndexRoute
@@ -200,18 +201,18 @@ export interface FileRoutesById {
   '/_dashboard/_inventory/api/oauth/callback': typeof DashboardInventoryApiOauthCallbackRoute
   '/_dashboard/_inventory/apps/$appId_/delete': typeof DashboardInventoryAppsAppIdDeleteRoute
   '/_dashboard/_inventory/apps/$appId_/setup': typeof DashboardInventoryAppsAppIdSetupRoute
-  '/_dashboard/_inventory/apps/add_/custom': typeof DashboardInventoryAppsAddCustomRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
   fullPaths:
     | '/'
     | '/app-auth'
-    | '/connect'
+    | '/connections'
     | '/account-connect/$connectionId'
     | '/mcp/authorize'
     | '/$'
     | '/approvals/$runId'
+    | '/connections/$connectionId'
     | '/mcp/approve/$requestId'
     | '/approvals/'
     | '/apps/$appId'
@@ -222,16 +223,16 @@ export interface FileRouteTypes {
     | '/api/oauth/callback'
     | '/apps/$appId/delete'
     | '/apps/$appId/setup'
-    | '/apps/add/custom'
   fileRoutesByTo: FileRoutesByTo
   to:
     | '/'
     | '/app-auth'
-    | '/connect'
+    | '/connections'
     | '/account-connect/$connectionId'
     | '/mcp/authorize'
     | '/$'
     | '/approvals/$runId'
+    | '/connections/$connectionId'
     | '/mcp/approve/$requestId'
     | '/approvals'
     | '/apps/$appId'
@@ -242,17 +243,17 @@ export interface FileRouteTypes {
     | '/api/oauth/callback'
     | '/apps/$appId/delete'
     | '/apps/$appId/setup'
-    | '/apps/add/custom'
   id:
     | '__root__'
     | '/_dashboard'
     | '/app-auth'
     | '/_dashboard/_inventory'
-    | '/_dashboard/connect'
+    | '/_dashboard/connections'
     | '/account-connect/$connectionId'
     | '/mcp/authorize'
     | '/_dashboard/_inventory/$'
     | '/_dashboard/approvals/$runId'
+    | '/_dashboard/connections_/$connectionId'
     | '/mcp/approve/$requestId'
     | '/_dashboard/_inventory/'
     | '/_dashboard/approvals/'
@@ -264,7 +265,6 @@ export interface FileRouteTypes {
     | '/_dashboard/_inventory/api/oauth/callback'
     | '/_dashboard/_inventory/apps/$appId_/delete'
     | '/_dashboard/_inventory/apps/$appId_/setup'
-    | '/_dashboard/_inventory/apps/add_/custom'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
@@ -298,11 +298,11 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DashboardInventoryRouteImport
       parentRoute: typeof DashboardRoute
     }
-    '/_dashboard/connect': {
-      id: '/_dashboard/connect'
-      path: '/connect'
-      fullPath: '/connect'
-      preLoaderRoute: typeof DashboardConnectRouteImport
+    '/_dashboard/connections': {
+      id: '/_dashboard/connections'
+      path: '/connections'
+      fullPath: '/connections'
+      preLoaderRoute: typeof DashboardConnectionsRouteImport
       parentRoute: typeof DashboardRoute
     }
     '/account-connect/$connectionId': {
@@ -347,6 +347,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DashboardApprovalsRunIdRouteImport
       parentRoute: typeof DashboardRoute
     }
+    '/_dashboard/connections_/$connectionId': {
+      id: '/_dashboard/connections_/$connectionId'
+      path: '/connections/$connectionId'
+      fullPath: '/connections/$connectionId'
+      preLoaderRoute: typeof DashboardConnectionsConnectionIdRouteImport
+      parentRoute: typeof DashboardRoute
+    }
     '/mcp/approve/$requestId': {
       id: '/mcp/approve/$requestId'
       path: '/mcp/approve/$requestId'
@@ -410,13 +417,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DashboardInventoryAppsAppIdSetupRouteImport
       parentRoute: typeof DashboardInventoryRoute
     }
-    '/_dashboard/_inventory/apps/add_/custom': {
-      id: '/_dashboard/_inventory/apps/add_/custom'
-      path: '/apps/add/custom'
-      fullPath: '/apps/add/custom'
-      preLoaderRoute: typeof DashboardInventoryAppsAddCustomRouteImport
-      parentRoute: typeof DashboardInventoryRoute
-    }
   }
 }
 
@@ -430,7 +430,6 @@ interface DashboardInventoryRouteChildren {
   DashboardInventoryApiOauthCallbackRoute: typeof DashboardInventoryApiOauthCallbackRoute
   DashboardInventoryAppsAppIdDeleteRoute: typeof DashboardInventoryAppsAppIdDeleteRoute
   DashboardInventoryAppsAppIdSetupRoute: typeof DashboardInventoryAppsAppIdSetupRoute
-  DashboardInventoryAppsAddCustomRoute: typeof DashboardInventoryAppsAddCustomRoute
 }
 
 const DashboardInventoryRouteChildren: DashboardInventoryRouteChildren = {
@@ -445,7 +444,6 @@ const DashboardInventoryRouteChildren: DashboardInventoryRouteChildren = {
   DashboardInventoryAppsAppIdDeleteRoute:
     DashboardInventoryAppsAppIdDeleteRoute,
   DashboardInventoryAppsAppIdSetupRoute: DashboardInventoryAppsAppIdSetupRoute,
-  DashboardInventoryAppsAddCustomRoute: DashboardInventoryAppsAddCustomRoute,
 }
 
 const DashboardInventoryRouteWithChildren =
@@ -453,16 +451,18 @@ const DashboardInventoryRouteWithChildren =
 
 interface DashboardRouteChildren {
   DashboardInventoryRoute: typeof DashboardInventoryRouteWithChildren
-  DashboardConnectRoute: typeof DashboardConnectRoute
+  DashboardConnectionsRoute: typeof DashboardConnectionsRoute
   DashboardApprovalsRunIdRoute: typeof DashboardApprovalsRunIdRoute
+  DashboardConnectionsConnectionIdRoute: typeof DashboardConnectionsConnectionIdRoute
   DashboardApprovalsIndexRoute: typeof DashboardApprovalsIndexRoute
   DashboardWebhooksAppIdSubscriptionIdRoute: typeof DashboardWebhooksAppIdSubscriptionIdRoute
 }
 
 const DashboardRouteChildren: DashboardRouteChildren = {
   DashboardInventoryRoute: DashboardInventoryRouteWithChildren,
-  DashboardConnectRoute: DashboardConnectRoute,
+  DashboardConnectionsRoute: DashboardConnectionsRoute,
   DashboardApprovalsRunIdRoute: DashboardApprovalsRunIdRoute,
+  DashboardConnectionsConnectionIdRoute: DashboardConnectionsConnectionIdRoute,
   DashboardApprovalsIndexRoute: DashboardApprovalsIndexRoute,
   DashboardWebhooksAppIdSubscriptionIdRoute:
     DashboardWebhooksAppIdSubscriptionIdRoute,
diff --git a/apps/local/web/src/implementation/routes/_dashboard._inventory.apps.add_.custom.tsx b/apps/local/web/src/implementation/routes/_dashboard._inventory.apps.add_.custom.tsx
deleted file mode 100644
index f342e80ca4..0000000000
--- a/apps/local/web/src/implementation/routes/_dashboard._inventory.apps.add_.custom.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { CustomAppPage } from "../pages/custom-app.tsx";
-/** Generated-tree route for /_dashboard/_inventory/apps/add_/custom. */
-export const Route = createFileRoute("/_dashboard/_inventory/apps/add_/custom")({
-  staticData: { section: "apps" },
-  component: CustomAppPage,
-});
diff --git a/apps/local/web/src/implementation/routes/_dashboard.connect.tsx b/apps/local/web/src/implementation/routes/_dashboard.connect.tsx
deleted file mode 100644
index 253e68d373..0000000000
--- a/apps/local/web/src/implementation/routes/_dashboard.connect.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { ConnectAgentPage } from "../pages/connect-agent.tsx";
-/** Generated-tree route for /_dashboard/connect. */
-export const Route = createFileRoute("/_dashboard/connect")({
-  staticData: { section: "connect" },
-  component: ConnectAgentPage,
-});
diff --git a/apps/local/web/src/implementation/routes/_dashboard.connections.tsx b/apps/local/web/src/implementation/routes/_dashboard.connections.tsx
new file mode 100644
index 0000000000..33d7ed8b69
--- /dev/null
+++ b/apps/local/web/src/implementation/routes/_dashboard.connections.tsx
@@ -0,0 +1,8 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { ConnectionsPage } from "../pages/connections.tsx";
+
+/** Generated-tree route for /_dashboard/connections. */
+export const Route = createFileRoute("/_dashboard/connections")({
+  staticData: { section: "connect" },
+  component: ConnectionsPage,
+});
diff --git a/apps/local/web/src/implementation/routes/_dashboard.connections_.$connectionId.tsx b/apps/local/web/src/implementation/routes/_dashboard.connections_.$connectionId.tsx
new file mode 100644
index 0000000000..3e74fbd0d6
--- /dev/null
+++ b/apps/local/web/src/implementation/routes/_dashboard.connections_.$connectionId.tsx
@@ -0,0 +1,13 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { ConnectionPage } from "../pages/connections.tsx";
+
+/** Generated-tree route for /_dashboard/connections_/$connectionId. */
+export const Route = createFileRoute("/_dashboard/connections_/$connectionId")({
+  staticData: { section: "connect" },
+  component: ConnectionRoute,
+});
+
+function ConnectionRoute() {
+  const { connectionId } = Route.useParams();
+  return <ConnectionPage connectionId={connectionId} />;
+}
diff --git a/bun.lock b/bun.lock
index 66dcb874f1..7b14621998 100644
--- a/bun.lock
+++ b/bun.lock
@@ -40,7 +40,7 @@
     },
     "apps/cli": {
       "name": "executor",
-      "version": "2.0.0-beta.26",
+      "version": "2.0.0-beta.34",
     },
     "apps/docs": {
       "name": "@executor-js/docs",
@@ -488,7 +488,7 @@
     },
     "packages/apps": {
       "name": "apps",
-      "version": "0.0.1-beta.100.shuv.3",
+      "version": "0.0.1-beta.119.shuv.1",
       "dependencies": {
         "@cfworker/json-schema": "4.1.1",
         "@csstools/css-tokenizer": "4.0.2",
@@ -855,6 +855,7 @@
     "@swagger-api/apidom-ns-openapi-3-1@1.11.6": "patches/@swagger-api%2Fapidom-ns-openapi-3-1@1.11.6.patch",
     "@electric-sql/pglite@0.5.8": "patches/@electric-sql%2Fpglite@0.5.8.patch",
     "better-auth@1.7.5": "patches/better-auth@1.7.5.patch",
+    "@better-auth/core@1.7.5": "patches/@better-auth%2Fcore@1.7.5.patch",
     "tree-sitter@0.22.4": "patches/tree-sitter@0.22.4.patch",
     "@cloudflare/worker-bundler@0.2.4": "patches/@cloudflare%2Fworker-bundler@0.2.4.patch",
     "@effect/sql-pg@4.0.1": "patches/@effect%2Fsql-pg@4.0.1.patch",
diff --git a/e2e/README.md b/e2e/README.md
index d6b55245d8..e4bd4f5aee 100644
--- a/e2e/README.md
+++ b/e2e/README.md
@@ -957,8 +957,10 @@ EXECUTOR_E2E_RUNTIME_ARCHIVE=/path/to/executor-<version>-<platform>-<arch>.tgz \
 ```
 
 The desktop artifact smoke uses the packaged executable, synthetic secrets and a
-fresh profile/data directory. It deploys a dependency-using app, calls it, closes
-the app, then calls the retained app after restart:
+fresh profile/data directory. It deploys a dependency-using app, calls it and
+closes the app. The background server keeps running; the CLI the desktop staged
+reports and stops it. The scenario then calls the retained app after the desktop
+starts the server again:
 
 ```sh
 EXECUTOR_E2E_DESKTOP_EXECUTABLE='/path/to/Executor Preview.app/Contents/MacOS/Executor Preview' \
diff --git a/e2e/benchmarks/README.md b/e2e/benchmarks/README.md
index 9eb50cb0e5..6d858da67b 100644
--- a/e2e/benchmarks/README.md
+++ b/e2e/benchmarks/README.md
@@ -105,7 +105,7 @@ own schedule of an app they deploy in `call` (`Perf scheduled runs`) and wait fo
 finish. Those runs are dispatched by the schedule coordinator, whose statements go from wherever
 that object lives, so they measure the background path that placed requests do not. Client time
 includes the coordinator's one-second alarm delay; server time is the run's recorded duration.
-Read `schedule.dispatch` and coordinator `sql.wire` from the stage traces. `load-compare`
+Read `schedule.dispatch` and the coordinator's `db.wire.*` statement timings from the stage traces. `load-compare`
 alternates whole windows between two stages.
 
 ### Idle supervisors
@@ -137,6 +137,21 @@ hop is `mcp.session.forward` minus the object's `http.server` span, read from th
 when the gateway and object clocks disagree. The hop includes object activation, transit and
 object CPU after its last I/O, which Cloudflare's I/O clock does not advance through.
 
+### Many session objects
+
+```sh
+$P session-fanout --control $E/stage-control.json --keys $E/fanout-keys.json \
+  --output $E/results/fanout.json --objects 300 --seconds 240 --interval 20 --parallel 2
+```
+
+A session object belongs to one grant, so each API key addresses its own. The command creates
+`--objects` keys in a fixture organization (kept in the private `--keys` file, mode 0600, and
+reused by later runs; key creation waits out sign-in rate limits), opens one MCP session per key,
+and has each make `--parallel` concurrent `execute` calls every `--interval` seconds for
+`--seconds`. It prints failed calls by the text the product returned. Read the branch's
+PgBouncer clients from PlanetScale (`planetscale_pgbouncer_pools_client`, pool `active`) during
+the run: each object that connects directly holds its own (notes/database-pool.md).
+
 ## 5. Flamecharts
 
 ```sh
diff --git a/e2e/benchmarks/perf/client.ts b/e2e/benchmarks/perf/client.ts
index e6be568783..75382266dc 100644
--- a/e2e/benchmarks/perf/client.ts
+++ b/e2e/benchmarks/perf/client.ts
@@ -4,6 +4,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { Effect, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { randomBytes } from "node:crypto";
+import { roleHost } from "../../support/role-hosts.ts";
 
 export class PerfRequestFailed extends Schema.TaggedError<PerfRequestFailed>()(
   "PerfRequestFailed",
@@ -38,10 +39,15 @@ export const cookieHeader = (cookies: readonly { name: string; value: string }[]
 
 export type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 
-/** Product HTTP client bound to one origin and one actor's cookies. */
-export const productClient = (origin: string, cookies: string) =>
+/**
+ * Product HTTP client for one stage and one actor's cookies. `origin` is the stage's deployment
+ * origin; requests go to its browser host (`app.`), where Cloud keeps sessions and checks their
+ * origin, as a browser's would.
+ */
+export const productClient = (deployment: string, cookies: string) =>
   Effect.gen(function* () {
     const http = yield* HttpClient.HttpClient;
+    const origin = roleHost(deployment, "app");
     const request = (method: Method, path: string, data?: unknown) =>
       Effect.gen(function* () {
         const url = new URL(path, origin);
diff --git a/e2e/benchmarks/perf/observer.ts b/e2e/benchmarks/perf/observer.ts
index accdc1c1eb..a5794570cd 100644
--- a/e2e/benchmarks/perf/observer.ts
+++ b/e2e/benchmarks/perf/observer.ts
@@ -4,7 +4,7 @@
  * It creates a short-lived monitoring role (pg_monitor, TTL) through the PlanetScale API, then
  * samples pg_stat_activity and blocking PIDs with psql `\watch`. Each sample records only backend
  * state, wait events, ages, the statement's leading keyword and its SQLCommenter traceparent, so a
- * slow `sql.wire` span can be matched to what the origin was doing. SQL text, parameters, rows
+ * slow `sql.execute` span can be matched to what the origin was doing. SQL text, parameters, rows
  * and credentials are never written. The role password stays in this process's memory.
  */
 import { Config, Console, Effect, FileSystem, Redacted, Schedule, Schema, Stream } from "effect";
diff --git a/e2e/benchmarks/perf/session-fanout.ts b/e2e/benchmarks/perf/session-fanout.ts
new file mode 100644
index 0000000000..1adcb23a4b
--- /dev/null
+++ b/e2e/benchmarks/perf/session-fanout.ts
@@ -0,0 +1,197 @@
+/**
+ * Many MCP session objects active at once. A session object is chosen by the caller's grant, so
+ * each API key here addresses its own object, and each object holds its own PgBouncer client
+ * connections while it is active (notes/database-pool.md). The run keeps `objects` sessions busy
+ * for `seconds`: every `interval` seconds each makes `parallel` concurrent `execute` calls. It
+ * reports every call that failed, by the text the product returned, so a run that exhausts the
+ * database's client connections shows the `StorageError` agents saw in production.
+ *
+ * The keys belong to one fixture organization and are kept in the private `keys` file (mode
+ * 0600), so later runs reuse them instead of creating more.
+ */
+import { Clock, Console, Effect, FileSystem, Schedule, Schema } from "effect";
+import { cookieHeader, mcpSession, PerfRequestFailed, productClient } from "./client.ts";
+import { fixtureId } from "./seed.ts";
+import { fixtureActors } from "./sessions.ts";
+import type { StageControl } from "./stage.ts";
+
+const Keys = Schema.Struct({
+  origin: Schema.String,
+  organization: Schema.String,
+  keys: Schema.Array(Schema.String),
+});
+const Created = Schema.Struct({ key: Schema.String });
+
+export interface FanoutCall {
+  readonly object: number;
+  readonly at: string;
+  readonly ok: boolean;
+  /** The product's text for a failed call, or the client error; empty for a success. */
+  readonly failure: string;
+  readonly clientMs: number;
+  readonly traceId: string | undefined;
+}
+
+/** Collapse ids and numbers so failures with the same cause count together. */
+const failureKind = (text: string) =>
+  text
+    .replace(/[0-9a-f]{8,}/g, "<id>")
+    .replace(/\d+/g, "<n>")
+    .slice(0, 160);
+
+const resultText = (result: unknown) => {
+  const content = (result as { content?: ReadonlyArray<{ type: string; text?: string }> }).content;
+  return (content ?? []).map((block) => block.text ?? "").join(" ");
+};
+
+const ensureKeys = (control: StageControl, file: string, count: number) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const actors = yield* fixtureActors(control, fixtureId(0, "session-fanout"), "perf fanout");
+    const stored = (yield* fs.exists(file))
+      ? yield* fs
+          .readFileString(file)
+          .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Keys))))
+      : undefined;
+    if (stored !== undefined && stored.origin !== control.origin)
+      return yield* new PerfRequestFailed({
+        operation: "fanout keys",
+        detail: "The keys file was made for another stage",
+      });
+    const keys = [...(stored?.keys ?? [])];
+    const client = yield* productClient(control.origin, cookieHeader(actors.actors.owner.cookies));
+    const save = Effect.suspend(() =>
+      fs.writeFileString(
+        file,
+        JSON.stringify({ origin: control.origin, organization: actors.organization.id, keys }),
+        { mode: 0o600 },
+      ),
+    );
+    while (keys.length < count) {
+      // Sign-in rate limits apply to key creation; wait them out instead of failing the run.
+      const response = yield* client
+        .request("POST", "/api/auth/api-key/create", { name: `Perf fanout ${keys.length}` })
+        .pipe(
+          Effect.flatMap((answer) =>
+            answer.status === 429
+              ? Effect.fail(
+                  new PerfRequestFailed({ operation: "api key", status: 429, detail: "" }),
+                )
+              : Effect.succeed(answer),
+          ),
+          Effect.retry({
+            while: (error) => error.status === 429,
+            schedule: Schedule.spaced("15 seconds"),
+            times: 40,
+          }),
+        );
+      if (response.status !== 200)
+        return yield* new PerfRequestFailed({
+          operation: "api key",
+          status: response.status,
+          detail: JSON.stringify(response.body).slice(0, 300),
+        });
+      keys.push((yield* Schema.decodeUnknownEffect(Created)(response.body)).key);
+      yield* save;
+    }
+    return { organization: actors.organization.id, keys: keys.slice(0, count) };
+  });
+
+export const runSessionFanout = (input: {
+  readonly control: StageControl;
+  readonly keysFile: string;
+  readonly objects: number;
+  readonly seconds: number;
+  readonly interval: number;
+  readonly parallel: number;
+}) =>
+  Effect.gen(function* () {
+    const { organization, keys } = yield* ensureKeys(input.control, input.keysFile, input.objects);
+    yield* Console.log(`${keys.length} keys ready; opening sessions.`);
+    const calls: FanoutCall[] = [];
+    const started = yield* Clock.currentTimeMillis;
+    const deadline = started + input.seconds * 1000;
+    const call = (object: number, session: Effect.Success<ReturnType<typeof mcpSession>>) =>
+      Effect.gen(function* () {
+        const at = new Date(yield* Clock.currentTimeMillis).toISOString();
+        const begun = performance.now();
+        return yield* session.callTool("execute", { code: "return 1" }).pipe(
+          Effect.map(({ result, exchanges }) => {
+            const failed = (result as { isError?: boolean }).isError === true;
+            return {
+              object,
+              at,
+              ok: !failed,
+              failure: failed ? failureKind(resultText(result)) : "",
+              clientMs: performance.now() - begun,
+              traceId: exchanges.at(-1)?.traceId,
+            } satisfies FanoutCall;
+          }),
+          Effect.catch((error) =>
+            Effect.succeed({
+              object,
+              at,
+              ok: false,
+              failure: failureKind(error.detail),
+              clientMs: performance.now() - begun,
+              traceId: undefined,
+            } satisfies FanoutCall),
+          ),
+        );
+      });
+    yield* Effect.forEach(
+      keys,
+      (key, object) =>
+        Effect.gen(function* () {
+          // Spread session starts over the first interval, as independent agents arrive.
+          yield* Effect.sleep(Math.floor((object / keys.length) * input.interval * 1000));
+          const opened = yield* mcpSession(input.control.origin, key, organization).pipe(
+            Effect.map((session) => ({ session, failure: "" })),
+            Effect.catch((error) =>
+              Effect.succeed({ session: undefined, failure: failureKind(error.detail) }),
+            ),
+          );
+          if (opened.session === undefined) {
+            calls.push({
+              object,
+              at: new Date(yield* Clock.currentTimeMillis).toISOString(),
+              ok: false,
+              failure: `initialize: ${opened.failure}`,
+              clientMs: 0,
+              traceId: undefined,
+            });
+            return;
+          }
+          const session = opened.session;
+          while ((yield* Clock.currentTimeMillis) < deadline) {
+            const tick = yield* Clock.currentTimeMillis;
+            calls.push(
+              ...(yield* Effect.all(
+                Array.from({ length: input.parallel }, () => call(object, session)),
+                { concurrency: "unbounded" },
+              )),
+            );
+            const wait = tick + input.interval * 1000 - (yield* Clock.currentTimeMillis);
+            if (wait > 0) yield* Effect.sleep(wait);
+          }
+          yield* session.close.pipe(Effect.ignore);
+        }),
+      { concurrency: "unbounded", discard: true },
+    );
+    const failures = new Map<string, number>();
+    for (const entry of calls) {
+      if (entry.ok) continue;
+      failures.set(entry.failure, (failures.get(entry.failure) ?? 0) + 1);
+    }
+    const failed = calls.filter((entry) => !entry.ok).length;
+    yield* Console.log(
+      `${keys.length} objects, ${calls.length} calls, ${failed} failed (${((100 * failed) / Math.max(1, calls.length)).toFixed(2)}%).`,
+    );
+    for (const [text, count] of [...failures].sort((a, b) => b[1] - a[1]))
+      yield* Console.log(`  ${String(count).padStart(6)}  ${text}`);
+    return {
+      startedAt: new Date(started).toISOString(),
+      endedAt: new Date(yield* Clock.currentTimeMillis).toISOString(),
+      calls,
+    };
+  });
diff --git a/e2e/benchmarks/perf/stage.ts b/e2e/benchmarks/perf/stage.ts
index 8275278056..7868d15c5a 100644
--- a/e2e/benchmarks/perf/stage.ts
+++ b/e2e/benchmarks/perf/stage.ts
@@ -76,6 +76,9 @@ export const serveStage = (input: {
             "retained",
             "--background",
             "active",
+            // The harness reads its spans back from Axiom.
+            "--telemetry",
+            "export",
             "--owner",
             "Perf harness 0925",
             "--no-input",
diff --git a/e2e/benchmarks/run-perf.ts b/e2e/benchmarks/run-perf.ts
index 720628f566..5909bf266c 100644
--- a/e2e/benchmarks/run-perf.ts
+++ b/e2e/benchmarks/run-perf.ts
@@ -23,6 +23,7 @@ import { Observation, observe, summarizeObservations } from "./perf/observer.ts"
 import { sqlStats } from "./perf/sql-stats.ts";
 import { runIdle } from "./perf/idle.ts";
 import { runSessionHop } from "./perf/session-hop.ts";
+import { runSessionFanout } from "./perf/session-fanout.ts";
 
 const stage = Command.make(
   "stage",
@@ -247,6 +248,47 @@ const sessionHop = Command.make(
     }),
 );
 
+const sessionFanout = Command.make(
+  "session-fanout",
+  {
+    control: Flag.String("control"),
+    keys: Flag.String("keys"),
+    output: Flag.String("output"),
+    objects: Flag.Int("objects").pipe(Flag.withDefault(200)),
+    seconds: Flag.Int("seconds").pipe(Flag.withDefault(180)),
+    interval: Flag.Int("interval").pipe(Flag.withDefault(20)),
+    parallel: Flag.Int("parallel").pipe(Flag.withDefault(2)),
+  },
+  (input) =>
+    Effect.gen(function* () {
+      const control = yield* readStageControl(input.control);
+      const run = yield* runSessionFanout({
+        control,
+        keysFile: input.keys,
+        objects: input.objects,
+        seconds: input.seconds,
+        interval: input.interval,
+        parallel: input.parallel,
+      }).pipe(
+        Effect.tapError((error) =>
+          Console.error(
+            `${error._tag}: ${"operation" in error ? `${error.operation} ` : ""}${"status" in error && error.status !== undefined ? `HTTP ${error.status} ` : ""}${"detail" in error ? error.detail : ""}`,
+          ),
+        ),
+      );
+      yield* writeJson(input.output, {
+        kind: "perf-session-fanout",
+        origin: control.origin,
+        slug: control.slug,
+        commit: control.commit,
+        objects: input.objects,
+        interval: input.interval,
+        parallel: input.parallel,
+        ...run,
+      });
+    }),
+);
+
 const flamechart = Command.make(
   "flamechart",
   {
@@ -408,7 +450,7 @@ const sqlstats = Command.make(
         });
         const execute = stats.foreground["sql.execute"];
         yield* Console.log(
-          `${window.label.padEnd(22)} ${window.startedAt} fg sql.execute n=${execute?.n ?? 0} >1s=${execute?.over1s ?? 0} (${((stats.foregroundExecuteOver1sRate ?? 0) * 100).toFixed(2)}%) >300=${execute?.over300 ?? 0} p99=${execute?.p99 ?? "-"} max=${execute?.max ?? "-"} | connects/trace=${stats.connectsPerForegroundTrace?.toFixed(2) ?? "-"} | wire first>1s=${stats.foreground["sql.wire"]?.firstOver1s ?? 0}`,
+          `${window.label.padEnd(22)} ${window.startedAt} fg sql.execute n=${execute?.n ?? 0} >1s=${execute?.over1s ?? 0} (${((stats.foregroundExecuteOver1sRate ?? 0) * 100).toFixed(2)}%) >300=${execute?.over300 ?? 0} p99=${execute?.p99 ?? "-"} max=${execute?.max ?? "-"} | connects/trace=${stats.connectsPerForegroundTrace?.toFixed(2) ?? "-"} | wire first>1s=${(execute?.firstOver1s ?? 0) + (stats.foreground["sql.wire"]?.firstOver1s ?? 0)}`,
         );
         // Dashboard reads and tool calls are judged separately from discovery-heavy executes.
         const byKind: Record<string, unknown> = {};
@@ -480,6 +522,7 @@ const root = Command.make("perf").pipe(
     run,
     idle,
     sessionHop,
+    sessionFanout,
     compare,
     flamechart,
     table,
diff --git a/e2e/check-boundary.ts b/e2e/check-boundary.ts
index c8e16b0dad..3deb2e1180 100644
--- a/e2e/check-boundary.ts
+++ b/e2e/check-boundary.ts
@@ -14,6 +14,7 @@ const allowed = new Set([
   "@modelcontextprotocol/sdk/client/index.js",
   "@modelcontextprotocol/sdk/types.js",
   "@modelcontextprotocol/sdk/client/streamableHttp.js",
+  "@modelcontextprotocol/sdk/validation/cfworker",
   "vitest",
   "vitest/config",
   "effect/http",
diff --git a/e2e/ci-selection.ts b/e2e/ci-selection.ts
index 9426a1b1b2..85d7bbd01f 100644
--- a/e2e/ci-selection.ts
+++ b/e2e/ci-selection.ts
@@ -62,7 +62,7 @@ class SelectionFailed extends Schema.TaggedError<SelectionFailed>()("SelectionFa
 const claude = "Claude Code connects";
 const inventoryLoad = "concurrent owners and admins save every account";
 const catalogScale =
-  "MCP execute over 7,000 tools|MCP execute pays for a slow app|MCP execute remembers a stalled";
+  "MCP execute over 7,000 tools|MCP execute pays for a slow app|MCP execute remembers a stalled|MCP execute serves a search from rows past|MCP execute reports an app whose aged";
 
 /**
  * Each output feeds one `--test-name` in checks.yml. Full runs use these patterns unchanged.
@@ -74,8 +74,10 @@ const catalogScale =
  * its files take.
  *
  * Each Cloud job starts its own local Cloud. Those with the same `runner` run one after another on
- * one e2e-cloud runner, about four minutes of steps on each of the three on a full run; the
- * runners run at once. Keep them about even when adding a job.
+ * one e2e-cloud runner; the four runners run at once, and the slowest sets how long a full run
+ * takes. On a full run `cloud-product`'s step takes about eleven minutes, so it has a runner to
+ * itself, and each other runner's steps take about six or seven. Keep them about even when adding
+ * a job.
  */
 const jobs = {
   local: { target: "local", pattern: `^(?!.*${claude})`, shards: 2 },
@@ -92,7 +94,7 @@ const jobs = {
     runner: 1,
 
     pattern:
-      "Cloud onboarding|Cloud sign-in (?:keeps a new v1|skips the v1 check|admits members of only empty free v1)|Cloud OAuth callbacks|Cloud OAuth token requests record|Cloud product events|Cloud feedback|Cloud tracks an unusable OAuth|app query traces|observability retains|browser decode and startup|Browser connection failures explain|optimistic replay failures|private app crash reports|Platform admin impersonation|Cloud reports the framework pin|Cloud deploys fail promptly when the compiler does not answer|refuses every stored state Better Auth refuses|Billing reconciles only while visible|A dashboard read refreshed while in flight|Cloud finishes a slow app's tool listing|Cloud remembers a stalled tool listing|Cloud keeps each JSON Schema definition a tool listing repeats once|definitions share a name and length but not their JSON|definition names are long and of one length|Cloud MCP session objects (?:hold|make)|Cloud MCP request spans say whether|database failure while verifying an API key|use one API key together|Cloud cron wakes the schedule coordinator|Cloud runs a due schedule and requested webhook source setup while|app evaluation failures explain the likely cause|client request rejections are recorded on their request span|failure text reaches its caller|an app request Executor's network failed to send|MCP tool calls deliver their tool name and outcome|Executor time|Cloud serves a tool listing its isolate cannot keep|Cloud writes the background refresh of a stale tool listing|Owners delete an organization with every app|Hosted MCP negotiates older protocol versions|Hosted MCP ends a cancelled call|Cloud lists each build's browser files|Hosted dashboard runs of approval-gated tools|Hosted dashboard approval",
+      "Cloud app queries read current authorization|Cloud onboarding|Cloud sign-in (?:keeps a new v1|skips the v1 check|admits members of only empty free v1)|Cloud OAuth callbacks|Cloud OAuth token requests record|Cloud product events|Cloud feedback|Cloud tracks an unusable OAuth|app query traces|observability retains|browser decode and startup|Browser connection failures explain|optimistic replay failures|private app crash reports|Platform admin impersonation|Cloud reports the framework pin|Cloud deploys fail promptly when the compiler does not answer|refuses every stored state Better Auth refuses|Billing reconciles only while visible|A dashboard read refreshed while in flight|Cloud finishes a slow app's tool listing|Cloud remembers a stalled tool listing|Cloud keeps serving aged search rows when it stops their renewal|Cloud keeps each JSON Schema definition a tool listing repeats once|definitions share a name and length but not their JSON|definition names are long and of one length|Cloud MCP session objects (?:hold|make)|Cloud MCP request spans say whether|database failure while verifying an API key|use one API key together|Cloud cron wakes the schedule coordinator|schedule coordinator closes its database connections|Cloud runs a due schedule and requested webhook source setup while|app evaluation failures explain the likely cause|runtime limit matched from an app Worker|client request rejections are recorded on their request span|failure text reaches its caller|scheduled runs record whether the app's code|an app request Executor's network failed to send|an app's fetch receives a Brotli-encoded response|MCP tool calls deliver their tool name and outcome|Executor time|Cloud serves a tool listing its isolate cannot keep|Cloud writes the background refresh of a stale tool listing|Owners delete an organization with every app|Hosted MCP negotiates older protocol versions|Hosted MCP ends a cancelled call|Cloud lists each build's browser files|Hosted dashboard runs of approval-gated tools|Hosted dashboard approval",
   },
   // The scenarios above share one local Cloud and collector, and their span and latency checks
   // stall when more scenarios load it. These assert no such bound, so they start their own. The
@@ -103,14 +105,14 @@ const jobs = {
     runner: 3,
 
     pattern:
-      "Cloud SSO SAML accepts|Cloud's operator OAuth client signs in|Safari reports only the page's own failures|Cloud cron triggers run their jobs|Cloud support dialog lists every channel|Hosted feedback enforces its API contract|Executor's catalog calls an app's own cache methods|Executor app is installed with nothing left pending|Cloud MCP routes a request inside a session|Cloud MCP sessions continue after their session object is evicted|Request and workflow attempts at one team|remote skill catalog|a skill read without a revision|abandons a GitHub skills load|reads its catalog and the tool in one cache command|a cold call's wake is reported by that call alone|another organization's admin cannot read the link|account connections cannot cross organizations|Deploys wake webhook source setup|A skill catalog refreshed in the background after a dashboard batch read|Cloud MCP session objects run parallel tool calls|Cloud MCP session objects cancel a statement|Cloud MCP session objects discover the other apps|Cloud MCP session objects' database pool|Hosted MCP resume reports an approved call's own failure|Cloud refuses to remove an organization while one of its app workflows runs|Cloud v1 import (?!keeps at most the bound)",
+      "Cloud SSO SAML accepts|Cloud's operator OAuth client signs in|Safari reports only the page's own failures|Cloud cron triggers run their jobs|Cloud cron jobs record their outcome|Cloud support dialog lists every channel|Hosted feedback enforces its API contract|Executor's catalog calls an app's own cache methods|Executor app is installed with nothing left pending|Cloud MCP routes a request inside a session|Cloud MCP sessions continue after their session object is evicted|Request and workflow attempts at one team|remote skill catalog|a skill read without a revision|abandons a GitHub skills load|reads its catalog and the tool in one cache command|a cold call's wake is reported by that call alone|another organization's admin cannot read the link|account connections cannot cross organizations|Deploys wake webhook source setup|Cloud's schedule coordinator keeps nine slow scheduled runs|a webhook source reconciling for an activation that another supersedes|A skill catalog refreshed in the background after a dashboard batch read|Cloud MCP session objects run parallel tool calls|Cloud MCP session objects cancel a statement|Cloud MCP session objects discover the other apps|Cloud MCP session objects' database pool|Hosted MCP resume reports an approved call's own failure|Cloud refuses to remove an organization while one of its app workflows runs|Cloud v1 import (?!keeps at most the bound)|Hosted MCP operation and bearer-check spans name|Hosted management API request spans name only|Cloud's gateway names an authenticated MCP request's organization",
   },
   // Cloud's hosts: role hosts, the edge and sign-in on `app.`. Run in `cloud-product`, their
   // load kept the team installation's workflow span from arriving within its 30-second wait, so
   // they start their own local Cloud too.
   "cloud-domains": {
     target: "cloud",
-    runner: 3,
+    runner: 4,
     pattern:
       "cloud role hosts serve only|a grant is for its one resource|role host resource seed|Cloud request spans name the host|Cloud sign-in explains that a passkey|Cloud connected-account sign-ins return through|Cloud serves its site for the edge|keep serving the published skills index|Apps directory on the edge reads|Cloud's API host serves the SDK|Cloud's own social sign-ins on app\\.|hosted wildcard routes trace their template|Cloud links the site's anonymous visitor",
   },
@@ -142,7 +144,7 @@ const jobs = {
   // scenarios read billing and v1 plans, so this slows Autumn on its own local Cloud.
   "cloud-autumn": {
     target: "cloud",
-    runner: 1,
+    runner: 4,
     pattern: "Cloud sign-in's v1 check and the billing overview",
   },
   // This counts every request in local Cloud's single session object isolate, so another
@@ -152,14 +154,14 @@ const jobs = {
   // asserts it starts its own local Cloud, where no other scenario's organizations run.
   "cloud-v1-bound": {
     target: "cloud",
-    runner: 1,
+    runner: 4,
     pattern: "Cloud v1 import keeps at most the bound",
   },
   // Managed Cloud turns the per-address auth limit off; this job starts one with it on. Its
   // database scenarios lock the limit's table, which every request of this Cloud uses.
   "cloud-rate-limit": {
     target: "cloud",
-    runner: 3,
+    runner: 4,
 
     cloudMode: "rate-limited",
     pattern:
@@ -176,7 +178,7 @@ const jobs = {
   // Managed Cloud is the OAuth proxy's production; this job runs a test stage signing in through it.
   "cloud-oauth-proxy-preview": {
     target: "cloud",
-    runner: 3,
+    runner: 4,
     cloudMode: "oauth-proxy-preview",
     pattern:
       "A test stage signs in through production's OAuth proxy|A test stage connects an account with production's OAuth callback",
@@ -598,6 +600,7 @@ const suiteConfigs: Record<string, () => Promise<unknown>> = {
   "prepare-cache.config.ts": () => import("./prepare-cache.config.ts"),
   "release-archives.config.ts": () => import("./release-archives.config.ts"),
   "standalone-lockdown.config.ts": () => import("./standalone-lockdown.config.ts"),
+  "subrequest-depth.config.ts": () => import("./subrequest-depth.config.ts"),
   "typecheck-runner.config.ts": () => import("./typecheck-runner.config.ts"),
   "welcome-email.config.ts": () => import("./welcome-email.config.ts"),
 };
diff --git a/e2e/docker-release.config.ts b/e2e/docker-release.config.ts
index f30fd4d103..d0303c8b6f 100644
--- a/e2e/docker-release.config.ts
+++ b/e2e/docker-release.config.ts
@@ -5,6 +5,7 @@ export default defineConfig({
       "e2e/tests/docker-release.spec.ts",
       "e2e/tests/docker-release-app-memory.spec.ts",
       "e2e/tests/docker-release-credential-handles.spec.ts",
+      "e2e/tests/docker-release-executor-api.spec.ts",
       "e2e/tests/docker-release-workflow-memory.spec.ts",
       "e2e/tests/docker-release-workflow-restart.spec.ts",
       "e2e/tests/docker-release-workflow-stopped.spec.ts",
diff --git a/e2e/npm-packages.json b/e2e/npm-packages.json
index 4781dd0ab7..2556670ad6 100644
--- a/e2e/npm-packages.json
+++ b/e2e/npm-packages.json
@@ -119,6 +119,11 @@
       "name": "apps",
       "range": "0.0.1-beta.84",
       "transitive": false
+    },
+    {
+      "name": "apps",
+      "range": "0.0.1-beta.95",
+      "transitive": false
     }
   ],
   "packages": {
@@ -349,6 +354,14 @@
             "@effect/sql-sqlite-do": "https://pkg.pr.new/Effect-TS/effect/@effect/sql-sqlite-do@c7d1ffff31a3e2ae0b0b0796b742bddeb797269d",
             "@cloudflare/workers-types": "5.20260729.1"
           }
+        },
+        "0.0.1-beta.95": {
+          "tarball": "https://registry.npmjs.org/apps/-/apps-0.0.1-beta.95.tgz",
+          "integrity": "sha512-225vcyu5AEL+e43OlpJmHeSZOdZE2l8SR6W55p3ejxdJDwPe+KcNZoCi8HddhTkqSqGkYJTAuf4hJHNhp7qk3w==",
+          "dependencies": {
+            "effect": "4.0.1",
+            "@cloudflare/workers-types": "5.20260729.1"
+          }
         }
       }
     },
diff --git a/e2e/sdk/deployment.ts b/e2e/sdk/deployment.ts
index 03df7468bd..9847f74c62 100644
--- a/e2e/sdk/deployment.ts
+++ b/e2e/sdk/deployment.ts
@@ -126,6 +126,9 @@ export const startDeployment = ({
         "temporary",
         "--background",
         "active",
+        // The scenarios read this stage's traces back from Axiom.
+        "--telemetry",
+        "export",
         "--owner",
         "Automated test run",
         "--no-input",
diff --git a/e2e/sdk/suite.ts b/e2e/sdk/suite.ts
index 2903c36899..b8bc9232a4 100644
--- a/e2e/sdk/suite.ts
+++ b/e2e/sdk/suite.ts
@@ -247,8 +247,10 @@ export const runSuite = ({
                   // Products this run starts build apps against the checkout's own apps release.
                   const registry =
                     target === "cloud" && !managedCloud ? undefined : yield* lockedNpmRegistry;
-                  // Self-host and local read these public catalogs; Cloud keeps its own registry.
-                  const catalogs = target === "cloud" ? undefined : yield* publicCatalogs;
+                  // Self-host, local and managed Cloud list this run's synthetic official apps.
+                  // A deployed Cloud lists production's feed and keeps its own registry.
+                  const catalogs =
+                    target === "cloud" && !managedCloud ? undefined : yield* publicCatalogs;
                   // Production trusts the stage's browser origin, which it returns profiles to.
                   const productionDirectory = path.join(directory, "oauth-proxy-production");
                   if (Option.isSome(proxyProduction))
@@ -272,6 +274,7 @@ export const runSuite = ({
                   const environment = managedCloud
                     ? yield* startCloudEnvironment({
                         ...(registry === undefined ? {} : { npmRegistry: registry.url }),
+                        ...(catalogs === undefined ? {} : { catalogs: catalogs.origin }),
                         directory,
                         origin,
                         appPort: yield* freePort,
diff --git a/e2e/subrequest-depth.config.ts b/e2e/subrequest-depth.config.ts
new file mode 100644
index 0000000000..81f8f427de
--- /dev/null
+++ b/e2e/subrequest-depth.config.ts
@@ -0,0 +1,12 @@
+import { defineConfig } from "vitest/config";
+
+/** Runs by hand against a deployed stage: local workerd does not enforce the subrequest depth limit. */
+export default defineConfig({
+  test: {
+    include: ["e2e/tests/cloud-mcp-subrequest-depth.spec.ts"],
+    fileParallelism: false,
+    maxWorkers: 1,
+    testTimeout: 240_000,
+    hookTimeout: 60_000,
+  },
+});
diff --git a/e2e/support/api.ts b/e2e/support/api.ts
index 114b29d299..a910c0905c 100644
--- a/e2e/support/api.ts
+++ b/e2e/support/api.ts
@@ -19,6 +19,13 @@ export interface Session {
     headers?: Record<string, string>,
   ) => Effect.Effect<Response, RequestFailed>;
 }
+/**
+ * The wire revision this tree's clients state, sent on every request. A scenario acting as a
+ * client released before revisions overrides it with {@link releasedClient}, which reads the same
+ * as stating none.
+ */
+export const currentClient = { "executor-wire-revision": "1" } as const;
+export const releasedClient = { "executor-wire-revision": "0" } as const;
 /** Request failures expose safe context; underlying errors remain redacted. */
 export class RequestFailed extends Schema.TaggedError<RequestFailed>()("RequestFailed", {
   method: Schema.String,
@@ -132,7 +139,9 @@ export class SessionClients extends Context.Service<SessionClients, Sessions>()(
                       path: "cross-origin request rejected",
                       reason: "origin",
                     });
-                  let request = HttpClientRequest.make(method)(url, { headers });
+                  let request = HttpClientRequest.make(method)(url, {
+                    headers: { ...currentClient, ...headers },
+                  });
                   if (data !== undefined)
                     request = yield* HttpClientRequest.bodyJson(request, data);
                   const response = yield* http.execute(request);
diff --git a/e2e/support/background-service.ts b/e2e/support/background-service.ts
new file mode 100644
index 0000000000..91d27c217f
--- /dev/null
+++ b/e2e/support/background-service.ts
@@ -0,0 +1,534 @@
+/**
+ * The real local CLI against a background Executor of its own: an isolated HOME, data directory,
+ * key file and fixed port, and a fake browser opener first on PATH that records the link it is
+ * given. A server that a command starts is detached from it, outside every process group the
+ * spawner owns, so the scope's finalizer runs `executor service stop` and then kills any server
+ * process that is still registered or still answers as one this scenario saw.
+ *
+ * `server.json` and `GET /api/service` are the service's public contract with every local client;
+ * their schemas are restated here rather than imported from the product.
+ */
+import {
+  Config,
+  Deferred,
+  Duration,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Ref,
+  Schedule,
+  Schema,
+  Stream,
+} from "effect";
+import { HttpClient, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { createHmac } from "node:crypto";
+import { createServer } from "node:http";
+import { Evidence } from "./evidence.ts";
+import { Target } from "./platform.ts";
+import { connectionRefused, freePort } from "./ports.ts";
+import { localEntryCommand } from "./local-entry.ts";
+
+/** `server.json`: the process that serves a data directory and how to reach it. */
+export const ServiceRegistration = Schema.Struct({
+  id: Schema.String,
+  version: Schema.String,
+  url: Schema.String,
+  pid: Schema.Number,
+  password: Schema.RedactedFromValue(Schema.String),
+});
+export type ServiceRegistration = typeof ServiceRegistration.Type;
+const RegistrationJson = Schema.fromJsonString(ServiceRegistration);
+
+/**
+ * `GET /api/service`: the process answering on a port, and whether it serves every route yet, or
+ * is going away once asked to stop.
+ */
+export const ServiceInfo = Schema.Struct({
+  id: Schema.String,
+  version: Schema.String,
+  pid: Schema.Number,
+  status: Schema.Literals(["starting", "ready", "stopping"]),
+});
+
+/**
+ * A stand-in for `server` once it has been asked to stop and before it exits, for the current
+ * scope: it answers on the server's address as that process, with the proof of the registration's
+ * password for each fresh challenge that the server gives, and says it is stopping. A real server's
+ * own shutdown takes a fraction of a second; this one lasts until its scope closes, which closes
+ * every connection to it, as the server's exit would. `requests` are the method and path of each
+ * request it was sent, in order.
+ */
+export const stoppingServer = (server: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const requests = yield* Ref.make<ReadonlyArray<string>>([]);
+    const handler = Effect.gen(function* () {
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const url = new URL(request.url, server.url);
+      yield* Ref.update(requests, (all) => [...all, `${request.method} ${url.pathname}`]);
+      if (request.method !== "GET" || url.pathname !== "/api/service")
+        return HttpServerResponse.empty({ status: 503 });
+      const challenge = url.searchParams.get("challenge");
+      return HttpServerResponse.jsonUnsafe(
+        {
+          id: server.id,
+          version: server.version,
+          pid: server.pid,
+          status: "stopping",
+          ...(challenge === null
+            ? {}
+            : {
+                proof: createHmac("sha256", Redacted.value(server.password))
+                  .update(challenge)
+                  .digest("base64url"),
+              }),
+        },
+        { status: 503, headers: { "retry-after": "1" } },
+      );
+    });
+    const listener = yield* Effect.sync(() => createServer());
+    yield* Layer.build(
+      HttpRouter.serve(HttpRouter.add("*", "/*", handler), {
+        disableLogger: true,
+        disableListenLog: true,
+      }).pipe(
+        Layer.provideMerge(
+          NodeHttpServer.layer(() => listener, {
+            host: "127.0.0.1",
+            port: Number(new URL(server.url).port),
+          }),
+        ),
+      ),
+    );
+    // A server that exits closes every connection to it, as the product's listener also does
+    // when it shuts down. One left open would keep the port from the next server on Windows.
+    yield* Effect.addFinalizer(() => Effect.sync(() => listener.closeAllConnections()));
+    return {
+      requests: Ref.get(requests),
+      /** How many times it has said it is stopping. */
+      answered: Ref.get(requests).pipe(
+        Effect.map((all) => all.filter((request) => request === "GET /api/service").length),
+      ),
+    };
+  });
+
+/** Variables for one command; `undefined` removes one the helper sets, such as EXECUTOR_PORT. */
+export type Overrides = Readonly<Record<string, string | undefined>>;
+
+/** `source` runs the checkout's CLI under Node, even when the scenario tests a release executable. */
+export interface RunOptions {
+  readonly source?: boolean;
+}
+
+export interface CommandResult {
+  readonly code: number;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/** Connection links carry a one-use credential; evidence keeps only their shape. */
+const redact = (text: string) => text.replace(/#pair=[a-f0-9]{64}/gu, "#pair=<redacted>");
+
+/**
+ * Records the last argument it was started with, which is the URL for `open`, `xdg-open` and
+ * `rundll32 url.dll,FileProtocolHandler`.
+ */
+const openerSource = `import { appendFileSync } from "node:fs";
+appendFileSync(process.env.EXECUTOR_E2E_OPENED, process.argv.at(-1) + "\\n");
+`;
+
+/** A command did not reach the state a scenario waits for; the message says which. */
+export class ServiceCliFailed extends Schema.TaggedError<ServiceCliFailed>()("ServiceCliFailed", {
+  message: Schema.String,
+}) {}
+
+const otherUser = Schema.is(Schema.Struct({ code: Schema.Literal("EPERM") }));
+/** Signal 0 checks that a process exists; EPERM means it exists under another user. */
+const alive = (pid: number) =>
+  Effect.try({ try: () => process.kill(pid, 0), catch: otherUser }).pipe(
+    Effect.match({ onSuccess: () => true, onFailure: (exists) => exists }),
+  );
+
+/**
+ * End a background server as a crash would: nothing it runs on shutdown runs. Its child processes,
+ * the telemetry collector and workerd, end with it, as they would with the machine. A server a
+ * client starts is detached into its own process group, so POSIX signals that group, or the
+ * process alone when it leads none; Windows ends the process tree. A process that has already
+ * exited cannot be signalled, which is fine here.
+ */
+export const crashServer = (pid: number) =>
+  Effect.gen(function* () {
+    const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+    if (process.platform === "win32") {
+      yield* processes
+        .exitCode(
+          ChildProcess.make("taskkill", ["/pid", String(pid), "/t", "/f"], {
+            stdout: "ignore",
+            stderr: "ignore",
+          }),
+        )
+        .pipe(Effect.ignore);
+      return;
+    }
+    yield* Effect.try(() => process.kill(-pid, "SIGKILL")).pipe(
+      Effect.catch(() => Effect.try(() => process.kill(pid, "SIGKILL"))),
+      Effect.ignore,
+    );
+  });
+
+/**
+ * Whether `server` still answers on its address as that process, starting, ready or stopping.
+ * Only then is its pid known to be the server's, and safe to end with its process tree.
+ */
+export const answersAsServer = (server: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const response = yield* http.get(`${server.url}/api/service`);
+    const body = yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(ServiceInfo)));
+    return body.id === server.id && body.pid === server.pid;
+  }).pipe(
+    Effect.timeout("5 seconds"),
+    Effect.orElseSucceed(() => false),
+  );
+
+/** Repeat `check` every 100 ms until `done` holds, failing once `within` passes first. */
+export const eventually = <A, E, R>(
+  check: Effect.Effect<A, E, R>,
+  done: (value: A) => boolean,
+  within: Duration.Input,
+) =>
+  check.pipe(
+    Effect.repeat({ until: done, schedule: Schedule.spaced("100 millis") }),
+    Effect.timeout(within),
+  );
+
+/**
+ * A browser opener that records the URL it was asked to open, under `root`. Put
+ * `environment` in a command's environment: it puts the opener first on PATH. The launcher opens
+ * links with `open` on macOS, `xdg-open` elsewhere on Unix and `rundll32` on Windows, which starts
+ * only an executable, so the opener is compiled there.
+ */
+export const fakeBrowserOpener = (root: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem,
+      path = yield* Path.Path,
+      processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const bin = path.join(root, "bin");
+    const log = path.join(root, "opened.log");
+    const opener = path.join(root, "opener.mjs");
+    yield* fs.makeDirectory(bin, { recursive: true });
+    yield* fs.writeFileString(opener, openerSource);
+    if (process.platform === "win32") {
+      const compiled = yield* processes.exitCode(
+        ChildProcess.make(
+          "bun",
+          ["build", "--compile", opener, "--outfile", path.join(bin, "rundll32.exe")],
+          { stdout: "ignore", stderr: "inherit" },
+        ),
+      );
+      if (Number(compiled) !== 0) return yield* Effect.die("Could not build the fake opener");
+    } else
+      for (const name of ["open", "xdg-open"]) {
+        yield* fs.writeFileString(
+          path.join(bin, name),
+          `#!/bin/sh\nexec "${process.execPath}" "${opener}" "$@"\n`,
+        );
+        yield* fs.chmod(path.join(bin, name), 0o755);
+      }
+    return {
+      environment: {
+        PATH: `${bin}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`,
+        EXECUTOR_E2E_OPENED: log,
+      },
+      /** Every URL the opener was given, in order. */
+      opened: fs
+        .exists(log)
+        .pipe(
+          Effect.flatMap((exists) =>
+            exists
+              ? fs.readFileString(log).pipe(Effect.map((text) => text.split("\n").filter(Boolean)))
+              : Effect.succeed([]),
+          ),
+        ),
+    };
+  });
+
+/**
+ * A CLI with its own home and data directory under the scenario's folder, so a failed scenario
+ * keeps the server's diagnostics. `port` is EXECUTOR_PORT; by default a free one, never 4312.
+ */
+export const backgroundServiceCli = (options: { readonly port?: number } = {}) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem,
+      path = yield* Path.Path,
+      processes = yield* ChildProcessSpawner.ChildProcessSpawner,
+      http = yield* HttpClient.HttpClient,
+      evidence = yield* Evidence,
+      target = yield* Target;
+    const packagedEntry = yield* Config.NonEmptyString("EXECUTOR_E2E_LOCAL_ENTRY").pipe(
+      Config.option,
+    );
+    // A release executable reports the version it was built as; the checkout's CLI reports
+    // EXECUTOR_BUILD_VERSION, so only it can stand in for another release.
+    const source = path.resolve("apps/local/server/src/bin.ts");
+    const entry = Option.isSome(packagedEntry) ? path.resolve(packagedEntry.value) : source;
+    // Startup deploys the bundled Executor app, which pins this checkout's apps release.
+    const registry = yield* Config.NonEmptyString("E2E_NPM_REGISTRY").pipe(Config.option);
+    const catalogs = yield* Config.NonEmptyString("E2E_PUBLIC_CATALOGS").pipe(Config.option);
+    const root = path.resolve(target.directory, "background-service");
+    const home = path.join(root, "home");
+    const data = path.join(root, "data");
+    yield* fs.makeDirectory(home, { recursive: true });
+    const port = options.port ?? (yield* freePort);
+    const url = `http://127.0.0.1:${port}`;
+    const registrationFile = path.join(data, "server.json");
+    // The checkout's CLI compiles its Worker host when no prepared one exists, as in the release
+    // workflow, which builds none; a release executable carries its own.
+    const workerBundle = path.resolve(".local/test-runtime/host.json");
+    const prepared = yield* fs.exists(workerBundle);
+
+    const browser = yield* fakeBrowserOpener(root);
+
+    const environment = (overrides: Overrides) =>
+      Object.fromEntries(
+        Object.entries({
+          ...browser.environment,
+          ...(process.platform === "win32"
+            ? {
+                SystemRoot: process.env.SystemRoot,
+                ComSpec: process.env.ComSpec,
+                PATHEXT: process.env.PATHEXT,
+                APPDATA: process.env.APPDATA,
+                LOCALAPPDATA: process.env.LOCALAPPDATA,
+              }
+            : {}),
+          HOME: home,
+          USERPROFILE: home,
+          // Release scenarios never send product analytics, even from a build with a baked key.
+          DO_NOT_TRACK: "1",
+          EXECUTOR_ENVIRONMENT: "e2e",
+          // Keys stay in keys.json so no run touches the machine's OS credential store.
+          EXECUTOR_KEY_STORAGE: "file",
+          EXECUTOR_NO_UPDATE_CHECK: "1",
+          ...(prepared ? { EXECUTOR_WORKER_BUNDLE: workerBundle } : {}),
+          ...(Option.isSome(registry) ? { EXECUTOR_NPM_REGISTRY: registry.value } : {}),
+          ...(Option.isSome(catalogs)
+            ? {
+                EXECUTOR_CATALOG_URL: `${catalogs.value}/catalog/index.json`,
+                EXECUTOR_REGISTRY_URL: catalogs.value,
+              }
+            : {}),
+          EXECUTOR_DATA_DIR: data,
+          EXECUTOR_PORT: String(port),
+          ...overrides,
+        }).flatMap(([name, value]) => (value === undefined ? [] : [[name, value] as const])),
+      );
+    const command = (args: ReadonlyArray<string>, overrides: Overrides, from: RunOptions) => {
+      const file = from.source === true ? source : entry;
+      const { command, args: argv } = localEntryCommand(file, args);
+      return ChildProcess.make(command, argv, {
+        // A working directory inside the scenario's folder could not be removed on Windows
+        // while a stopped child finishes exiting.
+        cwd: path.dirname(file),
+        extendEnv: false,
+        env: environment(overrides),
+        stdout: "pipe",
+        stderr: "pipe",
+        forceKillAfter: "5 seconds",
+      });
+    };
+
+    /** Run one command to exit and return its code and complete output. */
+    const exec = (args: ReadonlyArray<string>, overrides: Overrides, from: RunOptions = {}) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const child = yield* processes.spawn(command(args, overrides, from));
+          const [code, stdout, stderr] = yield* Effect.all(
+            [
+              child.exitCode,
+              child.stdout.pipe(Stream.decodeText(), Stream.mkString),
+              child.stderr.pipe(Stream.decodeText(), Stream.mkString),
+            ],
+            { concurrency: 3 },
+          ).pipe(Effect.timeout("150 seconds"));
+          return { code: Number(code), stdout, stderr } satisfies CommandResult;
+        }),
+      );
+    let commands = 0;
+    const run = (args: ReadonlyArray<string>, overrides: Overrides = {}, from: RunOptions = {}) =>
+      evidence.step(
+        `executor ${args.join(" ")}`.trim(),
+        Effect.gen(function* () {
+          const result = yield* exec(args, overrides, from);
+          commands += 1;
+          yield* evidence.json(
+            `command-${commands}-${args.join("-").replaceAll(/[^a-z0-9-]+/gu, "") || "executor"}.json`,
+            {
+              args,
+              overrides,
+              ...from,
+              code: result.code,
+              stdout: redact(result.stdout),
+              stderr: redact(result.stderr),
+            },
+          );
+          return result;
+        }),
+      );
+
+    /**
+     * Start a command that keeps running in the caller's scope, and wait for the first output line
+     * `ready` accepts. Fails, keeping the output, if the command exits first. `output` reads what it
+     * has written on stdout and stderr so far, with links redacted.
+     */
+    const start = (
+      args: ReadonlyArray<string>,
+      ready: (line: string) => boolean,
+      overrides: Overrides = {},
+    ) =>
+      evidence.step(
+        `start executor ${args.join(" ")}`,
+        Effect.gen(function* () {
+          const child = yield* processes.spawn(command(args, overrides, {}));
+          const output = yield* Ref.make("");
+          const matched = yield* Deferred.make<string>();
+          yield* Stream.merge(child.stdout, child.stderr).pipe(
+            Stream.decodeText(),
+            Stream.splitLines,
+            Stream.runForEach((line) =>
+              Ref.update(output, (before) => `${before}${redact(line)}\n`).pipe(
+                Effect.andThen(ready(line) ? Deferred.succeed(matched, line) : Effect.void),
+              ),
+            ),
+            Effect.forkScoped,
+          );
+          commands += 1;
+          const saved = `command-${commands}-${args.join("-").replaceAll(/[^a-z0-9-]+/gu, "")}.json`;
+          yield* Effect.addFinalizer(() =>
+            Ref.get(output).pipe(Effect.flatMap((text) => evidence.json(saved, { args, text }))),
+          );
+          const line = yield* Effect.raceFirst(
+            Deferred.await(matched),
+            child.exitCode.pipe(
+              Effect.flatMap((code) =>
+                Effect.fail(
+                  new ServiceCliFailed({
+                    message: `executor ${args.join(" ")} exited (${code}) before it was ready`,
+                  }),
+                ),
+              ),
+            ),
+          ).pipe(Effect.timeout("150 seconds"));
+          return { child, line, output: Ref.get(output) };
+        }),
+      );
+
+    /**
+     * Windows: the program a process ID names now, by its image name. Windows soon gives a process
+     * ID that was freed to another process, often one that the next server starts.
+     */
+    const imageOf = (pid: number) =>
+      processes
+        .lines(
+          ChildProcess.make("tasklist", ["/fi", `PID eq ${pid}`, "/fo", "csv", "/nh"], {
+            stderr: "ignore",
+          }),
+        )
+        .pipe(
+          Effect.map((lines) =>
+            Option.fromNullishOr(
+              lines
+                .map((line) => /^"([^"]+)","(\d+)"/u.exec(line))
+                .find((match) => match !== null && Number(match[2]) === pid)?.[1],
+            ),
+          ),
+          Effect.orElseSucceed(() => Option.none<string>()),
+        );
+    /** On Windows, the image each server this scenario saw ran as. */
+    const images = new Map<number, string>();
+    /**
+     * Whether `pid` still names a process. On Windows a server's ID counts only while it names a
+     * process with the image that server ran as, since the ID may already name another process.
+     */
+    const running = (pid: number) =>
+      Effect.gen(function* () {
+        if (!(yield* alive(pid))) return false;
+        const image = images.get(pid);
+        if (image === undefined) return true;
+        return Option.contains(yield* imageOf(pid), image);
+      });
+    /** Every server this scenario saw registered, by id, for cleanup. */
+    const seen = new Map<string, ServiceRegistration>();
+    /** The registered server, if `server.json` exists. */
+    const registration = Effect.gen(function* () {
+      if (!(yield* fs.exists(registrationFile))) return Option.none<ServiceRegistration>();
+      const text = yield* fs.readFileString(registrationFile);
+      const value = yield* Schema.decodeUnknownEffect(RegistrationJson)(text);
+      seen.set(value.id, value);
+      if (process.platform === "win32" && !images.has(value.pid)) {
+        const image = yield* imageOf(value.pid);
+        if (Option.isSome(image)) images.set(value.pid, image.value);
+      }
+      return Option.some(value);
+    });
+    const registered = registration.pipe(
+      Effect.flatMap(
+        Option.match({
+          onNone: () =>
+            Effect.fail(new ServiceCliFailed({ message: `${registrationFile} does not exist` })),
+          onSome: Effect.succeed,
+        }),
+      ),
+    );
+
+    /** What `GET /api/service` answers at `base`. */
+    const info = (base: string) =>
+      http.get(`${base}/api/service`).pipe(
+        Effect.flatMap((response) =>
+          response.json.pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(ServiceInfo)),
+            Effect.map((body) => ({ status: response.status, body })),
+          ),
+        ),
+        Effect.timeout("5 seconds"),
+      );
+    yield* Effect.addFinalizer(() =>
+      Effect.gen(function* () {
+        yield* exec(["service", "stop"], {}).pipe(Effect.ignore);
+        // A start attempt that outlived its command can take the port once the server stops; it
+        // registers before it opens storage, so a second stop finds it.
+        if (Option.isSome(yield* info(url).pipe(Effect.option)))
+          yield* exec(["service", "stop"], {}).pipe(Effect.ignore);
+        // Whatever still answers as a server this scenario saw, the registered one included, is
+        // ended with its collector and workerd. A pid that does not answer as its server may name
+        // another program by now, so it is left alone.
+        const left = yield* registration.pipe(Effect.orElseSucceed(() => Option.none()));
+        for (const server of [...Option.toArray(left), ...seen.values()])
+          if (yield* answersAsServer(server)) yield* crashServer(server.pid);
+      }),
+    );
+
+    return {
+      /** EXECUTOR_PORT and its loopback URL. */
+      port,
+      url,
+      /** The absolute data directory, as the product names it in messages. */
+      data,
+      registrationFile,
+      run,
+      start,
+      registration,
+      registered,
+      info,
+      /** Whether a process ID still names its process; see `running`. */
+      alive: running,
+      /** Whether nothing listens on `port` any more. */
+      refused: connectionRefused,
+      /** Every URL the fake browser opener was given, in order. */
+      opened: browser.opened,
+    };
+  });
diff --git a/e2e/support/browser-observability.ts b/e2e/support/browser-observability.ts
index 2e9235ec2c..6dc888bf94 100644
--- a/e2e/support/browser-observability.ts
+++ b/e2e/support/browser-observability.ts
@@ -83,7 +83,7 @@ export const injectDashboardResponse = (slug: string, body: string, status: numb
     // Pages render on the server with their data, so the browser reads resources only when it
     // navigates to them itself.
     yield* browser.use("Open a page that does not read resources", (page) =>
-      page.goto(`/org/${slug}/connect`),
+      page.goto(`/org/${slug}/organization`),
     );
     yield* browser.use("Navigate to Apps in the browser", (page) =>
       page.getByRole("navigation").getByRole("link", { name: /^Apps/ }).click(),
diff --git a/e2e/support/cloud-environment.ts b/e2e/support/cloud-environment.ts
index 092fbdf0d9..9a2405e621 100644
--- a/e2e/support/cloud-environment.ts
+++ b/e2e/support/cloud-environment.ts
@@ -1,5 +1,6 @@
 import {
   Clock,
+  Console,
   Deferred,
   Effect,
   FileSystem,
@@ -22,6 +23,7 @@ import {
   v1DatabaseWriter,
 } from "./cloud-postgres.ts";
 import { v1McpForwardFile } from "./v1-mcp-forward.ts";
+import { v1SessionHandoffFile } from "./v1-session-handoff.ts";
 import { isAlchemyDevFailure, outputLines } from "./alchemy-dev-output.ts";
 import { startFixtureControl, fixtureRequest } from "../sdk/fixtures.ts";
 import { roleHost } from "./role-hosts.ts";
@@ -126,6 +128,8 @@ export const startCloudEnvironment = (input: {
   readonly browserOrigin: "app" | "deployment";
   /** Registry the local Cloud compiler resolves app packages from. */
   readonly npmRegistry?: string;
+  /** The run's synthetic official app feed (`public-catalogs.ts`), which Add app and setup list. */
+  readonly catalogs?: string;
   /**
    * Better Auth's OAuth proxy is on, as in production. Without this, this Cloud is the proxy's
    * production: its edge exchanges the codes of stages that sign in through it. With it, this
@@ -169,9 +173,12 @@ export const startCloudEnvironment = (input: {
     yield* Effect.addFinalizer(() =>
       Effect.forEach(
         Object.values(Redacted.value(fixture).services),
-        (service) => emulatorRequest(service.baseUrl, "/_emulate/reset", {}),
-        { concurrency: 5 },
-      ).pipe(Effect.asVoid, Effect.orDie),
+        (service) =>
+          emulatorRequest(service.baseUrl, "/_emulate/reset", {}).pipe(
+            Effect.catch(() => Console.error("Could not reset one external test emulator.")),
+          ),
+        { concurrency: 5, discard: true },
+      ),
     );
     const emulators = `${directory}/emulators.json`;
     yield* fs.writeFileString(emulators, JSON.stringify(Redacted.value(fixture)), { mode: 0o600 });
@@ -224,6 +231,13 @@ export const startCloudEnvironment = (input: {
       mode: 0o600,
     });
     yield* Effect.addFinalizer(() => fs.remove(v1Forward).pipe(Effect.orDie));
+    // The secret the synthetic v1 signs session handoffs with; scenarios read it from here.
+    const v1HandoffSecret = randomBytes(32).toString("hex");
+    const v1Handoff = `${directory}/${v1SessionHandoffFile}`;
+    yield* fs.writeFileString(v1Handoff, JSON.stringify({ secret: v1HandoffSecret }), {
+      mode: 0o600,
+    });
+    yield* Effect.addFinalizer(() => fs.remove(v1Handoff).pipe(Effect.orDie));
     const env = {
       PATH: [path.join(cloud, "node_modules/.bin"), process.env.PATH ?? ""].join(
         process.platform === "win32" ? ";" : ":",
@@ -264,6 +278,9 @@ export const startCloudEnvironment = (input: {
       CLOUD_DEV_APP_UI_PORT: String(input.appPort),
       EXECUTOR_APP_UI_BASE_URL: `http://localhost:${input.appPort}`,
       ...(input.npmRegistry === undefined ? {} : { EXECUTOR_NPM_REGISTRY: input.npmRegistry }),
+      ...(input.catalogs === undefined
+        ? {}
+        : { EXECUTOR_CATALOG_URL: `${input.catalogs}/catalog/index.json` }),
       CLOUD_DEV_DATABASE_PORT: String(input.databasePort),
       CLOUD_DEV_DATABASE_PASSWORD: databasePassword,
       CLOUD_DEV_EXTERNAL_DATABASE: "true",
@@ -275,6 +292,7 @@ export const startCloudEnvironment = (input: {
       // Imports freeze and cut over each organization in the emulated v1 through this login.
       V1_IMPORT_WRITER_DATABASE_URL: `postgresql://${v1DatabaseWriter}:${v1WriterPassword}@127.0.0.1:${input.databasePort}/executor_v1?sslmode=disable`,
       V1_MCP_FORWARD_SECRET: v1ForwardSecret,
+      V1_SESSION_HANDOFF_SECRET: v1HandoffSecret,
       // Serve the role hosts as production does, at `app.`, `mcp.` and `api.` of the origin's host.
       EXECUTOR_ROLE_HOSTS_DOMAIN: new URL(input.origin).hostname,
       CLOUD_BROWSER_ORIGIN: input.browserOrigin,
diff --git a/e2e/support/cloud-postgres.ts b/e2e/support/cloud-postgres.ts
index e9dcffcdb0..0e37085bd8 100644
--- a/e2e/support/cloud-postgres.ts
+++ b/e2e/support/cloud-postgres.ts
@@ -206,9 +206,27 @@ export const startCloudPostgres = (input: {
     );
     if (created !== 0)
       return yield* new CloudPostgresFailed({ operation: "Create the Postgres container" });
-    const started = yield* processes.exitCode(docker(["start", container]));
+    // Docker says why a container cannot start, such as its published port being in use.
+    const [started, startErrors] = yield* Effect.scoped(
+      Effect.gen(function* () {
+        const start = yield* processes.spawn(
+          ChildProcess.make("docker", ["start", container], {
+            env: dockerEnv,
+            extendEnv: false,
+            stdout: "ignore",
+            stderr: "pipe",
+          }),
+        );
+        return yield* Effect.all(
+          [start.exitCode, Stream.mkString(Stream.decodeText(start.stderr))],
+          { concurrency: 2 },
+        );
+      }),
+    );
     if (started !== 0)
-      return yield* new CloudPostgresFailed({ operation: "Start the Postgres container" });
+      return yield* new CloudPostgresFailed({
+        operation: `Start the Postgres container: ${startErrors.trim()}`,
+      });
     const logs = yield* processes.spawn(
       ChildProcess.make("docker", ["logs", "--follow", container], {
         env: dockerEnv,
diff --git a/e2e/support/cloud-rows.ts b/e2e/support/cloud-rows.ts
index 546a0c12b8..da5ddaa219 100644
--- a/e2e/support/cloud-rows.ts
+++ b/e2e/support/cloud-rows.ts
@@ -42,3 +42,42 @@ export const writeRows = (
       Schema.fromJsonString(Schema.Array(Schema.Array(Schema.Unknown))),
     )(output);
   });
+
+/**
+ * Expire the evaluated result `key` kept in a managed Cloud's app data supervisors, as a day
+ * passing does: the supervisor removes it at its next command, so a read of it misses. Returns how
+ * many stored parts were expired.
+ */
+export const expireEvaluated = (key: string) =>
+  Effect.gen(function* () {
+    const target = yield* Target,
+      fs = yield* FileSystem.FileSystem,
+      processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const state = yield* fs
+      .readFileString(`${target.directory}/alchemy-state.json`)
+      .pipe(
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(
+            Schema.fromJsonString(Schema.Struct({ directory: Schema.String })),
+          ),
+        ),
+      );
+    // Alchemy keeps a stage's state in `.alchemy/state/<app>/<stage>` and its local Durable
+    // Objects in `.alchemy/local`.
+    const output = yield* processes.string(
+      ChildProcess.make(
+        "node",
+        [
+          "apps/hosted/testing/cloud-evaluated-fixture.ts",
+          "--directory",
+          `${state.directory}/../../../local`,
+          "--key",
+          key,
+        ],
+        { env: { PATH: process.env.PATH ?? "", NODE_ENV: "test" }, extendEnv: false },
+      ),
+    );
+    return (yield* Schema.decodeUnknownEffect(
+      Schema.fromJsonString(Schema.Struct({ expired: Schema.Number })),
+    )(output)).expired;
+  });
diff --git a/e2e/support/desktop.ts b/e2e/support/desktop.ts
index ada748d5f7..f95e19b454 100644
--- a/e2e/support/desktop.ts
+++ b/e2e/support/desktop.ts
@@ -1,7 +1,51 @@
 import { _electron, type ElectronApplication } from "playwright";
-import { Config, Console, Effect, Exit, FileSystem, Option, Path, Schedule, Schema } from "effect";
+import {
+  type Cause,
+  Config,
+  Console,
+  DateTime,
+  Effect,
+  Exit,
+  FileSystem,
+  Option,
+  Path,
+  type PlatformError,
+  Queue,
+  Redacted,
+  Schedule,
+  Schema,
+  Stream,
+} from "effect";
+import { HttpClient } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import {
+  answersAsServer,
+  crashServer,
+  ServiceInfo,
+  ServiceRegistration,
+} from "./background-service.ts";
 import { driver } from "./platform.ts";
 
+/**
+ * What a desktop scenario's own environment keeps of the runner's: its display and session bus,
+ * and on Windows the Windows directory, which every Windows process's environment names.
+ */
+export const runnerSession = () =>
+  Object.fromEntries(
+    [
+      "DISPLAY",
+      "XAUTHORITY",
+      "WAYLAND_DISPLAY",
+      "XDG_RUNTIME_DIR",
+      "XDG_SESSION_TYPE",
+      "DBUS_SESSION_BUS_ADDRESS",
+      "SystemRoot",
+    ].flatMap((name) => {
+      const value = process.env[name];
+      return value === undefined ? [] : [[name, value] as const];
+    }),
+  );
+
 /** Request a browser link across Electron's real session boundary, without an API key. */
 export const requestBrowserPairing = (electron: ElectronApplication, origin: string) =>
   driver("pair from the native desktop session", () =>
@@ -58,8 +102,9 @@ export const launchDesktop = (options: {
       ),
       (electron) => driver("close desktop", () => electron.close()).pipe(Effect.orDie),
     );
-    // A failed or timed-out scenario prints the desktop's own record of its backend starts, exits
-    // and restarts before the window closes, which shows the step it stopped at.
+    // A failed or timed-out scenario, as one whose dashboard never shows, prints the desktop's
+    // own record of its connections, losses and recoveries before the window closes, which shows
+    // the step it stopped at, and keeps what its windows show and its logs (see `keepEvidence`).
     const data = options.env.EXECUTOR_DESKTOP_DATA_DIR;
     if (data !== undefined)
       yield* Effect.addFinalizer((exit) =>
@@ -68,22 +113,70 @@ export const launchDesktop = (options: {
           : desktopEvents(data).pipe(
               Effect.flatMap((events) => Console.error(lifecycleLog(events))),
               Effect.ignore,
+              Effect.andThen(keepEvidence(electron, data).pipe(Effect.ignore)),
             ),
       );
     return electron;
   });
 
-/** Messages the desktop writes itself as it starts, stops and restarts its backend. */
+/** Pairing links carry a one-use credential; kept evidence holds only their shape. */
+const redactLinks = (text: string) => text.replace(/#pair=[a-f0-9]{64}/g, "#pair=<redacted>");
+
+/**
+ * Keep a failed scenario's evidence, which would go with its directory: a screenshot of each
+ * desktop window, and the desktop's and its servers' logs from `data`, in a new folder under
+ * EXECUTOR_E2E_DESKTOP_SCREENSHOTS (by default `.local/desktop-recovery`), which it names.
+ */
+const keepEvidence = (electron: ElectronApplication, data: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const screenshots = yield* Config.String("EXECUTOR_E2E_DESKTOP_SCREENSHOTS").pipe(
+      Config.withDefault(".local/desktop-recovery"),
+    );
+    const stamp = DateTime.formatIso(yield* DateTime.now).replace(/[:.]/g, "-");
+    const directory = path.resolve(screenshots, `failed-${stamp}-${process.pid}`);
+    yield* fs.makeDirectory(directory, { recursive: true });
+    yield* Effect.forEach(
+      electron.windows(),
+      (page, index) =>
+        driver("capture the failed scenario's window", () =>
+          page.screenshot({
+            path: path.join(directory, `window-${index + 1}.png`),
+            timeout: 10_000,
+          }),
+        ).pipe(Effect.ignore),
+      { discard: true },
+    );
+    const diagnostics = path.join(data, "diagnostics");
+    const logs = (yield* fs.readDirectory(diagnostics).pipe(Effect.orElseSucceed(() => []))).filter(
+      (name) => name.endsWith(".jsonl"),
+    );
+    for (const name of logs)
+      yield* fs.readFileString(path.join(diagnostics, name)).pipe(
+        Effect.flatMap((text) =>
+          fs.writeFileString(path.join(directory, name), redactLinks(text), { mode: 0o600 }),
+        ),
+        Effect.ignore,
+      );
+    yield* Console.error(`The failed scenario's desktop windows and logs are in ${directory}`);
+  });
+
+/** Messages the desktop writes itself as it connects to, loses and recovers its server. */
 const lifecycleMessages = new Set([
   "Starting Executor desktop",
-  "Desktop backend started",
-  "Desktop backend could not start",
-  "Desktop backend ready",
-  "Desktop backend exited",
-  "Desktop backend stopped",
-  "Restarting the desktop backend",
+  "Moved the desktop's data",
+  "Executor could not move the desktop's data",
+  "Connecting to the background Executor",
+  "Starting the background Executor",
+  "Background Executor ready",
+  "Background Executor stopped answering",
+  "Background Executor could not start",
+  "Could not pair with the background Executor",
   "Executor desktop ready",
+  "Desktop window could not load the dashboard",
   "Showing desktop recovery",
+  "Showing the moved data notice",
   "Resetting Executor data",
   "Moved Executor data to a backup",
   "Executor data reset failed",
@@ -91,18 +184,18 @@ const lifecycleMessages = new Set([
 ]);
 
 /**
- * The lifecycle events as the desktop's structured fields only. A backend's stderr and the other
+ * The lifecycle events as the desktop's structured fields only. What a server said and the other
  * events' messages, such as the renderer's console, may hold anything a process printed, so they
  * are counted rather than shown.
  */
 const lifecycleLog = (events: ReadonlyArray<DesktopEvent>) => {
   const lifecycle = events.filter((event) => lifecycleMessages.has(event.message));
-  const lines = lifecycle.map(({ annotations: { stderr, ...annotations }, ...event }) =>
+  const lines = lifecycle.map(({ annotations: { detail, ...annotations }, ...event }) =>
     JSON.stringify({
       ...event,
       annotations: {
         ...annotations,
-        ...(stderr === undefined ? {} : { stderrCharacters: stderr.length }),
+        ...(detail === undefined ? {} : { detailCharacters: detail.length }),
       },
     }),
   );
@@ -114,26 +207,37 @@ const lifecycleLog = (events: ReadonlyArray<DesktopEvent>) => {
 };
 
 // A failed assertion prints the whole event, so keep what tells runs apart: when it was logged,
-// which backend run it describes and how that run ended.
+// which server it names and how the desktop lost or recovered it.
 const LogLine = Schema.fromJsonString(
   Schema.Struct({
     timestamp: Schema.String,
     level: Schema.String,
     message: Schema.String,
     annotations: Schema.Struct({
-      run: Schema.optional(Schema.Number),
+      url: Schema.optional(Schema.String),
       pid: Schema.optional(Schema.Number),
-      kind: Schema.optional(Schema.String),
-      ready: Schema.optional(Schema.Boolean),
-      exitCode: Schema.optional(Schema.NullOr(Schema.Number)),
-      signal: Schema.optional(Schema.NullOr(Schema.String)),
+      version: Schema.optional(Schema.String),
+      origin: Schema.optional(Schema.String),
+      loss: Schema.optional(Schema.String),
+      stage: Schema.optional(Schema.String),
       configuration: Schema.optional(Schema.String),
-      stderr: Schema.optional(Schema.String),
+      detail: Schema.optional(Schema.String),
       recovery: Schema.optional(
         Schema.Struct({ stage: Schema.String, reason: Schema.optional(Schema.String) }),
       ),
+      kind: Schema.optional(Schema.String),
+      archived: Schema.optional(Schema.String),
       backup: Schema.optional(Schema.String),
-      delayMillis: Schema.optional(Schema.Number),
+      /** What a move changed of the CLI's settings: names only. */
+      settings: Schema.optional(
+        Schema.Struct({
+          port: Schema.optional(Schema.Struct({ from: Schema.Number, to: Schema.Number })),
+          variables: Schema.optional(Schema.Array(Schema.String)),
+          removed: Schema.optional(Schema.Array(Schema.String)),
+        }),
+      ),
+      failure: Schema.optional(Schema.String),
+      attempt: Schema.optional(Schema.Number),
     }),
   }),
 );
@@ -150,16 +254,16 @@ export const desktopEvents = (directory: string) =>
     return text.split("\n").flatMap((line) => {
       const entry = Schema.decodeUnknownOption(LogLine)(line);
       if (Option.isNone(entry)) return [];
-      const { stderr } = entry.value.annotations;
+      const { detail } = entry.value.annotations;
       // A failed assertion prints this. Redact pairing links as managed-server.ts does.
-      return stderr === undefined
+      return detail === undefined
         ? [entry.value]
         : [
             {
               ...entry.value,
               annotations: {
                 ...entry.value.annotations,
-                stderr: stderr.replace(/#pair=[a-f0-9]{64}/g, "#pair=<redacted>"),
+                detail: redactLinks(detail),
               },
             },
           ];
@@ -178,46 +282,328 @@ export const eventsNamed = (directory: string, message: string, count: number) =
     Effect.retry({ schedule: Schedule.spaced("100 millis"), times: 300 }),
   );
 
-/** Backend process IDs in start order, from the desktop's own diagnostics log. */
-export const backendPids = (directory: string) =>
+/** How many times the desktop has started a background server for its data directory. */
+export const serverStarts = (directory: string) =>
   desktopEvents(directory).pipe(
-    Effect.map((events) =>
-      events.flatMap((event) =>
-        event.message === "Desktop backend started" && event.annotations.pid !== undefined
-          ? [event.annotations.pid]
-          : [],
-      ),
+    Effect.map(
+      (events) =>
+        events.filter((event) => event.message === "Starting the background Executor").length,
     ),
   );
 
-/** Wait until the desktop has started a backend after the ones already seen. */
-export const nextBackendPid = (directory: string, seen: ReadonlyArray<number>) =>
-  backendPids(directory).pipe(
-    Effect.flatMap((pids) =>
-      pids.length > seen.length
-        ? Effect.succeed(pids[pids.length - 1]!)
-        : Effect.fail(new Error("The desktop has not started another backend")),
+const RegistrationJson = Schema.fromJsonString(ServiceRegistration);
+
+/** The server `server.json` names for `directory`, if any. */
+export const registeredServer = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const file = path.join(directory, "server.json");
+    if (!(yield* fs.exists(file))) return Option.none<ServiceRegistration>();
+    return yield* fs.readFileString(file).pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(RegistrationJson)),
+      // A server replacing the file between the check and the read is no registration yet.
+      Effect.option,
+    );
+  });
+
+/** Whether `server` answers on its address as that process, ready to serve every route. */
+export const answersReady = (server: ServiceRegistration) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const response = yield* http.get(`${server.url}/api/service`);
+    const info = yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(ServiceInfo)));
+    return (
+      response.status === 200 &&
+      info.status === "ready" &&
+      info.id === server.id &&
+      info.pid === server.pid
+    );
+  }).pipe(
+    Effect.timeout("5 seconds"),
+    Effect.orElseSucceed(() => false),
+  );
+
+/**
+ * The PowerShell program behind `windowsSuspender`. It reads one command per line and answers each
+ * with one line, or with `error <message>`.
+ */
+const suspenderScript = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+Add-Type -Namespace ExecutorE2E -Name Suspension -MemberDefinition @'
+[DllImport("ntdll.dll")] public static extern int NtSuspendProcess(IntPtr process);
+[DllImport("ntdll.dll")] public static extern int NtResumeProcess(IntPtr process);
+'@
+$held = [System.Collections.Generic.List[System.Diagnostics.Process]]::new()
+function Hold([int] $id) {
+  $process = [System.Diagnostics.Process]::GetProcessById($id)
+  $status = [ExecutorE2E.Suspension]::NtSuspendProcess($process.Handle)
+  if ($status -ne 0) { throw "NtSuspendProcess($id) returned $status" }
+  $held.Add($process)
+}
+function Release {
+  foreach ($process in $held) { [void][ExecutorE2E.Suspension]::NtResumeProcess($process.Handle) }
+  $held.Clear()
+}
+function Reply([string] $line) { [Console]::Out.WriteLine($line); [Console]::Out.Flush() }
+function Stall([int] $app) {
+  $until = (Get-Date).AddSeconds(60)
+  while ((Get-Date) -lt $until) {
+    $all = @(Get-CimInstance Win32_Process -Property ProcessId, ParentProcessId, CommandLine)
+    $ours = @{ $app = $true }
+    do {
+      $grew = $false
+      foreach ($row in $all) {
+        if ($ours.ContainsKey([int] $row.ParentProcessId) -and -not $ours.ContainsKey([int] $row.ProcessId)) {
+          $ours[[int] $row.ProcessId] = $true
+          $grew = $true
+        }
+      }
+    } while ($grew)
+    $starter = $all | Where-Object { $ours.ContainsKey([int] $_.ProcessId) -and $_.CommandLine -like '*node.mojom.NodeService*' } | Select-Object -First 1
+    if ($starter) {
+      $attempt = $all | Where-Object { $_.ParentProcessId -eq $starter.ProcessId -and $_.CommandLine -like '*serve --service*' } | Select-Object -First 1
+      if ($attempt) {
+        Hold $starter.ProcessId
+        Hold $attempt.ProcessId
+        return "$($starter.ProcessId) $($attempt.ProcessId)"
+      }
+    }
+    Start-Sleep -Milliseconds 20
+  }
+  throw "No server starter of process $app started an attempt within 60 seconds"
+}
+while ($null -ne ($line = [Console]::In.ReadLine())) {
+  $command, $argument = $line.Split(' ', 2)
+  try {
+    switch ($command) {
+      'suspend' { Hold ([int] $argument); Reply 'suspended' }
+      'stall' { Reply (Stall ([int] $argument)) }
+      'resume' { Release; Reply 'resumed' }
+      default { throw "Unknown command $command" }
+    }
+  } catch {
+    Reply "error $($_.Exception.Message)"
+  }
+}
+Release
+`;
+
+/**
+ * Suspend processes on Windows, where Node cannot stop one, as a debugger does: one PowerShell
+ * process suspends each with NtSuspendProcess, so starting PowerShell, which takes seconds, happens
+ * once. It takes `suspend <pid>`; `stall <pid>`, which waits for the server starter of the desktop
+ * `<pid>` started to start an attempt and suspends both, as `stallStarter` does on POSIX; and
+ * `resume`, which resumes every process it suspended. It keeps each suspended process's handle, so
+ * an ID cannot name another process before it is resumed, and resumes them all when its input ends
+ * with the caller's scope.
+ */
+const windowsSuspender = Effect.gen(function* () {
+  const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const commands = yield* Queue.unbounded<string, Cause.Done>();
+  const child = yield* processes.spawn(
+    ChildProcess.make(
+      "powershell",
+      [
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(suspenderScript, "utf16le").toString("base64"),
+      ],
+      {
+        stdin: Stream.fromQueue(commands).pipe(
+          Stream.map((line) => `${line}\n`),
+          Stream.encodeText,
+        ),
+        stderr: "inherit",
+      },
     ),
-    // Polled often, so a scenario can end a backend before it reports readiness.
-    Effect.retry({ schedule: Schedule.spaced("25 millis"), times: 1200 }),
   );
+  // Ending its input resumes what it suspended before it exits.
+  yield* Effect.addFinalizer(() =>
+    Queue.end(commands).pipe(
+      Effect.andThen(child.exitCode),
+      Effect.timeout("30 seconds"),
+      Effect.ignore,
+    ),
+  );
+  const replies = yield* Queue.unbounded<string, PlatformError.PlatformError | Cause.Done>();
+  yield* child.stdout.pipe(
+    Stream.decodeText(),
+    Stream.splitLines,
+    Stream.runIntoQueue(replies),
+    Effect.forkScoped,
+  );
+  return (command: string) =>
+    Queue.offer(commands, command).pipe(
+      Effect.andThen(Queue.take(replies)),
+      Effect.timeout("90 seconds"),
+      Effect.mapError(() => new Error(`The process suspender did not answer "${command}"`)),
+      Effect.flatMap((reply) =>
+        reply.startsWith("error ")
+          ? Effect.fail(new Error(`The process suspender could not ${reply.slice(6)}`))
+          : Effect.succeed(reply),
+      ),
+    );
+});
 
 /**
- * End a backend. SIGKILL is a crash: no shutdown handlers run. SIGTERM is an outside request to
- * stop, except on Windows, where every signal terminates the process at once.
+ * Suspend `pid`, as a hung process stops, until `resume` or until the caller's scope closes. POSIX
+ * stops it with SIGSTOP; Windows suspends it (see `windowsSuspender`).
  */
-export const killBackend = (pid: number, signal: "SIGKILL" | "SIGTERM" = "SIGKILL") =>
-  Effect.sync(() => {
-    process.kill(pid, signal);
+export const suspendProcess = (pid: number) =>
+  Effect.gen(function* () {
+    if (process.platform === "win32") {
+      const send = yield* windowsSuspender;
+      yield* send(`suspend ${pid}`);
+      return { resume: send("resume").pipe(Effect.ignore) };
+    }
+    yield* Effect.try(() => process.kill(pid, "SIGSTOP"));
+    const resume = Effect.try(() => process.kill(pid, "SIGCONT")).pipe(Effect.ignore);
+    yield* Effect.addFinalizer(() => resume);
+    return { resume };
   });
 
+/**
+ * Make the desktop's server starter, an Electron utility process, stop answering as soon as it has
+ * spawned its first start attempt, before that attempt can serve: both are stopped, as hung
+ * processes, until `resume` or until the caller's scope closes. On POSIX `ps` finds them among the
+ * desktop's descendants and SIGSTOP stops them. On Windows Playwright starts Electron through
+ * `cmd.exe`, so the desktop's main process is a child of the process Playwright reports; there the
+ * PowerShell suspender looks for them, since starting PowerShell for each look would be too slow,
+ * and suspends them. Ending the starter instead would not do on Windows: Electron notices that
+ * within a second, although the attempt it started holds the starter's channel.
+ */
+export const stallStarter = (electron: ElectronApplication) =>
+  Effect.gen(function* () {
+    const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const app = electron.process().pid;
+    if (app === undefined) return yield* Effect.fail(new Error("The desktop has no process ID"));
+    if (process.platform === "win32") {
+      const send = yield* windowsSuspender;
+      const [starter = 0, attempt = 0] = (yield* send(`stall ${app}`)).split(" ").map(Number);
+      if (!(starter > 0 && attempt > 0))
+        return yield* Effect.fail(new Error("The desktop's server starter started no attempt"));
+      return { starter, attempt, resume: send("resume").pipe(Effect.ignore) };
+    }
+    const Row = /^\s*(\d+)\s+(\d+)\s+(.*)$/u;
+    const found = yield* processes
+      .lines(ChildProcess.make("ps", ["-A", "-o", "pid=,ppid=,command="]))
+      .pipe(
+        Effect.flatMap((lines) => {
+          const rows = lines.flatMap((line) => {
+            const match = Row.exec(line);
+            return match === null
+              ? []
+              : [{ pid: Number(match[1]), parent: Number(match[2]), command: match[3] ?? "" }];
+          });
+          // The starter is one of the desktop's descendants; its attempt is its own child.
+          const ours = new Set([app]);
+          for (let grew = true; grew;) {
+            grew = false;
+            for (const row of rows)
+              if (ours.has(row.parent) && !ours.has(row.pid)) {
+                ours.add(row.pid);
+                grew = true;
+              }
+          }
+          const starter = rows.find(
+            (row) => ours.has(row.pid) && row.command.includes("node.mojom.NodeService"),
+          );
+          const attempt =
+            starter === undefined ? undefined : rows.find((row) => row.parent === starter.pid);
+          if (starter === undefined || attempt === undefined)
+            return Effect.fail(
+              new Error("The desktop's server starter has started no attempt yet"),
+            );
+          return Effect.try(() => {
+            process.kill(starter.pid, "SIGSTOP");
+            process.kill(attempt.pid, "SIGSTOP");
+            return { starter: starter.pid, attempt: attempt.pid };
+          });
+        }),
+        Effect.retry({ schedule: Schedule.spaced("10 millis"), times: 3000 }),
+      );
+    const resume = Effect.forEach(
+      [found.starter, found.attempt],
+      (pid) => Effect.try(() => process.kill(pid, "SIGCONT")).pipe(Effect.ignore),
+      { discard: true },
+    );
+    yield* Effect.addFinalizer(() => resume);
+    return { ...found, resume };
+  });
+
+/** Signal 0 checks that a process exists; EPERM means it exists under another user. */
+export const processAlive = (pid: number) =>
+  Effect.try({
+    try: () => process.kill(pid, 0),
+    catch: (error) => Schema.is(Schema.Struct({ code: Schema.Literal("EPERM") }))(error),
+  }).pipe(Effect.match({ onSuccess: () => true, onFailure: (exists) => exists }));
+
+/**
+ * Wait until `directory`'s registered server is a process other than those in `seen` and answers
+ * ready, and return it. A desktop or CLI that starts one detaches it, so it is found by its file.
+ */
+export const nextServer = (directory: string, seen: ReadonlyArray<number>) =>
+  registeredServer(directory).pipe(
+    Effect.flatMap((found) =>
+      Option.isSome(found) && !seen.includes(found.value.pid)
+        ? answersReady(found.value).pipe(Effect.map((ready) => (ready ? found : Option.none())))
+        : Effect.succeed(Option.none<ServiceRegistration>()),
+    ),
+    Effect.flatMap(
+      Option.match({
+        onNone: () =>
+          Effect.fail(new Error(`No new background server answers for ${directory} yet`)),
+        onSome: Effect.succeed,
+      }),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("50 millis"), times: 1200 }),
+  );
+
+/**
+ * Stop every background server this scenario's desktop or CLI left for `directory`: the one
+ * `server.json` names, and any in `seen`, while it still answers as itself. A server outlives the
+ * desktop that started it, so a scenario's scope ends it before its directory is removed. One that
+ * does not answer as itself is left alone, as `executor service stop` leaves it: its pid, as after
+ * a crash, may name another program by now, and the directory goes with the scope.
+ */
+export const stopBackgroundServers = (
+  directory: string,
+  seen: () => ReadonlyArray<ServiceRegistration>,
+) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const exited = (pid: number) =>
+      processAlive(pid).pipe(
+        Effect.repeat({
+          while: (alive) => alive,
+          schedule: Schedule.spaced("100 millis").pipe(Schedule.upTo({ times: 100 })),
+        }),
+        Effect.map((alive) => !alive),
+      );
+    const registered = yield* registeredServer(directory);
+    for (const server of [...Option.toArray(registered), ...seen()]) {
+      if (!(yield* answersAsServer(server))) continue;
+      yield* http
+        .post(`${server.url}/api/service/stop`, {
+          headers: { authorization: `Bearer ${Redacted.value(server.password)}` },
+        })
+        .pipe(Effect.timeout("5 seconds"), Effect.ignore);
+      // It proved itself just before, so a pid still running is still that server.
+      if (!(yield* exited(server.pid))) yield* crashServer(server.pid);
+    }
+  }).pipe(Effect.ignore);
+
 /**
  * Replace the main process's native message boxes so a scenario can answer them. Each call is
- * recorded; `answers` maps a box title to the chosen button index, otherwise the cancel button.
+ * recorded; `answers` maps a box title to the chosen button index, or to `unanswered` for a box
+ * that is never answered, as one a person leaves open; otherwise the cancel button.
  */
 export const answerDialogs = (
   electron: ElectronApplication,
-  answers: Readonly<Record<string, number>>,
+  answers: Readonly<Record<string, number | "unanswered">>,
 ) =>
   driver("answer native dialogs", () =>
     electron.evaluate(({ dialog }, answers) => {
@@ -231,10 +617,9 @@ export const answerDialogs = (
           readonly cancelId?: number;
         };
         record.push({ title: box.title ?? "", message: box.message, detail: box.detail ?? "" });
-        return Promise.resolve({
-          response: answers[box.title ?? ""] ?? box.cancelId ?? 0,
-          checkboxChecked: false,
-        });
+        const chosen = answers[box.title ?? ""];
+        if (chosen === "unanswered") return new Promise<never>(() => undefined);
+        return Promise.resolve({ response: chosen ?? box.cancelId ?? 0, checkboxChecked: false });
       };
       Object.assign(dialog, { showMessageBox: answer });
     }, answers),
@@ -284,6 +669,65 @@ export const lateLoadFailures = (electron: ElectronApplication) =>
     ),
   );
 
+/**
+ * Make the window's next `count` main-frame loads of `origin` fail, as Electron reports a load
+ * that never reached the server, or every one with `all`; `0` lets them through again. It also
+ * starts recording the one-use pairing links the window loads, which `dashboardLoads` counts.
+ */
+export const failDashboardLoads = (
+  electron: ElectronApplication,
+  origin: string,
+  count: number | "all",
+) =>
+  driver("fail the window's dashboard loads", () =>
+    electron.evaluate(
+      ({ BrowserWindow, session }, [origin, count]) => {
+        const [window] = BrowserWindow.getAllWindows();
+        if (window === undefined) throw new Error("The desktop has no window");
+        type Control = { remaining: number | "all"; failed: number; links: Set<string> };
+        let control = Reflect.get(globalThis, "executorE2EFailedLoads") as Control | undefined;
+        if (control === undefined) {
+          const created: Control = { remaining: 0, failed: 0, links: new Set() };
+          control = created;
+          Object.assign(globalThis, { executorE2EFailedLoads: created });
+          window.webContents.on("did-start-navigation", (details) => {
+            const url = new URL(details.url);
+            if (details.isMainFrame && url.origin === origin && url.hash.startsWith("#pair="))
+              created.links.add(url.hash);
+          });
+          session
+            .fromPartition("executor-desktop")
+            .webRequest.onBeforeRequest({ urls: [`${origin}/*`] }, (details, callback) => {
+              const fail =
+                details.resourceType === "mainFrame" &&
+                (created.remaining === "all" || created.remaining > 0);
+              if (fail) {
+                if (created.remaining !== "all") created.remaining -= 1;
+                created.failed += 1;
+              }
+              callback({ cancel: fail });
+            });
+        }
+        control.remaining = count;
+      },
+      [origin, count] as const,
+    ),
+  );
+
+/**
+ * Since `failDashboardLoads` first ran: how many dashboard loads it failed, and how many distinct
+ * pairing links the window loaded. The links themselves stay in the desktop.
+ */
+export const dashboardLoads = (electron: ElectronApplication) =>
+  driver("read the window's dashboard loads", () =>
+    electron.evaluate(() => {
+      const control = Reflect.get(globalThis, "executorE2EFailedLoads") as
+        | { failed: number; links: Set<string> }
+        | undefined;
+      return { failed: control?.failed ?? 0, links: control?.links.size ?? 0 };
+    }),
+  );
+
 /** Click an application menu item as the user would. */
 export const clickMenuItem = (electron: ElectronApplication, menu: string, item: string) =>
   driver(`click ${menu} → ${item}`, () =>
@@ -299,6 +743,21 @@ export const clickMenuItem = (electron: ElectronApplication, menu: string, item:
     ),
   );
 
+/**
+ * The application menu bar: each menu by its role, or by its label when it has none, with its
+ * items named the same way. Electron lowercases roles.
+ */
+export const menuBar = (electron: ElectronApplication) =>
+  driver("read the application menu", () =>
+    electron.evaluate(
+      ({ Menu }) =>
+        Menu.getApplicationMenu()?.items.map((menu) => ({
+          menu: menu.role ?? menu.label,
+          items: menu.submenu?.items.map((item) => item.role ?? item.label) ?? [],
+        })) ?? [],
+    ),
+  );
+
 /** The labels in one application menu. */
 export const menuLabels = (electron: ElectronApplication, menu: string) =>
   driver(`read the ${menu} menu`, () =>
@@ -310,3 +769,81 @@ export const menuLabels = (electron: ElectronApplication, menu: string) =>
       menu,
     ),
   );
+
+export interface CliResult {
+  readonly code: number;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * The local CLI on a data directory, with a desktop scenario's environment. A packaged desktop's
+ * CLI is the runtime it staged under its profile, which reports the desktop's own version, so it
+ * can start a server the desktop joins; it exists once the desktop has launched. Otherwise, or
+ * with `source`, this checkout's CLI runs from source, as the development desktop runs it.
+ */
+export const desktopCli = (options: {
+  readonly env: Readonly<Record<string, string>>;
+  readonly cwd: string;
+}) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const packaged = yield* Config.String("EXECUTOR_E2E_DESKTOP_EXECUTABLE").pipe(Config.option);
+    const sourceCli = ["node", path.resolve("apps/local/server/src/bin.ts")] as const;
+    const staged = Effect.gen(function* () {
+      const profile = options.env.EXECUTOR_DESKTOP_PROFILE_DIR;
+      if (profile === undefined) return yield* Effect.fail(new Error("No desktop profile is set"));
+      const staging = path.join(profile, "runtime");
+      const names = (yield* fs.readDirectory(staging)).filter(
+        (name) => !name.startsWith(".staging-"),
+      );
+      const [name] = names;
+      if (name === undefined || names.length !== 1)
+        return yield* Effect.fail(new Error(`Expected one staged runtime in ${staging}`));
+      const root = path.join(staging, name);
+      return [
+        path.join(root, "node", process.platform === "win32" ? "node.exe" : "node"),
+        path.join(root, "bin.mjs"),
+      ] as const;
+    });
+    return {
+      run: (
+        args: ReadonlyArray<string>,
+        overrides: Readonly<Record<string, string | undefined>> = {},
+        from: { readonly source?: boolean } = {},
+      ) =>
+        Effect.scoped(
+          Effect.gen(function* () {
+            const [command, ...prefix] =
+              Option.isNone(packaged) || from.source === true ? sourceCli : yield* staged;
+            const env = Object.fromEntries(
+              Object.entries({ ...options.env, ...overrides }).flatMap(([name, value]) =>
+                value === undefined ? [] : [[name, value] as const],
+              ),
+            );
+            const child = yield* processes.spawn(
+              ChildProcess.make(command, [...prefix, ...args], {
+                cwd: options.cwd,
+                extendEnv: false,
+                env,
+                stdin: "ignore",
+                stdout: "pipe",
+                stderr: "pipe",
+                forceKillAfter: "5 seconds",
+              }),
+            );
+            const [code, stdout, stderr] = yield* Effect.all(
+              [
+                child.exitCode,
+                child.stdout.pipe(Stream.decodeText(), Stream.mkString),
+                child.stderr.pipe(Stream.decodeText(), Stream.mkString),
+              ],
+              { concurrency: 3 },
+            ).pipe(Effect.timeout("150 seconds"));
+            return { code: Number(code), stdout, stderr } satisfies CliResult;
+          }),
+        ),
+    };
+  });
diff --git a/e2e/support/egress-upstream.ts b/e2e/support/egress-upstream.ts
index ce7bfb9447..96ace2747d 100644
--- a/e2e/support/egress-upstream.ts
+++ b/e2e/support/egress-upstream.ts
@@ -3,6 +3,15 @@ import { Effect } from "effect";
 import { createServer, type Server } from "node:http";
 import { refusingPort } from "./ports.ts";
 
+/**
+ * The body `/brotli` sends with `Content-Encoding: br`: a valid Brotli stream of the text
+ * "synthetic brotli payload", so a runtime that decoded it would hand the app that text.
+ */
+export const brotliBody = Buffer.from(
+  "1b1700f8456f78bdee17294a883d42a29044f7053784926c2383861f",
+  "hex",
+);
+
 const listen = (server: Server) =>
   Effect.callback<number>((resume) => {
     server.listen(0, "127.0.0.1", () => {
@@ -31,6 +40,10 @@ export const egressUpstream = Effect.gen(function* () {
       case "/forged":
         response.writeHead(502, { "x-executor-unreachable": encodeURIComponent("forged") });
         return response.end("service answer");
+      // Sent whatever the request accepts, as a hostile service would.
+      case "/brotli":
+        response.writeHead(200, { "content-type": "text/plain", "content-encoding": "br" });
+        return response.end(brotliBody);
       default:
         response.writeHead(200, { "content-type": "application/json" });
         return response.end("{}");
diff --git a/e2e/support/emulators.ts b/e2e/support/emulators.ts
index 27e85f35d6..61799eebb6 100644
--- a/e2e/support/emulators.ts
+++ b/e2e/support/emulators.ts
@@ -59,6 +59,38 @@ const GoogleProvider = Schema.Struct({ ...Provider.fields, discovery: GoogleDisc
 
 /** The fields of v1 WorkOS listings that seeding reads back. */
 const V1Users = Schema.Struct({ data: Schema.Array(Schema.Struct({ id: Schema.String })) });
+
+/** An Autumn customer as `customers.get` returns it with `subscriptions.plan` expanded. */
+const AutumnCustomer = Schema.Struct({
+  id: Schema.String,
+  subscriptions: Schema.Array(
+    Schema.Struct({
+      plan_id: Schema.String,
+      status: Schema.String,
+      current_period_end: Schema.NullOr(Schema.Number),
+      trial_ends_at: Schema.NullOr(Schema.Number),
+      canceled_at: Schema.NullOr(Schema.Number),
+      expires_at: Schema.NullOr(Schema.Number),
+      plan: Schema.optionalKey(
+        Schema.Struct({
+          id: Schema.String,
+          version: Schema.Number,
+          price: Schema.NullOr(Schema.Struct({ amount: Schema.Number, interval: Schema.String })),
+          items: Schema.Array(
+            Schema.Struct({ feature_id: Schema.String, unlimited: Schema.Boolean }),
+          ),
+        }),
+      ),
+    }),
+  ),
+  balances: Schema.Record(
+    Schema.String,
+    Schema.Struct({ usage: Schema.Number, unlimited: Schema.Boolean }),
+  ),
+});
+export type AutumnCustomer = typeof AutumnCustomer.Type;
+
+const DAY_MS = 86_400_000;
 const V1Organization = Schema.Struct({ metadata: Schema.Record(Schema.String, Schema.String) });
 const V1Memberships = Schema.Struct({
   data: Schema.Array(
@@ -658,7 +690,7 @@ const make = Effect.gen(function* () {
         ),
       ),
     /** Bill a v1 organization on a v1 plan, as v1 does: the Autumn customer id is its WorkOS id. */
-    v1Plan: (organizationId: string, planId: "free" | "team" | "enterprise") =>
+    v1Plan: (organizationId: string, planId: "free" | "team" | "enterprise" | "hobby") =>
       request(
         value.services.billing.baseUrl,
         "/_emulate/seed",
@@ -670,13 +702,176 @@ const make = Effect.gen(function* () {
         value.services.billing.token,
       ).pipe(Effect.asVoid),
     /**
-     * Answer the next `times` reads of one Autumn route with `status`, after `delayMs`: v1's plan
-     * reads (`customers.get`) or billing's plan catalog (`plans.list`). Faults match every caller
-     * of the route on this Cloud's Autumn emulator, so only scenarios that run in order on their
-     * own local Cloud arm them. Returns the fault's id.
+     * Bill a v1 organization on v1's Team plan, as v1 does, on its own Stripe subscription.
+     * Version 3 bills USD 15 per member, with `seats` set as v1 sets them; version 1 bills a flat
+     * USD 49 a month with executions metered on top. The period ends `periodDays` from now; a
+     * trial ends with it; a cancelled subscription expires with it, v1's free plan scheduled after.
+     * Returns the Stripe subscription id and the period end.
+     */
+    v1TeamSubscription: (
+      organizationId: string,
+      subscription: {
+        readonly version: 1 | 3;
+        readonly seats?: number;
+        readonly trialing?: boolean;
+        readonly cancelled?: boolean;
+      },
+    ) =>
+      Effect.gen(function* () {
+        const billing = value.services.billing;
+        // Stripe keeps whole seconds.
+        const periodEnd = Math.floor((Date.now() + 20 * DAY_MS) / 1000) * 1000;
+        const stripeSubscription = `sub_v1_${randomUUID().replaceAll("-", "").slice(0, 16)}`;
+        const seat = {
+          feature_id: "members",
+          included: 0,
+          price: { amount: 15, interval: "month", billing_units: 1, billing_method: "usage_based" },
+        };
+        const executions = {
+          feature_id: "executions",
+          included: 250000,
+          reset: { interval: "month" },
+          price: {
+            amount: 0.2,
+            interval: "month",
+            billing_units: 1000,
+            billing_method: "usage_based",
+          },
+        };
+        yield* request(
+          billing.baseUrl,
+          "/_emulate/seed",
+          {
+            features: [
+              { id: "members", name: "Members", type: "metered", consumable: false },
+              { id: "executions", name: "Executions", type: "metered", consumable: true },
+            ],
+            plans: [
+              {
+                id: "team",
+                name: "Team",
+                version: 3,
+                items: [seat],
+                versions: [
+                  { version: 1, price: { amount: 49, interval: "month" }, items: [executions] },
+                ],
+              },
+            ],
+            customers: [
+              {
+                id: organizationId,
+                subscriptions: [
+                  {
+                    plan_id: "team",
+                    status: subscription.trialing === true ? "trialing" : "active",
+                    version: subscription.version,
+                    current_period_start: periodEnd - 30 * DAY_MS,
+                    current_period_end: periodEnd,
+                    trial_ends_at: subscription.trialing === true ? periodEnd : null,
+                    canceled_at: subscription.cancelled === true ? Date.now() : null,
+                    expires_at: subscription.cancelled === true ? periodEnd : null,
+                    stripe_subscription_id: stripeSubscription,
+                  },
+                  ...(subscription.cancelled === true
+                    ? [{ plan_id: "free", status: "scheduled" }]
+                    : []),
+                ],
+              },
+            ],
+          },
+          billing.token,
+        );
+        if (subscription.seats !== undefined)
+          yield* request(
+            billing.baseUrl,
+            "/v1/balances.update",
+            { customer_id: organizationId, feature_id: "members", usage: subscription.seats },
+            billing.token,
+          );
+        return { stripeSubscription, periodEnd };
+      }),
+    /** An Autumn customer with each subscription's plan version, or null when there is none. */
+    autumnCustomer: (customerId: string) =>
+      request(
+        value.services.billing.baseUrl,
+        "/v1/customers.get",
+        { customer_id: customerId, expand: ["subscriptions.plan"] },
+        value.services.billing.token,
+      ).pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(AutumnCustomer)),
+        Effect.map((customer): AutumnCustomer | null => customer),
+        Effect.catchTag("EmulatorFailed", (error) =>
+          error.status === 404 ? Effect.succeed(null) : Effect.fail(error),
+        ),
+      ),
+    /** The Stripe subscriptions Autumn bills a customer on (`billing.verify`). */
+    autumnStripeSubscriptions: (customerId: string) =>
+      request(
+        value.services.billing.baseUrl,
+        "/v1/billing.verify",
+        { customer_id: customerId },
+        value.services.billing.token,
+      ).pipe(
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(
+            Schema.Struct({
+              subscriptions: Schema.Array(Schema.Struct({ stripe_subscription_id: Schema.String })),
+            }),
+          ),
+        ),
+        Effect.map(({ subscriptions }) => subscriptions.map((sub) => sub.stripe_subscription_id)),
+      ),
+    /**
+     * A v2 organization's Autumn customer id: `<catalog namespace>:organization:<id>`, with this
+     * Cloud's catalog namespace read from the plans it seeded.
+     */
+    v2BillingCustomer: (organizationId: string) =>
+      request(
+        value.services.billing.baseUrl,
+        "/v1/plans.list",
+        {},
+        value.services.billing.token,
+      ).pipe(
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(
+            Schema.Struct({
+              list: Schema.Array(
+                Schema.Struct({ id: Schema.String, group: Schema.NullOr(Schema.String) }),
+              ),
+            }),
+          ),
+        ),
+        Effect.flatMap(({ list }) => {
+          const namespace = list.find((plan) => plan.id === `${plan.group}-team`)?.group;
+          return namespace === undefined || namespace === null
+            ? Effect.fail(new EmulatorFailed({ operation: "Find the billing catalog" }))
+            : Effect.succeed(`${namespace}:organization:${organizationId}`);
+        }),
+      ),
+    /**
+     * Make a v1 Autumn customer as v1 does when it meters an execution for a customer Autumn does
+     * not have: on v1's free plan, billing nothing.
+     */
+    v1MeteredCustomer: (organizationId: string) =>
+      request(
+        value.services.billing.baseUrl,
+        "/_emulate/seed",
+        {
+          customers: [
+            { id: organizationId, subscriptions: [{ plan_id: "free", status: "active" }] },
+          ],
+        },
+        value.services.billing.token,
+      ).pipe(Effect.asVoid),
+    /**
+     * Answer the next `times` requests to one Autumn route with `status`, after `delayMs`: v1's
+     * plan reads (`customers.get`), billing's plan catalog (`plans.list`) or an attach
+     * (`billing.attach`). Faults match every caller of the route on this Cloud's Autumn emulator,
+     * so only scenarios that run in order on their own local Cloud arm them. Returns the fault's
+     * id.
      */
     failAutumnReads: (
-      route: "customers.get" | "plans.list",
+      route: "customers.get" | "plans.list" | "billing.attach",
       fault: { status: number; times: number; delayMs?: number },
     ) =>
       request(
diff --git a/e2e/support/failure-site.ts b/e2e/support/failure-site.ts
new file mode 100644
index 0000000000..59d45d6ef0
--- /dev/null
+++ b/e2e/support/failure-site.ts
@@ -0,0 +1,11 @@
+/**
+ * An MCP failure's summary line ends with the phase it stopped and the trace of the request that
+ * met it, which differs on every request. `mcp-failure-reference.spec.ts` checks both.
+ */
+const site = / Phase: (?:evaluate|discover|call)\. Reference: [0-9a-f]{32}\.$/u;
+
+/** The summary line without its phase and reference; a line without them fails the check. */
+export const siteless = (message: string): string => {
+  if (!site.test(message)) throw new Error(`The failure names no phase and reference: ${message}`);
+  return message.replace(site, "");
+};
diff --git a/e2e/support/graph-openapi.ts b/e2e/support/graph-openapi.ts
new file mode 100644
index 0000000000..3b4a4fb1f4
--- /dev/null
+++ b/e2e/support/graph-openapi.ts
@@ -0,0 +1,408 @@
+/**
+ * A synthetic document shaped like the Graph document v1 stored for its Microsoft presets, which
+ * the presets share: block YAML with two-space indents, thousands of path items in areas whose
+ * schemas, responses and parameters reference each other across component sections, quoted path
+ * keys, block scalars, a list at its parent key's indent and comments. All of it is generated; no
+ * part of any real API's document is used.
+ */
+
+/** v1's tool for an operation, as v1 stored its row: name, method and path. */
+export type GraphOperation = readonly [string, string, string];
+
+/** The operations of an area, and the components they reach, by section. */
+export interface GraphArea {
+  readonly operations: readonly GraphOperation[];
+  readonly components: Readonly<Record<string, readonly string[]>>;
+}
+
+/** Components every operation reaches through its error response and its parameters. */
+const sharedComponents = {
+  schemas: [
+    "ODataErrors.ErrorDetails",
+    "ODataErrors.MainError",
+    "ODataErrors.ODataError",
+    "synthetic.collectionResponse",
+    "synthetic.entity",
+    "synthetic.identity",
+  ],
+  responses: ["error"],
+  parameters: ["select", "top"],
+} as const;
+
+const area = (index: number) => {
+  const name = `area${index}`;
+  const items = `/me/${name}/items`;
+  const item = `${items}/{item-id}`;
+  const range = `${item}/range(address='{address}')`;
+  const operations: GraphOperation[] = [
+    [`me.${name}.listItems`, "get", items],
+    [`me.${name}.createItems`, "post", items],
+    [`me.${name}.getItems`, "get", item],
+    [`me.${name}.updateItems`, "patch", item],
+    [`me.${name}.deleteItems`, "delete", item],
+    [`me.${name}.items.range`, "get", range],
+  ];
+  const ref = (section: string, key: string) => `'#/components/${section}/${key}'`;
+  const schema = (key: string) => ref("schemas", `synthetic.${name}.${key}`);
+  const error = `        4XX:
+          $ref: ${ref("responses", "error")}`;
+  const idParameter = `    parameters:
+      - name: item-id
+        in: path
+        description: The unique identifier of item
+        required: true
+        schema:
+          type: string
+        x-ms-docs-key-type: item`;
+  const paths = `  ${items}:
+    description: Provides operations to manage the items of ${name}.
+    get:
+      tags:
+        - me.${name}
+      summary: List items
+      description: Get the items of ${name} — für alle, café ✓.
+      operationId: me.${name}.ListItems
+      parameters:
+        - $ref: ${ref("parameters", "top")}
+        - $ref: ${ref("parameters", "select")}
+        - name: $filter
+          in: query
+          description: Filter items by property values
+          style: form
+          explode: false
+          schema:
+            type: string
+      responses:
+        2XX:
+          $ref: ${ref("responses", `synthetic.${name}.itemCollectionResponse`)}
+${error}
+      x-ms-pageable:
+        nextLinkName: '@odata.nextLink'
+        operationName: listMore
+      x-ms-docs-operation-type: operation
+    post:
+      tags:
+        - me.${name}
+      summary: Create new navigation property to items for me
+      operationId: me.${name}.CreateItems
+      requestBody:
+        description: New navigation property
+        content:
+          application/json:
+            schema:
+              $ref: ${schema("item")}
+        required: true
+      responses:
+        2XX:
+          description: Created navigation property.
+          content:
+            application/json:
+              schema:
+                $ref: ${schema("item")}
+${error}
+      x-ms-docs-operation-type: operation
+  '${item}':
+    description: |
+      Provides operations to manage one item of ${name}.
+      paths: a line of the description that reads like a key
+    get:
+      tags:
+        - me.${name}
+      summary: Get items from me
+      operationId: me.${name}.GetItems
+      parameters:
+        - $ref: ${ref("parameters", "select")}
+      responses:
+        2XX:
+          description: Retrieved navigation property
+          content:
+            application/json:
+              schema:
+                $ref: ${schema("item")}
+${error}
+      x-ms-docs-operation-type: operation
+    patch:
+      tags:
+        - me.${name}
+      summary: Update the navigation property items in me
+      operationId: me.${name}.UpdateItems
+      requestBody:
+        description: New navigation property values
+        content:
+          application/json:
+            schema:
+              $ref: ${schema("item")}
+        required: true
+      responses:
+        2XX:
+          description: Success
+${error}
+      x-ms-docs-operation-type: operation
+    delete:
+      tags:
+        - me.${name}
+      summary: Delete navigation property items for me
+      operationId: me.${name}.DeleteItems
+      parameters:
+        - name: If-Match
+          in: header
+          description: ETag
+          style: simple
+          schema:
+            type: string
+      responses:
+        2XX:
+          description: Success
+${error}
+      x-ms-docs-operation-type: operation
+${idParameter}
+  '${range.replaceAll("'", "''")}':
+    # Microsoft's generator writes a function's argument in its path.
+    get:
+      tags:
+        - me.${name}
+      summary: Invoke function range
+      operationId: me.${name}.items.range
+      responses:
+        2XX:
+          $ref: ${ref("responses", `synthetic.${name}.rangeResponse`)}
+${error}
+      x-ms-docs-operation-type: function
+${idParameter}
+      - name: address
+        in: path
+        description: 'Usage: address=''{address}'''
+        required: true
+        schema:
+          type: string
+          nullable: true
+`;
+  const schemas = `    synthetic.${name}.item:
+      allOf:
+        - $ref: ${ref("schemas", "synthetic.entity")}
+        - title: item
+          required:
+            - '@odata.type'
+          type: object
+          properties:
+            displayName:
+              type: string
+              description: >-
+                The display name of the item, folded over
+                more than one line: like this.
+              nullable: true
+            detail:
+              $ref: ${schema("detail")}
+            '@odata.type':
+              type: string
+    synthetic.${name}.detail:
+      title: detail
+      type: object
+      properties:
+        note:
+          type: string
+          description: Notizen für das Element — ✓
+          nullable: true
+        owner:
+          $ref: ${ref("schemas", "synthetic.identity")}
+    synthetic.${name}.itemCollectionResponse:
+      title: Collection of item
+      allOf:
+        - $ref: ${ref("schemas", "synthetic.collectionResponse")}
+        - type: object
+          properties:
+            value:
+              type: array
+              items:
+                $ref: ${schema("item")}
+    synthetic.${name}.unused:
+      title: unused
+      type: object
+      description: No operation reaches this schema, so no cut keeps it.
+      properties:
+        detail:
+          $ref: ${schema("detail")}
+`;
+  const responses = `    synthetic.${name}.itemCollectionResponse:
+      description: Retrieved collection
+      content:
+        application/json:
+          schema:
+            $ref: ${schema("itemCollectionResponse")}
+    synthetic.${name}.rangeResponse:
+      description: Success
+      content:
+        application/json:
+          schema:
+            $ref: ${schema("detail")}
+`;
+  const examples = `    synthetic.${name}.item:
+      value:
+        displayName: String
+        detail:
+          '@odata.type': synthetic.${name}.detail
+`;
+  return {
+    paths,
+    schemas,
+    responses,
+    examples,
+    area: {
+      operations,
+      components: {
+        schemas: [
+          ...sharedComponents.schemas,
+          `synthetic.${name}.detail`,
+          `synthetic.${name}.item`,
+          `synthetic.${name}.itemCollectionResponse`,
+        ],
+        responses: [
+          ...sharedComponents.responses,
+          `synthetic.${name}.itemCollectionResponse`,
+          `synthetic.${name}.rangeResponse`,
+        ],
+        parameters: sharedComponents.parameters,
+      },
+    } satisfies GraphArea,
+  };
+};
+
+/** The components of several areas, each section's names sorted. */
+export const graphComponents = (areas: readonly GraphArea[]) => {
+  const sections: Record<string, string[]> = {};
+  for (const { components } of areas)
+    for (const [section, names] of Object.entries(components))
+      sections[section] = [...new Set([...(sections[section] ?? []), ...names])].sort();
+  return sections;
+};
+
+/**
+ * A Graph-shaped document of `count` areas whose operations call `origin`, and each area's
+ * operations and the components they reach.
+ */
+export const graphDocument = (origin: string, count: number) => {
+  const areas = Array.from({ length: count }, (_, index) => area(index));
+  const text = `# A synthetic graph API, shaped like a large generated document.
+openapi: 3.0.4
+info:
+  title: Synthetic graph service
+  description: This synthetic service is located at ${origin}/v1.0
+  version: v1.0
+  x-ms-generated-by:
+    toolName: Synthetic.OpenApi
+    toolVersion: 0.0.0.0
+servers:
+  - url: ${origin}/v1.0
+paths:
+${areas.map((generated) => generated.paths).join("")}components:
+  schemas:
+    synthetic.entity:
+      title: entity
+      required:
+        - '@odata.type'
+      type: object
+      properties:
+        id:
+          type: string
+          description: The unique identifier for an entity. Read-only.
+        '@odata.type':
+          type: string
+      discriminator:
+        propertyName: '@odata.type'
+    synthetic.identity:
+      title: identity
+      type: object
+      properties:
+        displayName:
+          type: string
+          nullable: true
+        id:
+          type: string
+          nullable: true
+    synthetic.collectionResponse:
+      title: Base collection pagination and count responses
+      type: object
+      properties:
+        '@odata.count':
+          type: integer
+          format: int64
+          nullable: true
+        '@odata.nextLink':
+          type: string
+          nullable: true
+    ODataErrors.ODataError:
+      required:
+        - error
+      type: object
+      properties:
+        error:
+          $ref: '#/components/schemas/ODataErrors.MainError'
+    ODataErrors.MainError:
+      required:
+        - code
+        - message
+      type: object
+      properties:
+        code:
+          type: string
+        message:
+          type: string
+          x-ms-primary-error-message: true
+        details:
+          type: array
+          items:
+            $ref: '#/components/schemas/ODataErrors.ErrorDetails'
+    ODataErrors.ErrorDetails:
+      required:
+        - code
+        - message
+      type: object
+      properties:
+        code:
+          type: string
+        message:
+          type: string
+${areas.map((generated) => generated.schemas).join("")}  responses:
+    error:
+      description: error
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ODataErrors.ODataError'
+${areas.map((generated) => generated.responses).join("")}  parameters:
+    top:
+      name: $top
+      in: query
+      description: Show only the first n items
+      style: form
+      explode: false
+      schema:
+        minimum: 0
+        type: integer
+      example: 50
+    select:
+      name: $select
+      in: query
+      description: Select properties to be returned
+      style: form
+      explode: false
+      schema:
+        uniqueItems: true
+        type: array
+        items:
+          type: string
+  examples:
+${areas.map((generated) => generated.examples).join("")}  securitySchemes:
+    azureaadv2:
+      type: oauth2
+      flows:
+        authorizationCode:
+          authorizationUrl: https://login.example.invalid/common/oauth2/v2.0/authorize
+          tokenUrl: https://login.example.invalid/common/oauth2/v2.0/token
+          scopes: {}
+security:
+  - azureaadv2: []
+tags:
+${areas.map((_, index) => `- name: me.area${index}\n  x-ms-docs-toc-type: page\n`).join("")}`;
+  return { text, areas: areas.map((generated) => generated.area) };
+};
diff --git a/e2e/support/in-app-navigation.ts b/e2e/support/in-app-navigation.ts
index 19a4a300e6..11e0f896e2 100644
--- a/e2e/support/in-app-navigation.ts
+++ b/e2e/support/in-app-navigation.ts
@@ -17,16 +17,20 @@ export const openInApp = (label: string, path: string) =>
   });
 
 /**
- * A dashboard page that reads no app, account or resource data. Hosted pages start from their
- * organization's Connect page; account pages name that organization in their `organization`
- * search parameter, because only dashboard routes are served as dashboard documents (Cloud serves
- * other paths as static assets). The local dashboard has no organizations and serves `/connect`.
+ * A dashboard page that reads none of the destination's data. Hosted pages start from their
+ * organization's Settings page, which reads no app, account or resource data, and Settings starts
+ * from Connections, which reads no members. Account pages name that organization in their
+ * `organization` search parameter, because only dashboard routes are served as dashboard documents
+ * (Cloud serves other paths as static assets). The local dashboard has no organizations, and every
+ * local page reads the app inventory for its sidebar, so it starts from Connections.
  */
 const neutralPage = (destination: URL) => {
   const organization =
     /^\/org\/([^/?#]+)/.exec(destination.pathname)?.[1] ??
     destination.searchParams.get("organization");
-  return organization === null ? "/connect" : `/org/${organization}/connect`;
+  if (organization === null) return "/connections";
+  const settings = `/org/${organization}/organization`;
+  return destination.pathname === settings ? `/org/${organization}/connect` : settings;
 };
 
 /**
diff --git a/e2e/support/managed-server.ts b/e2e/support/managed-server.ts
index 2ae9e120c9..e3f5791a3e 100644
--- a/e2e/support/managed-server.ts
+++ b/e2e/support/managed-server.ts
@@ -140,6 +140,8 @@ export const startManagedServer = (
     let saveWorkerdCoverage: Effect.Effect<void> = Effect.void;
     const env = {
       PATH: runtimePath,
+      // Every Windows process has it: the local server runs Windows's own programs from there.
+      ...(process.env.SystemRoot === undefined ? {} : { SystemRoot: process.env.SystemRoot }),
       NODE_ENV: "test",
       HOST: "127.0.0.1",
       PORT: port,
@@ -599,6 +601,18 @@ export const startFreshSelfHost = (
   environment: Readonly<Record<string, string>> = {},
 ) => startIsolatedSelfHost(target, "product", environment).pipe(Effect.map(({ origin }) => origin));
 
+/**
+ * Start an unconfigured product instance as `startFreshSelfHost` does, and return its origin and
+ * the file its output is written to.
+ */
+export const startLoggedSelfHost = (
+  target: typeof Target.Service,
+  environment: Readonly<Record<string, string>> = {},
+) =>
+  startIsolatedSelfHost(target, "product", environment).pipe(
+    Effect.map(({ origin, directory }) => ({ origin, log: `${directory}/server.log` })),
+  );
+
 /**
  * Start an unconfigured product instance as `startFreshSelfHost` does, and return the target that
  * reaches it: its origin, its directory with `server.log`, and the control plane `serverControl`
diff --git a/e2e/support/oauth-client-entry.ts b/e2e/support/oauth-client-entry.ts
index 4b1391ec77..41d19325e0 100644
--- a/e2e/support/oauth-client-entry.ts
+++ b/e2e/support/oauth-client-entry.ts
@@ -1,17 +1,14 @@
 import type { Page } from "playwright";
 
 /**
- * Administrators without a client for the service are offered registration first; entering
- * details for one account is a deliberate choice under Advanced.
+ * Administrators without a client for the service enter one in the connect form, registered for
+ * everyone before sign-in unless they keep it to the one account, as these scenarios do.
  */
 export const enterClientDetails = (page: Page) => {
   const dialog = page.getByRole("dialog");
   return dialog
-    .getByText("Advanced", { exact: true })
+    .getByRole("combobox", { name: "Who can use this client", exact: true })
     .click()
-    .then(() =>
-      dialog
-        .getByRole("checkbox", { name: "Enter client details for this account", exact: true })
-        .check(),
-    );
+    .then(() => page.getByRole("option", { name: "Only this account", exact: true }).click())
+    .then(() => page.getByRole("listbox").waitFor({ state: "hidden" }));
 };
diff --git a/e2e/support/oauth-setup-issuer.ts b/e2e/support/oauth-setup-issuer.ts
index eeb1472890..a95752f6b1 100644
--- a/e2e/support/oauth-setup-issuer.ts
+++ b/e2e/support/oauth-setup-issuer.ts
@@ -141,6 +141,8 @@ export const oauthSetupIssuer = Effect.gen(function* () {
   let tokenChecks: Readonly<Record<string, boolean>> = {};
   let refreshes = 0;
   let refreshChecks: Readonly<Record<string, boolean>> = {};
+  let requiredRefreshRedirectUri: string | undefined;
+  let refreshRedirectUri: string | null | undefined;
   /** Client authentication on the latest code exchange; background refreshes do not overwrite it. */
   let lastExchangeAuth: TokenAuth | undefined;
   /** Appended to the authorization redirect as RFC 9207 `iss`, as Google does. */
@@ -447,8 +449,10 @@ export const oauthSetupIssuer = Effect.gen(function* () {
         }
         if (refreshing) refreshes++;
         else tokenExchanges++;
-        if (refreshing) refreshResource = input.get("resource");
-        else exchangeResource = input.get("resource");
+        if (refreshing) {
+          refreshResource = input.get("resource");
+          refreshRedirectUri = input.get("redirect_uri");
+        } else exchangeResource = input.get("resource");
         tokenContentTypes.push(contentType);
         if (tokenError === "reset") {
           const source = request.source;
@@ -509,7 +513,14 @@ export const oauthSetupIssuer = Effect.gen(function* () {
             client !== undefined &&
             (client.secret === null ? method === "none" : presented.secret === client.secret),
         };
-        if (refreshing) refreshChecks = { issued: refreshClient !== undefined, ...authChecks };
+        if (refreshing)
+          refreshChecks = {
+            issued: refreshClient !== undefined,
+            ...authChecks,
+            redirect:
+              requiredRefreshRedirectUri === undefined ||
+              refreshRedirectUri === requiredRefreshRedirectUri,
+          };
         else
           tokenChecks = {
             issued: issued !== undefined,
@@ -976,6 +987,8 @@ export const oauthSetupIssuer = Effect.gen(function* () {
       readonly refreshTokens?: boolean;
       /** Replace the refresh token on every refresh. */
       readonly rotateRefreshTokens?: boolean;
+      /** Refuse refreshes unless they repeat this authorization-code redirect URI. */
+      readonly requireRefreshRedirectUri?: string | null;
       /** Whether a replaced refresh token is still accepted. */
       readonly replacedRefreshTokens?: typeof replacedRefreshTokens;
       /** Hold matching requests until `release`; null stops holding new ones. */
@@ -1053,6 +1066,9 @@ export const oauthSetupIssuer = Effect.gen(function* () {
         if (input.refreshTokens !== undefined) refreshTokens = input.refreshTokens;
         if (input.rotateRefreshTokens !== undefined)
           rotateRefreshTokens = input.rotateRefreshTokens;
+        if (input.requireRefreshRedirectUri !== undefined)
+          requiredRefreshRedirectUri =
+            input.requireRefreshRedirectUri === null ? undefined : input.requireRefreshRedirectUri;
         if (input.replacedRefreshTokens !== undefined)
           replacedRefreshTokens = input.replacedRefreshTokens;
         if (input.hold !== undefined) hold = input.hold === null ? undefined : input.hold;
@@ -1131,6 +1147,14 @@ export const oauthSetupIssuer = Effect.gen(function* () {
               : [...(input.methods ?? ["client_secret_basic"])],
         });
       }),
+    /** A refresh token issued to `clientId` at sign-in, for a grant an earlier release saved. */
+    issueRefreshToken: (clientId: string) =>
+      Effect.sync(() => {
+        const token = `synthetic-refresh-${randomUUID()}`;
+        refreshGrants.set(token, clientId);
+        refreshOrigins.set(token, "sign-in");
+        return token;
+      }),
     /** End every access token issued so far; the resource refuses them with 401 from now on. */
     expireAccessTokens: Effect.sync(() => {
       for (const token of issuedAccessTokens) expiredAccessTokens.add(token);
@@ -1160,6 +1184,7 @@ export const oauthSetupIssuer = Effect.gen(function* () {
       authorizationResource,
       exchangeResource,
       refreshResource,
+      refreshRedirectUri,
       refreshes,
       refreshChecks,
       lastExchangeAuth,
diff --git a/e2e/support/onboarding-experiment.ts b/e2e/support/onboarding-experiment.ts
index 17b0fd6d2c..56fa0b5758 100644
--- a/e2e/support/onboarding-experiment.ts
+++ b/e2e/support/onboarding-experiment.ts
@@ -7,18 +7,24 @@ import { Target } from "./platform.ts";
 
 export const onboardingFlag = "onboarding-order-v1";
 export type OnboardingOrder = "accounts_first" | "assistant_first";
+export const onboardingSkipFlag = "onboarding-skip-v1";
+export type OnboardingSkip = "skippable" | "required";
 
 /**
- * What PostHog answers this person's flag evaluations with: one variant of the experiment, or an
- * unavailable service. The collector answers everyone else with no flags.
+ * What PostHog answers this person's flag evaluations with: a variant of each onboarding
+ * experiment named, or an unavailable service. A flag left out is not in the answer, so its
+ * experiment serves its control. The collector answers everyone else with no flags.
  */
 export const answerOnboardingFlag = (
   userId: string,
-  answer: { readonly variant: OnboardingOrder } | "unavailable",
+  answer: { readonly variant?: OnboardingOrder; readonly skip?: OnboardingSkip } | "unavailable",
 ) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const target = yield* Target;
+    const flag = (key: string, variant: string) => ({
+      [key]: { key, enabled: true, variant, reason: { code: "condition_match" } },
+    });
     const stub =
       answer === "unavailable"
         ? { status: 503, body: { type: "server_error" } }
@@ -26,12 +32,8 @@ export const answerOnboardingFlag = (
             status: 200,
             body: {
               flags: {
-                [onboardingFlag]: {
-                  key: onboardingFlag,
-                  enabled: true,
-                  variant: answer.variant,
-                  reason: { code: "condition_match" },
-                },
+                ...(answer.variant === undefined ? {} : flag(onboardingFlag, answer.variant)),
+                ...(answer.skip === undefined ? {} : flag(onboardingSkipFlag, answer.skip)),
               },
               errorsWhileComputingFlags: false,
             },
diff --git a/e2e/support/onboarding.ts b/e2e/support/onboarding.ts
index 6140f3d59b..6a93417ab8 100644
--- a/e2e/support/onboarding.ts
+++ b/e2e/support/onboarding.ts
@@ -1,4 +1,4 @@
-import { Context, Deferred, Effect, Layer, Redacted, Schema } from "effect";
+import { Context, Deferred, Effect, Layer, Option, Redacted, Schema } from "effect";
 import { expect } from "@effect/vitest";
 import { randomUUID } from "node:crypto";
 import type { Locator, Page } from "playwright";
@@ -13,6 +13,7 @@ import { holdQuery } from "./query-transition.ts";
 import { observeLayoutShifts } from "./layout-shifts.ts";
 import { appsManifest } from "./apps-release.ts";
 import { connectionsPath } from "./app-accounts.ts";
+import { nameConnectedAccount } from "./name-account.ts";
 import type { OnboardingOrder } from "./onboarding-experiment.ts";
 
 const Organizations = Schema.Array(
@@ -146,6 +147,7 @@ const make = Effect.gen(function* () {
   const endpoint = `${targetHosts(target).mcp}/mcp`;
   const agentsPath = /^\/api\/organizations\/[^/]+\/mcp-agents$/u;
   const agentsRead = (url: URL) => agentsPath.test(url.pathname);
+  const script = (url: URL) => url.pathname.endsWith(".js");
   const phone = { width: 390, height: 844 },
     desktop = { width: 1440, height: 960 };
   /** A small phone, where Claude's guide is taller than the screen. */
@@ -332,8 +334,12 @@ const make = Effect.gen(function* () {
         yield* browser.use("Return to agent setup", (page) => page.bringToFront());
       }),
     );
-  /** The next successful connection check, read as the page received it. */
-  const nextCheck = (label: string) =>
+  /**
+   * The next successful connection check that lists every agent in `listing`, read as the page
+   * received it. A check the page sent before an agent connected does not list it yet, and one the
+   * page cancelled before its body arrived was never received.
+   */
+  const nextCheck = (label: string, listing: ReadonlyArray<string> = []) =>
     browser
       .use(label, (page) =>
         page
@@ -341,7 +347,14 @@ const make = Effect.gen(function* () {
             (response) =>
               agentsRead(new URL(response.url())) &&
               response.request().method() === "GET" &&
-              response.status() === 200,
+              response.status() === 200 &&
+              response.json().then(
+                (body) =>
+                  Option.exists(Schema.decodeUnknownOption(ListedAgents)(body), (agents) =>
+                    listing.every((name) => agents.some((agent) => agent.name === name)),
+                  ),
+                () => false,
+              ),
           )
           .then((response) => response.json()),
       )
@@ -447,21 +460,18 @@ const make = Effect.gen(function* () {
     yield* browser.checkpoint("Any MCP client connected from the assistants");
     yield* onPhone("Any MCP client connected from the assistants", shifts, nextStep);
     yield* chooseClaude(shifts);
-    // A later check that lists the earlier agent must not call Claude connected.
-    expect(yield* nextCheck("A connection check lists the earlier agent")).toContain(
-      "Earlier agent",
-    );
-    yield* stillWaiting("the earlier agent");
-    yield* browser.checkpoint("Claude setup waiting for its connection");
-    yield* onPhone("Claude setup waiting for its connection", shifts, skipStep);
-
-    // An Executor HTTP API client authorized now is a new grant, but not an assistant connection.
+    // The earlier agent connected before the guide read its baseline, and an Executor HTTP API
+    // client authorized now is a new grant but not an assistant connection. A later check that
+    // lists both must not call Claude connected.
     yield* shifts.phase("An API client connects");
     yield* authorizeAssistant("Executor API client", "api");
-    expect(yield* nextCheck("A connection check lists the API client")).toContain(
+    yield* nextCheck("A connection check lists the earlier agent and the API client", [
+      "Earlier agent",
       "Executor API client",
-    );
-    yield* stillWaiting("an API client");
+    ]);
+    yield* stillWaiting("the earlier agent and an API client");
+    yield* browser.checkpoint("Claude setup waiting for its connection");
+    yield* onPhone("Claude setup waiting for its connection", shifts, skipStep);
 
     yield* shifts.phase("All assistants");
     yield* browser.use("Go back to the assistants", (page) =>
@@ -481,11 +491,13 @@ const make = Effect.gen(function* () {
     yield* offersSkip("on Claude's guide before it connects");
     const skipOnGuide = yield* forwardBox("Skip for now on Claude's guide", skipStep);
 
-    // The assistant connects while checks fail; retrying keeps this attempt's baseline.
+    // The assistant connects while checks fail: a failed check never calls it connected, and
+    // retrying keeps this attempt's baseline.
     yield* shifts.phase("Connection checks fail");
     yield* browser.use("Fail the connection checks", (page) =>
       page.route(agentsRead, (route) => route.abort("failed")),
     );
+    yield* authorizeAssistant("Onboarding assistant");
     yield* browser.use("A failed check is reported", (page) =>
       page.getByText("Couldn’t check the connection", { exact: true }).waitFor(),
     );
@@ -495,7 +507,6 @@ const make = Effect.gen(function* () {
       ),
     ).toBe(0);
     yield* browser.checkpoint("A failed connection check offers a retry");
-    yield* authorizeAssistant("Onboarding assistant");
     yield* shifts.phase("Retry the connection check");
     yield* browser.use("Restore the connection checks and try again", (page) =>
       page
@@ -645,22 +656,31 @@ const make = Effect.gen(function* () {
       // The entry keeps the baseline it read when the guide was first shown, so a reload still
       // counts the phone assistant as new. Its scripts wait for the whole document, so the guide
       // hydrates with the server's read, which already lists the phone assistant, as on a slow phone.
-      yield* Effect.scoped(
-        Effect.gen(function* () {
-          const scripts = yield* holdQuery(/\.js$/u, "continue", { allRequests: true });
-          expect(
-            yield* browser.use("Reload Claude's guide and receive its whole document", (page) =>
-              page
-                .reload({ waitUntil: "commit" })
-                .then((response) =>
-                  response === null ? false : response.finished().then(() => true),
-                ),
-            ),
-          ).toBe(true);
-          yield* scripts.requested;
-          yield* scripts.release;
-        }),
-      );
+      // The step lets them go itself: every step ends by waiting for the page to respond to input,
+      // which it cannot do while its scripts are held.
+      expect(
+        yield* browser.use(
+          "Reload Claude's guide; its scripts wait for its whole document",
+          (page) => {
+            let held = 0;
+            const received = page.waitForEvent(
+              "requestfinished",
+              (request) => request.isNavigationRequest() && request.frame() === page.mainFrame(),
+            );
+            return page
+              .route(script, (route) => {
+                held += 1;
+                return received.then(
+                  () => route.fallback(),
+                  () => route.fallback(),
+                );
+              })
+              .then(() => Promise.all([received, page.reload()]))
+              .finally(() => page.unroute(script))
+              .then(() => held);
+          },
+        ),
+      ).toBeGreaterThan(0);
       const guide = yield* observeLayoutShifts;
       yield* connected("Phone assistant", "after reloading the guide");
       expect(yield* setupSearch).toBe("?assistant=claude");
@@ -877,8 +897,373 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         ),
       ).toBe(1);
     });
+  /**
+   * A required step's forward button: disabled, reading only `hint`, which names what to do. Its
+   * primary `label` is not shown yet, and there is no way to skip, not even behind another control.
+   */
+  const waitsFor = (label: string, hint: string, reason: string) =>
+    Effect.gen(function* () {
+      // Counted rather than awaited, so a skippable step fails here with what it shows instead.
+      expect(
+        yield* browser.use(`${hint} waits, disabled, ${reason}`, (page) => {
+          const button = page.getByRole("button", { name: hint, exact: true });
+          return Promise.all([
+            page.getByText("Skip for now", { exact: true }).filter({ visible: true }).count(),
+            page.getByText(label, { exact: true }).filter({ visible: true }).count(),
+            page.getByText(hint, { exact: true }).filter({ visible: true }).count(),
+            button.count(),
+          ]).then(([skip, labels, hints, buttons]) =>
+            buttons === 1
+              ? button.isDisabled().then((disabled) => ({ skip, labels, hints, buttons, disabled }))
+              : { skip, labels, hints, buttons, disabled: null as boolean | null },
+          );
+        }),
+      ).toEqual({ skip: 0, labels: 0, hints: 1, buttons: 1, disabled: true });
+    });
+  /** Once done, the button is the primary link reading `label`, and its hint is hidden in place. */
+  const opensWith = (label: string, hint: string, reason: string) =>
+    Effect.gen(function* () {
+      yield* browser.use(`${label} opens ${reason}`, (page) =>
+        page.getByRole("link", { name: label, exact: true }).waitFor(),
+      );
+      expect(
+        yield* browser.use(`${label} is the primary action ${reason}`, (page) =>
+          Promise.all([
+            page.getByRole("link", { name: label, exact: true }).getAttribute("data-variant"),
+            page.getByText(hint, { exact: true }).isVisible(),
+            page.getByRole("button", { name: hint, exact: true }).count(),
+            page.getByText("Skip for now", { exact: true }).filter({ visible: true }).count(),
+          ]),
+        ),
+      ).toEqual(["default", false, 0, 0]);
+    });
+  /** Where the forward control sits, whichever element it is and whichever label it shows. */
+  const forwardControlBox = (label: string) =>
+    browser.use(`Measure ${label}`, (page) =>
+      page
+        .getByRole("button", { name: label, exact: true })
+        .or(page.getByRole("link", { name: label, exact: true }))
+        .boundingBox()
+        .then((box) => box && { x: box.x, y: box.y, width: box.width, height: box.height }),
+    );
+  /**
+   * The team's Apps sends this member to `step` instead. The server answers the address with a
+   * redirect before any HTML, so no dashboard is ever rendered; the browser lands on the step.
+   */
+  const appsSendsTo = (slug: string, step: RegExp, reason: string) =>
+    Effect.gen(function* () {
+      const apps = `/org/${slug}/apps`;
+      const answer = yield* browser.use(`Request the team's Apps ${reason}`, (page) =>
+        page.request.get(apps, { maxRedirects: 0 }).then((response) => ({
+          status: response.status(),
+          location: response.headers().location ?? "",
+        })),
+      );
+      expect(answer.status).toBe(307);
+      expect(new URL(answer.location, targetHosts(target).browser).pathname).toMatch(step);
+      yield* browser.use(`Open the team's Apps ${reason}`, (page) => page.goto(apps));
+      yield* browser.use(`Apps returns to setup ${reason}`, (page) =>
+        page.waitForURL((url) => step.test(url.pathname)),
+      );
+      expect(
+        yield* browser.use(`No dashboard shell is shown ${reason}`, (page) =>
+          page.locator(".shell").count(),
+        ),
+      ).toBe(0);
+      return (yield* setupPath) as string;
+    });
+  /**
+   * Leaving setup for account settings in the session menu, then following its way back to the
+   * team, returns to `step` within the page. The router asks before showing the dashboard, so the
+   * account page stays until the step replaces it: no dashboard page or frame appears, and the
+   * Apps address, which the router enters as it starts, is replaced rather than kept in history.
+   */
+  const accountSettingsReturnTo = (name: string, step: RegExp) =>
+    Effect.gen(function* () {
+      yield* browser.use("Open the session menu on setup", (page) =>
+        page.getByRole("button", { name: /^Account: / }).click(),
+      );
+      yield* browser.use("Open account settings", (page) =>
+        page.getByRole("menuitem", { name: "Account settings", exact: true }).click(),
+      );
+      yield* browser.use("Account settings open", (page) =>
+        page.waitForURL((url) => url.pathname === "/account/profile"),
+      );
+      yield* browser.use("Watch for the dashboard on the way back", (page) =>
+        page.evaluate(() => {
+          const flagged = () => {
+            if (
+              document.querySelector("h1")?.textContent?.trim() === "Apps" ||
+              document.querySelector("a[href$='/approvals']") !== null
+            )
+              document.documentElement.dataset.dashboardShown = "true";
+          };
+          new MutationObserver(flagged).observe(document.body, {
+            childList: true,
+            subtree: true,
+            characterData: true,
+          });
+          document.documentElement.dataset.sameDocument = "true";
+        }),
+      );
+      yield* browser.use(`Follow the way back to ${name}`, (page) =>
+        page.getByRole("link", { name: `Back to ${name}`, exact: true }).click(),
+      );
+      yield* browser.use("The way back returns to setup", (page) =>
+        page.waitForURL((url) => step.test(url.pathname)),
+      );
+      expect(
+        yield* browser.use("The dashboard never showed on the way back", (page) =>
+          page.evaluate(() => ({
+            sameDocument: document.documentElement.dataset.sameDocument === "true",
+            dashboardShown: document.documentElement.dataset.dashboardShown === "true",
+          })),
+        ),
+      ).toEqual({ sameDocument: true, dashboardShown: false });
+      yield* browser.use("Back from setup", (page) => page.goBack());
+      yield* browser.use("Back returns to account settings, not Apps", (page) =>
+        page.waitForURL((url) => url.pathname === "/account/profile"),
+      );
+      yield* browser.use("Forward to setup again", (page) => page.goForward());
+      yield* browser.use("Forward returns to setup", (page) =>
+        page.waitForURL((url) => step.test(url.pathname)),
+      );
+    });
+  /** The required step at the desktop and phone sizes: it fits a phone with its hint shown. */
+  const atBothSizes = (name: string, section: string) =>
+    Effect.gen(function* () {
+      yield* browser.use("Use the desktop layout", (page) => page.setViewportSize(desktop));
+      yield* browser.checkpoint(`${name} 1440x960`);
+      yield* browser.use("Use a phone layout", (page) => page.setViewportSize(phone));
+      yield* fitsPhone(name, section);
+      yield* browser.checkpoint(`${name} 390x844`);
+      yield* browser.use("Return to the desktop layout", (page) => page.setViewportSize(desktop));
+    });
+  /** Connect one Synthetic Mail account from the account step's catalog and name it. */
+  const connectMail = (label: string) =>
+    Effect.gen(function* () {
+      yield* browser.use("The catalog has loaded", (page) =>
+        page.locator("[aria-label='Loading apps']").waitFor({ state: "detached" }),
+      );
+      yield* browser.use("Connect Synthetic Mail", (page) =>
+        page
+          .getByRole("group", { name: "Synthetic Mail", exact: true })
+          .getByRole("button", { name: "Connect" })
+          .click(),
+      );
+      yield* browser.use("The app's connection form opens", (page) =>
+        page.getByRole("dialog", { name: "Connect Synthetic Mail" }).waitFor(),
+      );
+      yield* browser.use("Save and name the account", (page) =>
+        page
+          .getByRole("dialog")
+          .getByRole("textbox")
+          .first()
+          .fill("synthetic-onboarding-mail")
+          .then(() =>
+            page.getByRole("dialog").getByRole("button", { name: "Connect account" }).click(),
+          )
+          .then(() => nameConnectedAccount(page, label)),
+      );
+    });
   return {
     sessionUserId,
+    /**
+     * Create the team as a member whose setup is required, then complete it in `order`. Neither
+     * step offers to skip: each forward button waits, disabled and reading its hint, until its step is
+     * done, and becomes the primary action in the same box without moving anything. Until both are
+     * done the team's Apps sends the member to their current step, as a document request and from
+     * within the page; finishing opens the dashboard for good.
+     */
+    requiredSetup: (name: string, order: OnboardingOrder) =>
+      Effect.gen(function* () {
+        yield* allowClipboard;
+        yield* browser.use("Confirm team creation", (page) =>
+          page.getByRole("button", { name: "Continue", exact: true }).click(),
+        );
+        yield* browser.use("Team creation opens a setup step", (page) =>
+          page.waitForURL(
+            (url) =>
+              url.origin === targetHosts(target).browser &&
+              /^\/org\/[^/]+\/setup\/(accounts|assistant)$/u.test(url.pathname),
+          ),
+        );
+        const teams = yield* organizations;
+        const team = teams[0];
+        if (teams.length !== 1 || team === undefined || team.name !== name)
+          return yield* new OnboardingFailed({
+            operation: "Confirmation must create exactly the chosen team",
+          });
+        const setup = `/org/${team.slug}/setup`;
+        const accountsStep = new RegExp(`^${setup}/accounts$`, "u");
+        const assistantStep = new RegExp(`^${setup}/assistant$`, "u");
+        const accountsHint = "Connect an account to continue";
+        const assistantHint = "Connect your assistant to continue";
+        const continueAccounts = "Continue with 1 account";
+        const label = order === "assistant_first" ? "Assistant first" : "Accounts first";
+        /** Connect one account on the account step: the button opens in place, nothing moves. */
+        const completeAccounts = Effect.gen(function* () {
+          const catalogLoaded = browser.use("The catalog has loaded", (page) =>
+            page.locator("[aria-label='Loading apps']").waitFor({ state: "detached" }),
+          );
+          yield* heading("Connect your accounts");
+          yield* catalogLoaded;
+          yield* waitsFor(continueAccounts, accountsHint, "before an account connects");
+          yield* atBothSizes(`Required ${label}: Connect your accounts`, "accounts-setup-title");
+          // A fresh document, so the shifts observed are this step's own, not the resizes'.
+          yield* browser.use("Reload the account step", (page) => page.reload());
+          yield* heading("Connect your accounts");
+          yield* catalogLoaded;
+          const shifts = yield* observeLayoutShifts;
+          yield* shifts.phase("Connect an account");
+          yield* waitsFor(continueAccounts, accountsHint, "after a reload");
+          const waiting = yield* forwardControlBox(accountsHint);
+          yield* connectMail("Work mail");
+          yield* opensWith(continueAccounts, accountsHint, "once an account connects");
+          expect(yield* forwardControlBox(continueAccounts)).toEqual(waiting);
+          yield* noLayoutShifts(shifts, "required-account-step-shifts.json");
+          yield* browser.checkpoint(`Required ${label}: Continue opens once an account connects`);
+          yield* browser.use("Continue from the account step", (page) =>
+            page.getByRole("link", { name: continueAccounts, exact: true }).click(),
+          );
+        });
+        /**
+         * Choose Claude and come back with "Different assistant", then connect Claude: the button
+         * waits on the assistants and the guide alike and opens in place once Claude connects.
+         */
+        const completeAssistant = (next: string) =>
+          Effect.gen(function* () {
+            yield* heading("Connect your assistant");
+            yield* waitsFor(next, assistantHint, "on the assistants");
+            yield* atBothSizes(`Required ${label}: Connect your assistant`, "agent-setup-title");
+            yield* browser.use("Choose Claude", (page) =>
+              page.getByRole("button", { name: "Claude", exact: true }).click(),
+            );
+            yield* browser.use("Setup waits for Claude", (page) =>
+              page.getByText("Waiting for Claude to connect…", { exact: true }).waitFor(),
+            );
+            yield* waitsFor(next, assistantHint, "on Claude's guide");
+            yield* browser.use("Go back to a different assistant", (page) =>
+              page.getByRole("link", { name: "Different assistant", exact: true }).click(),
+            );
+            yield* browser.use("The assistants are offered again", (page) =>
+              page.getByRole("group", { name: "Choose your assistant", exact: true }).waitFor(),
+            );
+            yield* waitsFor(next, assistantHint, "back on the assistants");
+            yield* browser.use("Choose Claude again", (page) =>
+              page.getByRole("button", { name: "Claude", exact: true }).click(),
+            );
+            yield* browser.use("Setup waits for Claude again", (page) =>
+              page.getByText("Waiting for Claude to connect…", { exact: true }).waitFor(),
+            );
+            yield* atBothSizes(`Required ${label}: Claude's guide waits`, "agent-setup-title");
+            // The guide keeps its baseline through a reload, in the entry's history state.
+            yield* browser.use("Reload Claude's guide", (page) => page.reload());
+            yield* browser.use("Claude's guide waits after a reload", (page) =>
+              page.getByText("Waiting for Claude to connect…", { exact: true }).waitFor(),
+            );
+            const shifts = yield* observeLayoutShifts;
+            yield* shifts.phase("Connect Claude");
+            yield* waitsFor(next, assistantHint, "while Claude's guide waits");
+            const waiting = yield* forwardControlBox(assistantHint);
+            yield* authorizeAssistant("Onboarding assistant");
+            yield* browser.use("Claude is connected", (page) =>
+              approvedFor(page, "Onboarding assistant").waitFor(),
+            );
+            yield* opensWith(next, assistantHint, "once Claude connects");
+            expect(yield* forwardControlBox(next)).toEqual(waiting);
+            yield* noLayoutShifts(shifts, "required-guide-shifts.json");
+            yield* browser.checkpoint(`Required ${label}: Next opens once Claude connects`);
+            yield* browser.use(`Continue with ${next}`, (page) =>
+              page.getByRole("link", { name: next, exact: true }).click(),
+            );
+          });
+
+        if (order === "accounts_first") {
+          expect(yield* setupPath).toBe(`${setup}/accounts`);
+          yield* heading("Connect your accounts");
+          yield* appsSendsTo(team.slug, accountsStep, "before any step is done");
+          yield* browser.checkpoint(`Required ${label}: Apps returns to the account step`);
+          yield* accountSettingsReturnTo(name, accountsStep);
+          yield* completeAccounts;
+          yield* browser.use("Continue opens the assistants", (page) =>
+            page.waitForURL((url) => assistantStep.test(url.pathname) && url.search === ""),
+          );
+          yield* heading("Connect your assistant");
+          yield* appsSendsTo(team.slug, assistantStep, "with an account and no assistant");
+          yield* browser.checkpoint(`Required ${label}: Apps returns to the assistant step`);
+          yield* completeAssistant("Next: first prompt");
+          yield* promptShown("Onboarding assistant", "after a required setup");
+        } else {
+          expect(yield* setupPath).toBe(`${setup}/assistant`);
+          yield* heading("Connect your assistant");
+          yield* appsSendsTo(team.slug, assistantStep, "before any step is done");
+          yield* browser.checkpoint(`Required ${label}: Apps returns to the assistant step`);
+          yield* accountSettingsReturnTo(name, assistantStep);
+          yield* completeAssistant("Next: connect accounts");
+          yield* browser.use("Next opens the account step with the agent", (page) =>
+            page.waitForURL((url) => accountsStep.test(url.pathname) && url.search !== ""),
+          );
+          yield* heading("Connect your accounts");
+          // The server names the agent connected, so the first prompt can still confirm it.
+          const returned = yield* appsSendsTo(
+            team.slug,
+            accountsStep,
+            "with an assistant and no account",
+          );
+          expect(returned).toMatch(
+            new RegExp(`^${setup}/accounts\\?assistant=other&agent=[^&]+$`, "u"),
+          );
+          yield* browser.checkpoint(`Required ${label}: Apps returns to the account step`);
+          // A new visit to the assistant step, as in a new tab, finds Claude done and moves on.
+          yield* browser.use("Open the assistant step in a new visit", (page) =>
+            page.goto(`${setup}/assistant`),
+          );
+          yield* heading("Connect your assistant");
+          yield* opensWith(
+            "Next: connect accounts",
+            assistantHint,
+            "in a new visit once Claude is connected",
+          );
+          yield* browser.use("Return to the account step", (page) => page.goto(returned));
+          yield* completeAccounts;
+          yield* browser.use("The first prompt is shown", (page) =>
+            page.getByRole("button", { name: "Copy starter prompt", exact: true }).waitFor(),
+          );
+          yield* browser.use("The first prompt confirms the agent", (page) =>
+            approvedFor(page, "Onboarding assistant").waitFor(),
+          );
+        }
+        expect(
+          yield* browser.use("The first prompt names the connected account", (page) =>
+            page.getByText(/I've connected Synthetic Mail \(Work mail\)\./u).count(),
+          ),
+        ).toBe(1);
+        yield* browser.use("Open the dashboard", (page) =>
+          page.getByRole("link", { name: "Open dashboard", exact: true }).click(),
+        );
+        yield* browser.use("Setup ends at the team's Apps", (page) =>
+          page.waitForURL(`${targetHosts(target).browser}/org/${team.slug}/apps`),
+        );
+        yield* browser.use("The dashboard is open", (page) =>
+          page.getByRole("button", { name: "Add app", exact: true }).first().waitFor(),
+        );
+        // Finished for good: the server serves Apps itself, and a reload keeps it.
+        expect(
+          yield* browser.use("Request the team's Apps after setup", (page) =>
+            page.request
+              .get(`/org/${team.slug}/apps`, { maxRedirects: 0 })
+              .then((response) => response.status()),
+          ),
+        ).toBe(200);
+        yield* browser.use("Reload the team's Apps", (page) => page.reload());
+        yield* browser.use("Apps stays open after a reload", (page) =>
+          page.getByRole("button", { name: "Add app", exact: true }).first().waitFor(),
+        );
+        expect(yield* setupPath).toBe(`/org/${team.slug}/apps`);
+        yield* browser.checkpoint(`Required ${label}: the dashboard opens after setup`);
+        return team;
+      }),
     /**
      * Create the team, then complete setup in the order the onboarding experiment assigned: the
      * first step renders straight after creation, reloads keep the order, the assistant's agent
@@ -1282,7 +1667,7 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         );
         yield* browser.use("The confirmed team stays open", (page) =>
           page
-            .getByRole("link", { name: "Add app", exact: true })
+            .getByRole("button", { name: "Add app", exact: true })
             .first()
             .waitFor({ state: "visible" }),
         );
diff --git a/e2e/support/openapi-error-upstream.ts b/e2e/support/openapi-error-upstream.ts
index 7e8ef64b4f..92a45cb356 100644
--- a/e2e/support/openapi-error-upstream.ts
+++ b/e2e/support/openapi-error-upstream.ts
@@ -21,6 +21,10 @@ export const openapiConflictRecovery = {
 };
 /** A declared 403 body; a bare status alone would not explain the refusal. */
 export const openapiDeniedMessage = "This workspace does not allow exports by members.";
+/** A declared 401 body, the service's own explanation of a refused credential. */
+export const openapiSessionMessage = "The session for this workspace has ended.";
+/** A Bearer challenge's stated error, which takes precedence over a declared body. */
+export const openapiChallengeMessage = "The access token expired.";
 /** A reason-specific response from an error schema with no static description. */
 export const openapiOAuthMessage = "We could not register an OAuth client for this connection.";
 /** A declared conflict a bulk write meets after saving part of its records. */
@@ -69,6 +73,10 @@ export const openapiErrorUpstream = (memorySchema: unknown, oauthSchema: unknown
               identifier: "ExportDenied",
               httpApiStatus: 403,
             }),
+            Schema.TaggedStruct("SessionExpired", { message: Schema.String }).annotate({
+              identifier: "SessionExpired",
+              httpApiStatus: 401,
+            }),
           ],
         }).annotate(OpenApi.Identifier, "fail"),
       ),
@@ -352,6 +360,23 @@ export const openapiErrorUpstream = (memorySchema: unknown, oauthSchema: unknown
                 headers: mode === "declared-limited" ? { "x-ratelimit-remaining": "0" } : {},
               },
             );
+          if (mode === "declared-unauthorized")
+            return yield* HttpServerResponse.json(
+              { _tag: "SessionExpired", message: openapiSessionMessage },
+              { status: 401 },
+            );
+          // A Bearer challenge already states the error; its declared body never finishes.
+          if (mode === "challenged-stalled")
+            return HttpServerResponse.stream(
+              Stream.concat(Stream.make(new TextEncoder().encode("{")), Stream.never),
+              {
+                status: 401,
+                contentType: "application/json",
+                headers: {
+                  "www-authenticate": `Bearer error="invalid_token", error_description="${openapiChallengeMessage}"`,
+                },
+              },
+            );
           if (mode === "missing-message")
             return yield* HttpServerResponse.json(
               { _tag: "BuildMemoryExceeded", recovery: openapiMemoryRecovery },
diff --git a/e2e/support/openapi-import.ts b/e2e/support/openapi-import.ts
index 1d7ed5bf0b..7b2f4d1fca 100644
--- a/e2e/support/openapi-import.ts
+++ b/e2e/support/openapi-import.ts
@@ -289,6 +289,166 @@ export const credentialEchoUpstream = Effect.gen(function* () {
   return { origin: `http://127.0.0.1:${server.address.port}` };
 });
 
+/** An API that answers every request with its method, path with query, Accept header and body. */
+export const requestEchoUpstream = Effect.gen(function* () {
+  const services = yield* Layer.build(
+    HttpRouter.serve(
+      HttpRouter.add(
+        "*",
+        "/*",
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          return yield* HttpServerResponse.json({
+            method: request.method,
+            url: request.url,
+            accept: request.headers.accept ?? null,
+            body: yield* request.text,
+          });
+        }),
+      ),
+      { disableLogger: true, disableListenLog: true },
+    ).pipe(Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }))),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return { origin: `http://127.0.0.1:${server.address.port}` };
+});
+
+/**
+ * Shapes Executor v1 imported that the OpenAPI specification forbids or leaves unclear: schema
+ * references to a component whose name is not URI-encoded, into another component's properties,
+ * into an operation under `paths` and into a Parameter Object; a request body whose schema is
+ * another operation's; an operation that can answer with an event stream or JSON; paths that
+ * carry a fixed query or a fragment; an operationId left empty; a parameter in `body`, which
+ * OpenAPI 3 does not have; and a request body without media types.
+ */
+export const v1Document = (origin: string) => {
+  const json = (schema: unknown) => ({ "application/json": { schema } });
+  const ok = { "200": { description: "OK", content: json({ type: "object" }) } };
+  const page = "Page`1[[Item, Lib, Version=1.0.0]]";
+  return {
+    openapi: "3.0.3",
+    info: { title: "v1 shapes", version: "1" },
+    servers: [{ url: origin }],
+    components: {
+      schemas: {
+        [page]: {
+          type: "object",
+          properties: { items: { type: "array", items: { $ref: "#/components/schemas/Item" } } },
+        },
+        Item: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            owner: {
+              type: "object",
+              properties: { name: { type: "string" } },
+              required: ["name"],
+              additionalProperties: false,
+            },
+          },
+          required: ["id"],
+        },
+      },
+      parameters: {
+        Limit: { name: "limit", in: "query", schema: { type: "integer", minimum: 1 } },
+        Legacy: { name: "payload", in: "body", schema: { type: "object" } },
+      },
+      responses: {
+        Created: {
+          description: "Created",
+          content: json({ type: "object", properties: { created: { type: "boolean" } } }),
+        },
+      },
+    },
+    paths: {
+      "/items": {
+        post: {
+          operationId: "createItem",
+          requestBody: {
+            required: true,
+            content: json({
+              type: "object",
+              properties: { owner: { $ref: "#/components/schemas/Item/properties/owner" } },
+              required: ["owner"],
+              additionalProperties: false,
+            }),
+          },
+          responses: {
+            "200": { description: "OK", content: json({ $ref: `#/components/schemas/${page}` }) },
+          },
+        },
+      },
+      "/items/copy": {
+        post: {
+          operationId: "copyItem",
+          parameters: [
+            { name: "max", in: "query", schema: { $ref: "#/components/parameters/Limit/schema" } },
+          ],
+          requestBody: {
+            required: true,
+            content: json({
+              $ref: "#/paths/~1items/post/requestBody/content/application~1json/schema",
+            }),
+          },
+          responses: { "200": { $ref: "#/components/responses/Created" } },
+        },
+      },
+      "/items/stream": {
+        get: {
+          operationId: "streamItems",
+          responses: {
+            "200": {
+              description: "Events, or the items at once",
+              content: {
+                "text/event-stream": { schema: { type: "string" } },
+                ...json({ type: "object" }),
+              },
+            },
+          },
+        },
+      },
+      // Only an event stream, which a tool still cannot return.
+      "/items/events": {
+        get: {
+          operationId: "watchItems",
+          responses: {
+            "200": { description: "Events", content: { "text/event-stream": {} } },
+          },
+        },
+      },
+      "/search?type=items": {
+        get: {
+          operationId: "searchItems",
+          parameters: [{ name: "q", in: "query", schema: { type: "string" } }],
+          responses: ok,
+        },
+      },
+      "/items/{id}?view=full": {
+        get: {
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: ok,
+        },
+      },
+      // Two paths told apart only by their fragments, as some documents name one path's hosts.
+      "/docs#latest": { get: { operationId: "readDocs", responses: ok } },
+      "/docs#archive": { get: { operationId: "readDocs", responses: ok } },
+      "/legacy": {
+        post: {
+          operationId: null,
+          tags: ["legacy"],
+          parameters: [
+            { $ref: "#/components/parameters/Legacy" },
+            { name: "q", in: "query", schema: { type: "string" } },
+          ],
+          requestBody: { content: {} },
+          responses: ok,
+        },
+      },
+    },
+  };
+};
+
 /** Deploy an app with the given `index.ts`; it is deleted when the scenario ends. */
 export const deployPublicApp = (index: string) =>
   Effect.gen(function* () {
diff --git a/e2e/support/otlp-collector.ts b/e2e/support/otlp-collector.ts
index db1b1493c2..90d9e4660a 100644
--- a/e2e/support/otlp-collector.ts
+++ b/e2e/support/otlp-collector.ts
@@ -24,9 +24,15 @@ const Listening = Schema.Struct({
 /**
  * Serve one Motel from the bundle `e2e:prepare` built, storing its data in `diagnostics/<name>`
  * and its output in `<name>.log`. Every target in a run serves the same bundle directory, and a
- * build replaces it, so nothing in a run builds it.
+ * build replaces it, so nothing in a run builds it. `bounds` replaces the values of the bundle's
+ * own `MOTEL_OTEL_*` settings in a copy of its config, beside a copy of its worker.
  */
-const serveMotel = (directory: string, name: string, log: string) =>
+const serveMotel = (
+  directory: string,
+  name: string,
+  log: string,
+  bounds: Readonly<Record<string, string>> = {},
+) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -36,6 +42,22 @@ const serveMotel = (directory: string, name: string, log: string) =>
     const bundle = path.resolve("packages/telemetry/dist/motel");
     if (!(yield* fs.exists(path.join(bundle, "motel.capnp"))))
       return yield* Effect.die("Run bun run e2e:prepare to build the telemetry collector first.");
+    let config = path.join(bundle, "motel.capnp");
+    if (Object.keys(bounds).length > 0) {
+      let text = yield* fs.readFileString(config);
+      for (const [setting, value] of Object.entries(bounds)) {
+        const binding = `(name="${setting}",text="`;
+        if (!text.includes(binding))
+          return yield* Effect.die(`The collector's config has no ${setting} setting.`);
+        text = text.replace(
+          new RegExp(`\\(name="${setting}",text="[^"]*"\\)`),
+          `${binding}${value}")`,
+        );
+      }
+      config = path.join(directory, `${name}.capnp`);
+      yield* fs.writeFileString(config, text, { mode: 0o600 });
+      yield* fs.copyFile(path.join(bundle, "motel.mjs"), path.join(directory, "motel.mjs"));
+    }
     // The bundle's config names its directories and socket; this supplies their paths and a free port.
     const child = yield* processes.spawn(
       ChildProcess.make(
@@ -46,7 +68,7 @@ const serveMotel = (directory: string, name: string, log: string) =>
           `--directory-path=motel-data=${data}`,
           `--directory-path=motel-assets=${path.join(bundle, "web/dist")}`,
           "--socket-addr=motel=127.0.0.1:0",
-          path.join(bundle, "motel.capnp"),
+          config,
         ],
         {
           cwd: data,
@@ -97,10 +119,13 @@ const announce = (directory: string, url: string) =>
     );
   });
 
-/** One Motel, as a scenario that owns its own collector uses it. */
-export const serveOtlpCollector = (directory: string) =>
+/** One Motel, as a scenario that owns its own collector uses it, with any `bounds` it sets. */
+export const serveOtlpCollector = (
+  directory: string,
+  bounds: Readonly<Record<string, string>> = {},
+) =>
   Effect.gen(function* () {
-    const url = yield* serveMotel(directory, "motel", "collector.log");
+    const url = yield* serveMotel(directory, "motel", "collector.log", bounds);
     yield* announce(directory, url);
     return url;
   });
diff --git a/e2e/support/pipe-readers.ts b/e2e/support/pipe-readers.ts
new file mode 100644
index 0000000000..eb8e1bbaf7
--- /dev/null
+++ b/e2e/support/pipe-readers.ts
@@ -0,0 +1,252 @@
+/**
+ * Readers that misbehave the way real ones do: one that closes the pipe early, as `head -c` does,
+ * one that stops reading while the command still has output to write, and one that goes away
+ * while a server keeps running.
+ *
+ * Each runs as a Node program that starts the command itself, since only the process holding a
+ * pipe's ends can close or stall it, and prints what it saw as JSON.
+ */
+import { Effect, FileSystem, Path, Schema, Stream } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+/** What the reader does with the command's output. */
+export type Reader =
+  /** Read at least `bytes` of stdout, then close the pipe. */
+  | { readonly mode: "head"; readonly bytes: number }
+  /**
+   * Give the command a stderr pipe already full and never read. Read stdout until the server
+   * prints its connection link, which it prints only after logging its startup on stderr, and wait
+   * until the server at `origin` is ready, then stop it.
+   */
+  | { readonly mode: "stalled"; readonly origin: string }
+  /**
+   * Read stdout until the server prints its connection link and is ready at `origin`, or without
+   * one at the `Executor:` origin it prints, then close the `stream` pipe and create the `gate`
+   * file, if any. After `holdMs`, in which the server writes that stream again, check that it
+   * is still ready, stop it and check that its origin then refuses connections.
+   */
+  | {
+      readonly mode: "late";
+      readonly origin?: string;
+      readonly stream: "stdout" | "stderr";
+      readonly gate?: string;
+      readonly holdMs: number;
+    };
+
+/**
+ * A server is stopped with SIGTERM, except on Windows, where a signal ends a process at once and
+ * skips its shutdown; there the reader writes to the private fd3 pipe, which `e2e-process.ts`
+ * turns into the SIGTERM event the product listens for. `late` always uses that pipe, so it stops
+ * the server the same way on every platform.
+ */
+const reader = `import { spawn } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { connect } from "node:net";
+const [spec, command, ...args] = process.argv.slice(2);
+const reader = JSON.parse(spec);
+const report = (fields) => console.log(JSON.stringify(fields));
+const wait = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+if (reader.mode === "head") {
+  const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+  let read = 0, closedAt, stderr = "";
+  child.stderr.setEncoding("utf8").on("data", (text) => (stderr += text));
+  child.stdout.on("data", (chunk) => {
+    read += chunk.length;
+    if (read < reader.bytes || closedAt !== undefined) return;
+    closedAt = performance.now();
+    child.stdout.destroy();
+  });
+  child.on("close", (code, signal) =>
+    report({ code, signal, read, stderr, millisecondsAfterClose: performance.now() - (closedAt ?? NaN) }),
+  );
+} else {
+  let child, stderr = "", signalledAt, hung, reported = false, answeredAfterClose, refusedAfterExit;
+  let pipeFullAtSignal;
+  let origin = reader.origin;
+  // What the report waits for once the command exits.
+  let afterExit = Promise.resolve();
+  const cleanup = [];
+  const start = (output) => {
+    child = spawn(command, args, {
+      stdio: ["ignore", "pipe", output, "pipe"],
+      env: { ...process.env, EXECUTOR_TEST_STOP_FD: "3" },
+    });
+    child.stderr?.setEncoding("utf8").on("data", (text) => (stderr += text));
+    // A request to a server that has already exited fails; its exit is what gets reported.
+    child.stdio[3].on("error", () => {});
+    child.on("exit", (code, signal) => {
+      const exitedAt = performance.now();
+      clearTimeout(hung);
+      for (const other of cleanup) other.kill("SIGKILL");
+      // A process the command left running can hold stderr open, so stop waiting for it soon.
+      const done = () => {
+        if (reported) return;
+        reported = true;
+        for (const pipe of [child.stdout, child.stderr, child.stdio[3]]) pipe?.destroy();
+        afterExit.then(() =>
+          report({
+            code,
+            signal,
+            stderr,
+            answeredAfterClose,
+            refusedAfterExit,
+            pipeFullAtSignal,
+            millisecondsAfterSignal: exitedAt - (signalledAt ?? NaN),
+          }),
+        );
+      };
+      const settled = setTimeout(done, 2_000);
+      (child.stderr ?? child.stdout).on("close", () => (clearTimeout(settled), done()));
+    });
+  };
+  const request = () => child.stdio[3].write("stop");
+  const running = () => child.exitCode === null && child.signalCode === null;
+  const stop = (how) => {
+    if (!running()) return;
+    signalledAt = performance.now();
+    how();
+    hung = setTimeout(() => child.kill("SIGKILL"), 20_000);
+  };
+  // A starting server answers 503 until its product is composed; only a ready one answers 200.
+  // A request the starting server accepted may never be answered.
+  const isReady = () =>
+    fetch(new URL("/api/service", origin), { signal: AbortSignal.timeout(2_000) }).then(
+      async (response) => response.status === 200 && (await response.json()).status === "ready",
+      () => false,
+    );
+  // Only a refused connection shows that nothing listens; a listener that accepts and never
+  // answers is still there.
+  const refuses = () =>
+    new Promise((resolve) => {
+      const { hostname, port } = new URL(origin);
+      const socket = connect({ host: hostname, port: Number(port) });
+      const settle = (refused) => {
+        socket.destroy();
+        resolve(refused);
+      };
+      socket.setTimeout(2_000, () => settle(false));
+      socket.once("connect", () => settle(false));
+      socket.once("error", (error) => settle(error.code === "ECONNREFUSED"));
+    });
+  const deadline = Date.now() + 120_000;
+  const ready = async () => {
+    while (running() && Date.now() < deadline) {
+      if (await isReady()) return true;
+      await wait(200);
+    }
+    return false;
+  };
+  // Resolves once the server prints its connection link; without an origin, the server's is known
+  // only then.
+  const linked = () => {
+    let printed = "";
+    return new Promise((resolve) =>
+      child.stdout.setEncoding("utf8").on("data", (text) => {
+        printed += text;
+        origin ??= /^Executor: (\\S+)$/mu.exec(printed)?.[1];
+        if (/#pair=/u.test(printed)) resolve();
+      }),
+    );
+  };
+  if (reader.mode === "stalled") {
+    // One process holds the pipe's read end and never reads; another fills the pipe and waits
+    // there while it is full, so none of the command's writes to it can complete. This program
+    // never writes to the pipe, since a command that makes it blocking would block this program too.
+    const idle = ["-e", "setInterval(() => {}, 1 << 30)"];
+    const holder = spawn(process.execPath, idle, { stdio: ["pipe", "ignore", "ignore"] });
+    const filler = spawn(process.execPath, ["-e", "process.stdout.write(Buffer.alloc(1 << 20))"], {
+      stdio: ["ignore", holder.stdin, "ignore"],
+    });
+    cleanup.push(holder, filler);
+    filler.on("spawn", () => {
+      start(holder.stdin);
+      linked()
+        .then(ready)
+        .then((answered) => {
+          if (!answered) return child.kill("SIGKILL");
+          // The filler is still waiting to write, so the pipe is still full.
+          pipeFullAtSignal = filler.exitCode === null && filler.signalCode === null;
+          stop(process.platform === "win32" ? request : () => child.kill("SIGTERM"));
+        });
+    });
+  } else {
+    start("pipe");
+    linked()
+      .then(ready)
+      .then(async (answered) => {
+        if (!answered) return child.kill("SIGKILL");
+        child[reader.stream].destroy();
+        if (reader.gate !== undefined) writeFileSync(reader.gate, "");
+        await wait(reader.holdMs);
+        answeredAfterClose = running() && (await isReady());
+        // A server in another process, as \`--standalone\` runs, stops with the command: its
+        // origin refuses connections within 15 seconds of the command's exit.
+        if (running())
+          afterExit = new Promise((resolve) => child.once("exit", resolve)).then(async () => {
+            const until = Date.now() + 15_000;
+            while (Date.now() < until) {
+              if (await refuses()) return void (refusedAfterExit = true);
+              await wait(200);
+            }
+            refusedAfterExit = false;
+          });
+        stop(request);
+      });
+  }
+}
+`;
+
+const Observed = Schema.fromJsonString(
+  Schema.Struct({
+    code: Schema.NullOr(Schema.Number),
+    signal: Schema.NullOr(Schema.String),
+    stderr: Schema.String,
+    read: Schema.optional(Schema.Number),
+    millisecondsAfterClose: Schema.optional(Schema.NullOr(Schema.Number)),
+    millisecondsAfterSignal: Schema.optional(Schema.NullOr(Schema.Number)),
+    answeredAfterClose: Schema.optional(Schema.Boolean),
+    refusedAfterExit: Schema.optional(Schema.Boolean),
+    pipeFullAtSignal: Schema.optional(Schema.Boolean),
+  }),
+);
+
+/** Run the command under one of the readers, with this environment, and return what it saw. */
+export const throughPipe = (
+  spec: Reader,
+  command: { readonly command: string; readonly args: ReadonlyArray<string> },
+  env: Readonly<Record<string, string>>,
+) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem,
+        path = yield* Path.Path,
+        processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const directory = yield* fs.makeTempDirectoryScoped({ prefix: "executor-pipe-reader-" });
+      const script = path.join(directory, "reader.mjs");
+      yield* fs.writeFileString(script, reader);
+      const child = yield* processes.spawn(
+        ChildProcess.make(
+          "node",
+          [script, JSON.stringify(spec), command.command, ...command.args],
+          {
+            extendEnv: false,
+            env: { PATH: process.env.PATH ?? "", ...env },
+            stdout: "pipe",
+            stderr: "pipe",
+            forceKillAfter: "3 seconds",
+          },
+        ),
+      );
+      const [, printed, failed] = yield* Effect.all(
+        [
+          child.exitCode,
+          child.stdout.pipe(Stream.decodeText(), Stream.mkString),
+          child.stderr.pipe(Stream.decodeText(), Stream.mkString),
+        ],
+        { concurrency: 3 },
+      ).pipe(Effect.timeout("3 minutes"));
+      return yield* Schema.decodeUnknownEffect(Observed)(printed).pipe(
+        Effect.catch(() => Effect.die(`The pipe reader printed no result: ${failed}`)),
+      );
+    }),
+  );
diff --git a/e2e/support/ports.ts b/e2e/support/ports.ts
index 3633d0a0e1..4c8e2f45b9 100644
--- a/e2e/support/ports.ts
+++ b/e2e/support/ports.ts
@@ -1,6 +1,6 @@
 /** Scoped loopback listeners for isolated ports and real bind-conflict fixtures. */
 import { connect, createServer, type Socket } from "node:net";
-import { Effect } from "effect";
+import { Effect, Option, Random } from "effect";
 import { driver } from "./platform.ts";
 
 /**
@@ -28,8 +28,23 @@ export const holdPort = (port: number, onConnection?: (socket: Socket) => void)
     );
   });
 
-/** Ask the OS for an available port and release it before returning. */
-export const freePort = Effect.scoped(holdPort(0));
+/**
+ * Where `freePort` looks: below the ephemeral ranges of Linux (32768-60999), macOS and Windows
+ * (49152-65535). The OS hands ephemeral ports to every socket that binds port zero or connects
+ * out, so a port it chose and this run released can go to another socket, such as one of the
+ * loopback connections a starting Cloud makes by the thousand, before the server it was meant
+ * for binds it. Only explicit binds take ports in this range.
+ */
+const isolatedPorts = { from: 20_000, to: 32_767 } as const;
+
+/** A loopback port that is free now and that the OS will not hand out, released before returning. */
+export const freePort = Effect.gen(function* () {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const port = yield* Random.nextIntBetween(isolatedPorts.from, isolatedPorts.to);
+    if (Option.isSome(yield* Effect.option(Effect.scoped(holdPort(port))))) return port;
+  }
+  return yield* Effect.die(new Error("No free loopback port outside the ephemeral range"));
+});
 
 /**
  * A loopback port that refuses connections until the owning scope closes. A port released by
@@ -55,3 +70,16 @@ export const refusingPort = Effect.gen(function* () {
   if (port === undefined) return yield* Effect.die("The reserved socket has no local port");
   return port;
 });
+
+/** Whether a loopback connection to `port` is refused, the only sign that nothing listens there. */
+export const connectionRefused = (port: number) =>
+  Effect.callback<boolean>((resume) => {
+    const socket = connect({ host: "127.0.0.1", port });
+    const settle = (refused: boolean) => {
+      socket.destroy();
+      resume(Effect.succeed(refused));
+    };
+    socket.once("connect", () => settle(false));
+    socket.once("error", (error) => settle("code" in error && error.code === "ECONNREFUSED"));
+    return Effect.sync(() => socket.destroy());
+  });
diff --git a/e2e/support/registry-upstream.ts b/e2e/support/registry-upstream.ts
index a48a2dd64a..a61215a6cf 100644
--- a/e2e/support/registry-upstream.ts
+++ b/e2e/support/registry-upstream.ts
@@ -1,9 +1,15 @@
-/** A synthetic public app registry. Each requested name selects one response the product must classify. */
+/**
+ * A synthetic public app registry. It answers a name with the listings published under exactly that
+ * name, and fixed names select responses the product must classify. Like Cloud's registry, it
+ * serves a listing's source only for the commit the listing selects now.
+ */
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { Deferred, Effect, Exit, Layer, Option, Ref, Scope } from "effect";
 import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { createServer } from "node:http";
+import { withApps } from "./apps-release.ts";
 
+/** A listing of an older or custom registry: its name has no dot in its scope. */
 export const registryPublication = {
   name: "@fixture/example",
   commit: "a".repeat(40),
@@ -11,6 +17,52 @@ export const registryPublication = {
   publishedAt: "2026-01-01T00:00:00.000Z",
 };
 
+/** A listing in an organization's publishing scope. Clients released before scopes read `@scoped/notes`. */
+export const registryScopedListing = {
+  name: "@scoped.executor.community/notes",
+  commit: "b".repeat(40),
+  description: "Notes in a publishing scope",
+  publishedAt: "2026-01-02T00:00:00.000Z",
+};
+/** Two listings that clients released before publisher scopes would both read as `@twin/notes`. */
+export const registryTwinListings = [
+  {
+    name: "@twin/notes",
+    commit: "c".repeat(40),
+    description: "Notes without a publishing scope",
+    publishedAt: "2026-01-03T00:00:00.000Z",
+  },
+  {
+    name: "@twin.executor.community/notes",
+    commit: "d".repeat(40),
+    description: "Notes in the same slug's publishing scope",
+    publishedAt: "2026-01-04T00:00:00.000Z",
+  },
+] as const;
+/** Every listing the registry publishes, as it lists them. */
+export const registryCatalog = [
+  registryPublication,
+  registryScopedListing,
+  ...registryTwinListings,
+];
+
+/**
+ * A listing in a format no release reads yet: a name outside every package name pattern, as a
+ * later widening could send.
+ */
+export const registryFutureListing = { ...registryPublication, name: "@fixture/future+format" };
+/** A listing with a supported name and malformed metadata, which no release reads. */
+export const registryMalformedListing = {
+  ...registryPublication,
+  name: "@fixture/malformed",
+  description: 42,
+};
+/**
+ * The name that selects a listing of a readable publication beside {@link registryFutureListing}
+ * and {@link registryMalformedListing}.
+ */
+export const registryMixedName = "@fixture/mixed";
+
 /** Package names that select each upstream behavior. */
 export const registryFixtureNames = {
   redirect: "@fixture/moved",
@@ -19,10 +71,40 @@ export const registryFixtureNames = {
   missing: "@fixture/missing",
 } as const;
 
+type Listing = (typeof registryCatalog)[number];
+
+/** A listing's source: an app that deploys, whose package.json names the listing. */
+const listingSource = (listing: Listing) => ({
+  publication: listing,
+  files: [
+    {
+      path: "index.ts",
+      content: `import { defineApp } from "apps";\nexport default defineApp({}, {});\n`,
+    },
+    {
+      path: "package.json",
+      content: JSON.stringify({
+        name: listing.name,
+        description: listing.description,
+        dependencies: withApps(),
+      }),
+    },
+  ],
+});
+const notFound = HttpServerResponse.jsonUnsafe(
+  { _tag: "RegistryError", reason: "not-found" },
+  { status: 400 },
+);
+const changed = HttpServerResponse.jsonUnsafe(
+  { _tag: "RegistryError", reason: "changed" },
+  { status: 400 },
+);
+
 /**
  * Start the registry on loopback. `paths` lists every received request. `close` stops the
  * listener early so later reads cannot connect; the case scope otherwise closes it. `hold` keeps
- * later listing responses pending until `release`; `held` waits until one has arrived.
+ * later listing responses pending until `release`; `held` waits until one has arrived. `publish`
+ * replaces what the registry publishes, as when a listing is replaced or renamed.
  */
 export const registryUpstream = Effect.gen(function* () {
   const listener = yield* Scope.make();
@@ -43,7 +125,9 @@ export const registryUpstream = Effect.gen(function* () {
   );
   yield* Effect.addFinalizer(() => release.pipe(Effect.andThen(Scope.close(listener, Exit.void))));
   const paths = yield* Ref.make<ReadonlyArray<string>>([]);
-  const list = HttpServerResponse.jsonUnsafe([registryPublication]);
+  const revisions = yield* Ref.make<ReadonlyArray<string | undefined>>([]);
+  const catalog = yield* Ref.make<ReadonlyArray<Listing>>(registryCatalog);
+  const list = Effect.map(Ref.get(catalog), (listings) => HttpServerResponse.jsonUnsafe(listings));
   const routes = Layer.mergeAll(
     HttpRouter.add(
       "GET",
@@ -52,12 +136,14 @@ export const registryUpstream = Effect.gen(function* () {
         const request = yield* HttpServerRequest.HttpServerRequest;
         const url = new URL(request.url, "http://registry.invalid");
         yield* Ref.update(paths, (all) => [...all, url.pathname + url.search]);
+        yield* Ref.update(revisions, (all) => [...all, request.headers["executor-wire-revision"]]);
         const held = yield* Ref.get(gate);
         if (Option.isSome(held)) {
           yield* Deferred.succeed(held.value.arrived, undefined);
           yield* Deferred.await(held.value.open);
         }
-        switch (url.searchParams.get("name")) {
+        const name = url.searchParams.get("name");
+        switch (name) {
           case registryFixtureNames.redirect:
             // A followed redirect would succeed here, so only a refused redirect fails.
             return HttpServerResponse.empty({ status: 302, headers: { location: "/elsewhere" } });
@@ -65,22 +151,45 @@ export const registryUpstream = Effect.gen(function* () {
             return HttpServerResponse.text("unavailable", { status: 503 });
           case registryFixtureNames.garbled:
             return HttpServerResponse.html("<html></html>");
+          case registryMixedName:
+            return HttpServerResponse.jsonUnsafe([
+              registryPublication,
+              registryFutureListing,
+              registryMalformedListing,
+            ]);
           case registryFixtureNames.missing:
+            return notFound;
+          case null:
+            return yield* list;
+          default:
             return HttpServerResponse.jsonUnsafe(
-              { _tag: "RegistryError", reason: "not-found" },
-              { status: 400 },
+              (yield* Ref.get(catalog)).filter((listing) => listing.name === name),
             );
-          default:
-            return list;
         }
       }),
     ),
+    HttpRouter.add(
+      "GET",
+      "/api/registry/source",
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = new URL(request.url, "http://registry.invalid");
+        yield* Ref.update(paths, (all) => [...all, url.pathname + url.search]);
+        const listing = (yield* Ref.get(catalog)).find(
+          (candidate) => candidate.name === url.searchParams.get("name"),
+        );
+        if (listing === undefined) return notFound;
+        return listing.commit === url.searchParams.get("commit")
+          ? HttpServerResponse.jsonUnsafe(listingSource(listing))
+          : changed;
+      }),
+    ),
     HttpRouter.add(
       "GET",
       "/elsewhere",
       Effect.gen(function* () {
         yield* Ref.update(paths, (all) => [...all, "/elsewhere"]);
-        return list;
+        return yield* list;
       }),
     ),
   );
@@ -94,6 +203,8 @@ export const registryUpstream = Effect.gen(function* () {
   return {
     origin: `http://127.0.0.1:${server.address.port}`,
     paths: Ref.get(paths),
+    /** The wire revision each listing request stated. */
+    revisions: Ref.get(revisions),
     hold: Effect.gen(function* () {
       const arrived = yield* Deferred.make<void>();
       const open = yield* Deferred.make<void>();
@@ -101,6 +212,7 @@ export const registryUpstream = Effect.gen(function* () {
       return { held: Deferred.await(arrived).pipe(Effect.timeout("20 seconds")) };
     }),
     release,
+    publish: (listings: ReadonlyArray<Listing>) => Ref.set(catalog, listings),
     close: Scope.close(listener, Exit.void),
   };
 });
diff --git a/e2e/support/release-6ba6219e6.ts b/e2e/support/release-6ba6219e6.ts
new file mode 100644
index 0000000000..8ae3e3dbed
--- /dev/null
+++ b/e2e/support/release-6ba6219e6.ts
@@ -0,0 +1,125 @@
+/**
+ * How the local servers of release 2.0.0-beta.16, published from main at 6ba6219e6, read public
+ * app listings, frozen. They read package names under publisher scopes and can be asked to install
+ * one by its full name, but they state no wire revision, so a host answers them as it answers
+ * 2.0.0-beta.15. A listing they name must come back under the name they sent.
+ *
+ * Do not edit this file. Snapshot a later release in a new file named for its commit. Copied with
+ * effect 4.0.1 (bun.lock at 6ba6219e6) from these sources, by `git rev-parse 6ba6219e6:<path>`, and
+ * checked against the published `executor@2.0.0-beta.16-linux-x64` bundle:
+ * - 07cec7d1488290ddbf870abe4c1a85e7601a9731 packages/sdk/src/contracts/registry.ts
+ * - a04d181ca75701db0a2645724800d7258d29ec82 packages/sdk/src/contracts/source.ts
+ * - bc0c2088e5e1a092d47e9c211f749fd8d2c33612 packages/sdk/src/implementation/remote-registry.ts
+ * - 4b1554c4bff6580a3db6c80024b8e00375a07ffc packages/sdk/src/implementation/registry.ts
+ * The schemas run with this repository's effect, not 4.0.1, once it is upgraded.
+ */
+import { Effect, Schema } from "effect";
+
+/** `PackageName` in packages/sdk/src/contracts/registry.ts. */
+const PackageName = Schema.String.check(
+  Schema.isPattern(/^@[a-z0-9][a-z0-9.-]{0,119}\/[a-z0-9][a-z0-9-]{0,62}$/u),
+);
+const packageLabel = (name: string) => name.slice(name.indexOf("/") + 1);
+/** `SourceCommit` in packages/sdk/src/contracts/source.ts. */
+const SourceCommit = Schema.String.check(Schema.isPattern(/^[a-f0-9]{40}$/u));
+/** `SourceFilePath` in packages/sdk/src/contracts/source.ts. */
+const SourceFilePath = Schema.String.pipe(
+  Schema.check(
+    Schema.makeFilter((path: string) => {
+      if (path.includes("\0")) return "expected no NUL bytes";
+      if (path.includes("\\")) return "expected POSIX separators";
+      if (path.startsWith("/")) return "expected a relative path";
+      return path.length > 0 && path.split("/").every((s) => s !== "" && s !== "." && s !== "..")
+        ? true
+        : "expected canonical segments (non-empty, no `.` or `..`)";
+    }),
+  ),
+);
+const publicSourcePrefix = "ui/public/";
+/** `SourceFile` and its members in packages/sdk/src/contracts/source.ts. */
+const SourceTextFile = Schema.Struct({ path: SourceFilePath, content: Schema.String });
+const SourceBinaryFile = Schema.Struct({
+  path: SourceFilePath,
+  content: Schema.String.check(
+    Schema.isPattern(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u),
+  ),
+  encoding: Schema.Literal("base64"),
+});
+const SourceStoredFile = Schema.Struct({
+  path: SourceFilePath,
+  object: Schema.String.check(Schema.isPattern(/^[a-f0-9]{40}$/u)),
+  size: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+});
+const SourceFile = Schema.Union([SourceBinaryFile, SourceStoredFile, SourceTextFile]);
+type SourceFile = typeof SourceFile.Type;
+const isTextFile = (file: SourceFile): file is typeof SourceTextFile.Type =>
+  !("object" in file) && !("encoding" in file);
+/** `SourceFiles` in packages/sdk/src/contracts/source.ts. */
+const SourceFiles = Schema.NonEmptyArray(SourceFile).pipe(
+  Schema.check(
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) =>
+      new Set(files.map((f) => f.path)).size === files.length ? true : "expected unique paths",
+    ),
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) =>
+      files.some((f) => f.path === "index.ts") ? true : "expected a root index.ts",
+    ),
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) => {
+      const misplaced = files.find(
+        (file) => !isTextFile(file) && !file.path.startsWith(publicSourcePrefix),
+      );
+      return misplaced === undefined
+        ? true
+        : `expected ${misplaced.path} to be UTF-8 text: only files under ${publicSourcePrefix} may be binary or stored`;
+    }),
+  ),
+);
+/** `PackageManifest` in packages/sdk/src/contracts/registry.ts. */
+const PackageManifest = Schema.Struct({
+  name: PackageName,
+  description: Schema.optional(Schema.String.check(Schema.isMaxLength(2000))),
+});
+/** `Publication` and `PublicationSnapshot` in packages/sdk/src/contracts/registry.ts. */
+const Publication = Schema.Struct({
+  name: PackageName,
+  commit: SourceCommit,
+  description: Schema.String,
+  publishedAt: Schema.String,
+});
+const PublicationSnapshot = Schema.Struct({ publication: Publication, files: SourceFiles });
+
+/**
+ * What that release's local server answers for a list of public listings, whole or by name: the
+ * listings, or the failure its `remoteRegistry` maps any undecodable list to (`read` in
+ * remote-registry.ts).
+ */
+export const releasedCatalog = (body: unknown) =>
+  Schema.decodeUnknownEffect(Schema.Array(Publication))(body).pipe(
+    Effect.mapError(() => ({ _tag: "RegistryError", reason: "invalid-source" }) as const),
+  );
+
+/**
+ * What that release's local server makes of a listing's source when it installs `name` at
+ * `commit`: `snapshot` in remote-registry.ts requires the answer to name exactly the listing it
+ * asked for, then `resolvePublication` in registry.ts reads package.json (`publicationSource`)
+ * and requires its label to match. The number of source files when it installs.
+ */
+export const releasedInstall = (body: unknown, name: string, commit: string) =>
+  Effect.gen(function* () {
+    const snapshot = yield* Schema.decodeUnknownEffect(PublicationSnapshot)(body).pipe(
+      Effect.mapError(() => "invalid-source" as const),
+    );
+    if (snapshot.publication.name !== name || snapshot.publication.commit !== commit)
+      return yield* Effect.fail("changed" as const);
+    const manifest = snapshot.files.find((file) => file.path === "package.json");
+    if (manifest === undefined || !isTextFile(manifest))
+      return yield* Effect.fail("invalid-manifest" as const);
+    const document = yield* Schema.decodeUnknownEffect(
+      Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown)),
+    )(manifest.content).pipe(Effect.mapError(() => "invalid-manifest" as const));
+    const read = yield* Schema.decodeUnknownEffect(PackageManifest)(document).pipe(
+      Effect.mapError(() => "invalid-manifest" as const),
+    );
+    if (packageLabel(read.name) !== packageLabel(name))
+      return yield* Effect.fail("invalid-source" as const);
+    return snapshot.files.length;
+  });
diff --git a/e2e/support/release-f5f3256ab.ts b/e2e/support/release-f5f3256ab.ts
new file mode 100644
index 0000000000..affe0d2cde
--- /dev/null
+++ b/e2e/support/release-f5f3256ab.ts
@@ -0,0 +1,223 @@
+/**
+ * How the clients of release 2.0.0-beta.15, published from main at f5f3256ab, read public app
+ * listings and app source, frozen. Installed CLIs, desktop apps and local servers of that release keep
+ * calling Cloud: its local servers read the public registry, and its CLI reads app source. They
+ * state no wire revision, so a host must answer them in the format these schemas decode.
+ *
+ * Do not edit this file. Snapshot a later release in a new file named for its commit. Copied with
+ * effect 4.0.1 (bun.lock at f5f3256ab) from these sources, by `git rev-parse f5f3256ab:<path>`:
+ * - e748356672dc75b6c62c1025382c0a58fa3171fe packages/sdk/src/contracts/registry.ts
+ * - a04d181ca75701db0a2645724800d7258d29ec82 packages/sdk/src/contracts/source.ts
+ * - 94b650294b9c120ff05153f5c993fb76dd237362 packages/sdk/src/contracts/shared.ts
+ * - 912f8bb524cd891b7eb3ac04b9b228df67e3d016 packages/app-management/src/contracts/api.ts
+ * - 8ce4b56add20091c8a727cebd0aac2060d7ad95f packages/sdk/src/implementation/remote-registry.ts
+ * - 104307e77b7625cacb05e8dfb8af93ae79c3c908 packages/sdk/src/implementation/registry.ts
+ * - bc4573a29e5567bd991aa3ab6e9f1b70d85cc41c packages/app-management/src/cli.ts
+ * - 172fb330e11ec1db557bc7f824dcf440d7e34519 packages/app-management/src/client-error.ts
+ * The release's `Release 2.0.0-beta.15` commit, 1a03f723f, is older than the published build.
+ * The schemas run with this repository's effect, not 4.0.1, once it is upgraded.
+ */
+import { Effect, Schema } from "effect";
+
+/** `PackageName` in packages/sdk/src/contracts/registry.ts. */
+const PackageName = Schema.String.check(
+  Schema.isPattern(/^@[a-z0-9][a-z0-9-]{0,79}\/[a-z0-9][a-z0-9-]{0,62}$/u),
+);
+/** `SourceCommit` in packages/sdk/src/contracts/source.ts. */
+const SourceCommit = Schema.String.check(Schema.isPattern(/^[a-f0-9]{40}$/u));
+/** `SourceFilePath` in packages/sdk/src/contracts/source.ts. */
+const SourceFilePath = Schema.String.pipe(
+  Schema.check(
+    Schema.makeFilter((path: string) => {
+      if (path.includes("\0")) return "expected no NUL bytes";
+      if (path.includes("\\")) return "expected POSIX separators";
+      if (path.startsWith("/")) return "expected a relative path";
+      return path.length > 0 && path.split("/").every((s) => s !== "" && s !== "." && s !== "..")
+        ? true
+        : "expected canonical segments (non-empty, no `.` or `..`)";
+    }),
+  ),
+);
+const publicSourcePrefix = "ui/public/";
+/** `SourceFile` and its members in packages/sdk/src/contracts/source.ts. */
+const SourceTextFile = Schema.Struct({ path: SourceFilePath, content: Schema.String });
+const SourceBinaryFile = Schema.Struct({
+  path: SourceFilePath,
+  content: Schema.String.check(
+    Schema.isPattern(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u),
+  ),
+  encoding: Schema.Literal("base64"),
+});
+const SourceStoredFile = Schema.Struct({
+  path: SourceFilePath,
+  object: Schema.String.check(Schema.isPattern(/^[a-f0-9]{40}$/u)),
+  size: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+});
+const SourceFile = Schema.Union([SourceBinaryFile, SourceStoredFile, SourceTextFile]);
+type SourceFile = typeof SourceFile.Type;
+const isTextFile = (file: SourceFile): file is typeof SourceTextFile.Type =>
+  !("object" in file) && !("encoding" in file);
+/** `SourceFiles` in packages/sdk/src/contracts/source.ts. */
+const SourceFiles = Schema.NonEmptyArray(SourceFile).pipe(
+  Schema.check(
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) =>
+      new Set(files.map((f) => f.path)).size === files.length ? true : "expected unique paths",
+    ),
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) =>
+      files.some((f) => f.path === "index.ts") ? true : "expected a root index.ts",
+    ),
+    Schema.makeFilter((files: ReadonlyArray<SourceFile>) => {
+      const misplaced = files.find(
+        (file) => !isTextFile(file) && !file.path.startsWith(publicSourcePrefix),
+      );
+      return misplaced === undefined
+        ? true
+        : `expected ${misplaced.path} to be UTF-8 text: only files under ${publicSourcePrefix} may be binary or stored`;
+    }),
+  ),
+);
+/** `AppCodeId` in packages/sdk/src/contracts/shared.ts. */
+const AppCodeId = Schema.String.check(Schema.isPattern(/^code_[\s\S]+$/u));
+/** `SourceSnapshot` in packages/sdk/src/contracts/source.ts. */
+const SourceSnapshot = Schema.Struct({
+  revision: Schema.Struct({ code: AppCodeId, commit: SourceCommit }),
+  files: SourceFiles,
+});
+/** `PackageManifest` in packages/sdk/src/contracts/registry.ts. */
+const PackageManifest = Schema.Struct({
+  name: PackageName,
+  description: Schema.optional(Schema.String.check(Schema.isMaxLength(2000))),
+});
+/** `PublicationIssue` in packages/sdk/src/contracts/registry.ts. */
+const PublicationIssue = Schema.Struct({
+  _tag: Schema.Literal("PublicationIssue"),
+  reason: Schema.Literals([
+    "missing-manifest",
+    "invalid-json",
+    "missing-name",
+    "unscoped-name",
+    "invalid-name",
+    "invalid-metadata",
+    "invalid-source",
+    "limit",
+    "forbidden-scope",
+    "name-taken",
+  ]),
+  name: Schema.NullOr(Schema.String),
+});
+/** `PublicationReadiness` in packages/sdk/src/contracts/registry.ts. */
+const PublicationReadiness = Schema.Union([
+  Schema.Struct({ status: Schema.Literal("ready"), manifest: PackageManifest }),
+  Schema.Struct({
+    status: Schema.Literal("blocked"),
+    issue: PublicationIssue,
+    suggestedName: Schema.NullOr(PackageName),
+  }),
+]);
+/** `Publication` and `PublicationSnapshot` in packages/sdk/src/contracts/registry.ts. */
+const Publication = Schema.Struct({
+  name: PackageName,
+  commit: SourceCommit,
+  description: Schema.String,
+  publishedAt: Schema.String,
+});
+const PublicationSnapshot = Schema.Struct({ publication: Publication, files: SourceFiles });
+/** `AppSourceView` in packages/app-management/src/contracts/api.ts. */
+const AppSourceView = Schema.Struct({
+  ...SourceSnapshot.fields,
+  namespace: Schema.NullOr(Schema.String),
+  gitPath: Schema.String,
+  gitUrl: Schema.String,
+  canEdit: Schema.Boolean,
+  publication: Schema.NullOr(PublicationReadiness),
+});
+
+/**
+ * What that release's local server answers for the whole public catalog: the listings, or the
+ * failure its `remoteRegistry` maps any undecodable list to (`read` in remote-registry.ts).
+ */
+export const releasedCatalog = (body: unknown) =>
+  Schema.decodeUnknownEffect(Schema.Array(Publication))(body).pipe(
+    Effect.mapError(() => ({ _tag: "RegistryError", reason: "invalid-source" }) as const),
+  );
+
+/**
+ * What that release's local server makes of a listing's source when it copies `name` at `commit`:
+ * `snapshot` in remote-registry.ts, then `resolvePublication` in registry.ts, which requires the
+ * source's package.json to name the listing exactly.
+ */
+export const releasedInstall = (body: unknown, name: string, commit: string) =>
+  Effect.gen(function* () {
+    const snapshot = yield* Schema.decodeUnknownEffect(PublicationSnapshot)(body).pipe(
+      Effect.mapError(() => "invalid-source" as const),
+    );
+    if (snapshot.publication.name !== name || snapshot.publication.commit !== commit)
+      return yield* Effect.fail("changed" as const);
+    const manifest = snapshot.files.find((file) => file.path === "package.json");
+    if (manifest === undefined || !isTextFile(manifest))
+      return yield* Effect.fail("invalid-manifest" as const);
+    const document = yield* Schema.decodeUnknownEffect(
+      Schema.fromJsonString(Schema.Struct({ name: Schema.Unknown })),
+    )(manifest.content).pipe(Effect.mapError(() => "invalid-manifest" as const));
+    if (!Schema.is(PackageName)(document.name)) return yield* Effect.fail("invalid-manifest");
+    if (document.name !== name) return yield* Effect.fail("invalid-source" as const);
+    return snapshot.files.length;
+  });
+
+/**
+ * What that release's CLI makes of the app source it reads (`workingSource` in cli.ts): for
+ * `apps source`, `apps deploy --files`, and `apps create` with public files after it creates the
+ * app. The decoded view, or `UnexpectedResponse` when the body does not decode (`hostFailure` and
+ * `hostRequestFailure` in cli.ts).
+ */
+export const releasedSourceView = (body: unknown) =>
+  Schema.decodeUnknownEffect(AppSourceView)(body).pipe(
+    Effect.mapError(() => "UnexpectedResponse" as const),
+  );
+
+/** The tags of `appOperationErrors` in packages/app-management/src/contracts/api.ts. */
+const declaredErrors = new Set([
+  "StorageError",
+  "SourceError",
+  "RegistryError",
+  "AppAccessDenied",
+  "AppNotFound",
+  "AppNotDeployed",
+  "DeploymentNotFound",
+  "AppNameTaken",
+  "AppSlugTaken",
+  "AppDeploymentChanged",
+  "AccountNotFound",
+  "AccountSelectionInvalid",
+  "DeploymentBuildFailed",
+  "BuildMemoryExceeded",
+]);
+/** `HostRecovery` in packages/app-management/src/client-error.ts. */
+const HostRecovery = Schema.Struct({ action: Schema.String, instructions: Schema.String });
+/** `HostAnswer` in packages/app-management/src/cli.ts, after its JSON parse. */
+const HostAnswer = Schema.Struct({
+  _tag: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+  message: Schema.NonEmptyString.check(Schema.isMaxLength(4096)),
+  recovery: Schema.optional(HostRecovery),
+});
+
+/**
+ * What that release's CLI prints when an app management request fails with an error its contract
+ * does not declare (`hostFailure`, `hostAnswer` and `hostRequestFailure` in cli.ts): the host's own
+ * code, status, message and recovery. A declared error, or a body that is not an Executor error,
+ * never reaches this path, so it fails here.
+ */
+export const releasedHostAnswer = (status: number, body: unknown) =>
+  Schema.decodeUnknownEffect(HostAnswer)(body).pipe(
+    Effect.mapError(() => "UnexpectedResponse" as const),
+    Effect.filterOrFail(
+      (answer) => !declaredErrors.has(answer._tag),
+      () => "declared" as const,
+    ),
+    Effect.map(({ _tag, message, recovery }) => ({
+      code: _tag,
+      status,
+      message,
+      ...(recovery === undefined ? {} : { recovery }),
+    })),
+  );
diff --git a/e2e/support/resource-indicator-issuer.ts b/e2e/support/resource-indicator-issuer.ts
new file mode 100644
index 0000000000..a724aaa228
--- /dev/null
+++ b/e2e/support/resource-indicator-issuer.ts
@@ -0,0 +1,285 @@
+/**
+ * A loopback API whose authorization server binds every token to an RFC 8707 resource indicator.
+ * Its protected-resource metadata, at the origin's root, names the origin as the resource, but the
+ * server knows only the resources it was configured with:
+ * - `refuses-unknown`: the token endpoint refuses any other resource, or none, with
+ *   `invalid_target`, as a server does whose metadata names a resource it no longer serves.
+ * - `binds-audience`: the token endpoint issues a token for whatever resource was asked for, and
+ *   the API answers 401 `invalid_token` to a token issued for any resource but its own.
+ * Executor still uses its real discovery, registration, callback and token paths against it.
+ * Without `metadata` it publishes no protected-resource metadata, so nothing names a resource.
+ * With `scopeAudienceClaim` its authorization server's metadata looks like Microsoft identity
+ * platform v2.0's (a `/v2.0` issuer with `cloud_instance_name`), which Executor reads as taking the
+ * audience from the scopes, although this server still requires its resource.
+ * `refuseWith` changes the status and Retry-After of its `invalid_target` answer, and `addClient`
+ * accepts a client registered by hand, such as an operator's.
+ */
+import { createServer } from "node:http";
+import { createHash, randomUUID } from "node:crypto";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Deferred, Effect, Layer, Schema } from "effect";
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { tokenRequestParameters } from "./client-credentials-issuer.ts";
+
+export type ResourceIndicatorService = "refuses-unknown" | "binds-audience";
+
+const Registration = Schema.Struct({
+  redirect_uris: Schema.Array(Schema.String),
+  token_endpoint_auth_method: Schema.String,
+});
+
+/** The description such a server gives with `invalid_target`. */
+export const unknownResourceDescription = "resource indicator is missing, or unknown";
+
+/** How the token endpoint answers a resource it does not know: a 400 unless changed. */
+export interface ResourceRefusal {
+  readonly status: number;
+  readonly retryAfter?: string;
+}
+
+export const resourceIndicatorIssuer = (
+  service: ResourceIndicatorService,
+  options: { readonly metadata?: boolean; readonly scopeAudienceClaim?: boolean } = {},
+) =>
+  Effect.gen(function* () {
+    let refusal: ResourceRefusal = { status: 400 };
+    const address = yield* Deferred.make<string>();
+    const clients = new Map<string, string>();
+    const codes = new Map<
+      string,
+      { clientId: string; redirect: string; challenge: string; resource: string | null }
+    >();
+    /** Tokens issued, by the resource each is for. */
+    const audiences = new Map<string, string | null>();
+    const refreshGrants = new Map<string, { clientId: string; resource: string | null }>();
+    const authorizations: Array<{ readonly resource: string | null }> = [];
+    const tokenRequests: Array<{
+      readonly grant: string | null;
+      readonly resource: string | null;
+      readonly issued: boolean;
+    }> = [];
+    const apiRequests: Array<{ readonly audience: string | null; readonly accepted: boolean }> = [];
+    /** The API's own resource identifier, which its metadata does not name. */
+    const apiResource = Effect.map(Deferred.await(address), (origin) => `${origin}/api`);
+    const known = (resource: string | null) => Effect.map(apiResource, (api) => resource === api);
+    /** The authorization server's issuer path, which RFC 8414 inserts after the well-known name. */
+    const issuerPath = options.scopeAudienceClaim === true ? "/v2.0" : "";
+
+    const issue = (clientId: string, resource: string | null) => {
+      const accessToken = `synthetic-access-${randomUUID()}`;
+      const refreshToken = `synthetic-refresh-${randomUUID()}`;
+      audiences.set(accessToken, resource);
+      refreshGrants.set(refreshToken, { clientId, resource });
+      return HttpServerResponse.json({
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: refreshToken,
+        scope: "read",
+      });
+    };
+
+    const routes = Layer.mergeAll(
+      // Requests without credentials are answered: a client finds the resource's metadata itself.
+      HttpRouter.add("GET", "/", Effect.succeed(HttpServerResponse.empty({ status: 200 }))),
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-protected-resource",
+        Effect.gen(function* () {
+          if (options.metadata === false) return HttpServerResponse.empty({ status: 404 });
+          const origin = yield* Deferred.await(address);
+          return yield* HttpServerResponse.json({
+            resource: origin,
+            authorization_servers: [`${origin}${issuerPath}`],
+            scopes_supported: ["read"],
+          });
+        }),
+      ),
+      HttpRouter.add(
+        "GET",
+        `/.well-known/oauth-authorization-server${issuerPath}`,
+        Effect.gen(function* () {
+          const origin = yield* Deferred.await(address);
+          return yield* HttpServerResponse.json({
+            issuer: `${origin}${issuerPath}`,
+            ...(options.scopeAudienceClaim === true
+              ? { cloud_instance_name: "synthetic.invalid" }
+              : {}),
+            registration_endpoint: `${origin}/register`,
+            authorization_endpoint: `${origin}/authorize`,
+            token_endpoint: `${origin}/token`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            token_endpoint_auth_methods_supported: ["client_secret_basic"],
+            code_challenge_methods_supported: ["S256"],
+            scopes_supported: ["read"],
+          });
+        }),
+      ),
+      HttpRouter.add(
+        "POST",
+        "/register",
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const input = yield* request.json.pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Registration)),
+          );
+          const clientId = `synthetic-client-${clients.size + 1}`;
+          clients.set(clientId, "synthetic-client-secret");
+          return yield* HttpServerResponse.json(
+            {
+              client_id: clientId,
+              client_secret: "synthetic-client-secret",
+              client_secret_expires_at: 0,
+              token_endpoint_auth_method: input.token_endpoint_auth_method,
+              redirect_uris: input.redirect_uris,
+              grant_types: ["authorization_code", "refresh_token"],
+            },
+            { status: 201 },
+          );
+        }),
+      ),
+      HttpRouter.add(
+        "GET",
+        "/authorize",
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const params = new URL(request.url, "http://localhost").searchParams;
+          const clientId = params.get("client_id"),
+            redirect = params.get("redirect_uri"),
+            challenge = params.get("code_challenge");
+          if (
+            clientId === null ||
+            redirect === null ||
+            challenge === null ||
+            params.get("code_challenge_method") !== "S256" ||
+            !clients.has(clientId)
+          )
+            return HttpServerResponse.empty({ status: 400 });
+          const resource = params.get("resource");
+          authorizations.push({ resource });
+          const code = `synthetic-code-${randomUUID()}`;
+          codes.set(code, { clientId, redirect, challenge, resource });
+          const callback = new URL(redirect);
+          callback.searchParams.set("code", code);
+          const state = params.get("state");
+          if (state !== null) callback.searchParams.set("state", state);
+          return HttpServerResponse.redirect(callback.href, { status: 302 });
+        }),
+      ),
+      HttpRouter.add(
+        "POST",
+        "/token",
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const input = tokenRequestParameters(
+            request.headers["content-type"],
+            yield* request.text,
+          );
+          const authorization = request.headers.authorization;
+          const [clientId, secret] = authorization?.startsWith("Basic ")
+            ? Buffer.from(authorization.slice(6), "base64")
+                .toString("utf8")
+                .split(":")
+                .map((part) => decodeURIComponent(part))
+            : [undefined, undefined];
+          const grant = input.get("grant_type");
+          const resource = input.get("resource");
+          const refuse = (
+            error: string,
+            description?: string,
+            answer: ResourceRefusal = { status: 400 },
+          ) =>
+            Effect.gen(function* () {
+              tokenRequests.push({ grant, resource, issued: false });
+              return yield* HttpServerResponse.json(
+                { error, ...(description === undefined ? {} : { error_description: description }) },
+                {
+                  status: answer.status,
+                  ...(answer.retryAfter === undefined
+                    ? {}
+                    : { headers: { "retry-after": answer.retryAfter } }),
+                },
+              );
+            });
+          if (clientId === undefined || clients.get(clientId) !== secret)
+            return yield* refuse("invalid_client");
+          // An unknown resource is refused before the grant is looked at, on every grant type.
+          if (service === "refuses-unknown" && !(yield* known(resource)))
+            return yield* refuse("invalid_target", unknownResourceDescription, refusal);
+          if (grant === "refresh_token") {
+            const presented = input.get("refresh_token");
+            const held = presented === null ? undefined : refreshGrants.get(presented);
+            if (held === undefined || held.clientId !== clientId)
+              return yield* refuse("invalid_grant");
+            tokenRequests.push({ grant, resource, issued: true });
+            return yield* issue(clientId, resource);
+          }
+          const code = input.get("code");
+          const issued = code === null ? undefined : codes.get(code);
+          const verifier = input.get("code_verifier");
+          if (
+            code === null ||
+            issued === undefined ||
+            grant !== "authorization_code" ||
+            issued.clientId !== clientId ||
+            input.get("redirect_uri") !== issued.redirect ||
+            verifier === null ||
+            createHash("sha256").update(verifier).digest("base64url") !== issued.challenge
+          )
+            return yield* refuse("invalid_grant");
+          // RFC 8707 §2.2: the token request names the resource the authorization request did.
+          if (resource !== issued.resource) return yield* refuse("invalid_target");
+          codes.delete(code);
+          tokenRequests.push({ grant, resource, issued: true });
+          return yield* issue(clientId, resource);
+        }),
+      ),
+      HttpRouter.add(
+        "GET",
+        "/api",
+        Effect.gen(function* () {
+          const request = yield* HttpServerRequest.HttpServerRequest;
+          const token = request.headers.authorization?.replace(/^Bearer /, "") ?? "";
+          const audience = audiences.get(token) ?? null;
+          const accepted = audiences.has(token) && (yield* known(audience));
+          apiRequests.push({ audience, accepted });
+          return accepted
+            ? yield* HttpServerResponse.json({ ok: true })
+            : HttpServerResponse.empty({
+                status: 401,
+                headers: { "www-authenticate": 'Bearer error="invalid_token"' },
+              });
+        }),
+      ),
+    );
+    const listener = yield* Effect.sync(() => createServer());
+    const services = yield* Layer.build(
+      HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+        Layer.provideMerge(NodeHttpServer.layer(() => listener, { host: "127.0.0.1", port: 0 })),
+      ),
+    );
+    yield* Effect.addFinalizer(() => Effect.sync(() => listener.closeAllConnections()));
+    const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+    if (!("port" in server.address)) return yield* Effect.die("OAuth fixture needs a TCP listener");
+    const origin = `http://127.0.0.1:${server.address.port}`;
+    yield* Deferred.succeed(address, origin);
+    return {
+      origin,
+      /** The resource the API accepts tokens for; its metadata names `origin` instead. */
+      apiResource: `${origin}/api`,
+      refuseWith: (answer: ResourceRefusal) =>
+        Effect.sync(() => {
+          refusal = answer;
+        }),
+      addClient: (clientId: string, secret: string) =>
+        Effect.sync(() => {
+          clients.set(clientId, secret);
+        }),
+      metrics: Effect.sync(() => ({
+        authorizations: [...authorizations],
+        tokenRequests: [...tokenRequests],
+        apiRequests: [...apiRequests],
+      })),
+    };
+  });
diff --git a/e2e/support/v1-import.ts b/e2e/support/v1-import.ts
index 34ee6573f1..a9bae61330 100644
--- a/e2e/support/v1-import.ts
+++ b/e2e/support/v1-import.ts
@@ -5,6 +5,7 @@
 import { randomUUID } from "node:crypto";
 import { Effect, FileSystem, Schedule, Schema } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { writeRows } from "./cloud-rows.ts";
 import { Target } from "./platform.ts";
 
 const Operator = Schema.Struct({ token: Schema.String });
@@ -46,7 +47,25 @@ export const V1Report = Schema.Struct({
   emailMatches: Schema.Array(Schema.Struct({ email: Schema.String, match: Schema.String })),
   skippedMembers: Schema.Array(Schema.Struct({ user: Schema.String, reason: Schema.String })),
   slug: Schema.NullOr(
-    Schema.Struct({ v1: Schema.String, v2: Schema.NullOr(Schema.String), changed: Schema.Boolean }),
+    Schema.Struct({
+      v1: Schema.String,
+      v2: Schema.NullOr(Schema.String),
+      changed: Schema.Boolean,
+      displaced: Schema.optionalKey(
+        Schema.Struct({
+          organization: Schema.String,
+          slug: Schema.NullOr(Schema.String),
+          reason: Schema.optionalKey(Schema.String),
+        }),
+      ),
+    }),
+  ),
+  into: Schema.optionalKey(
+    Schema.Struct({
+      organization: Schema.String,
+      mode: Schema.NullOr(Schema.String),
+      refused: Schema.optionalKey(Schema.String),
+    }),
   ),
   integrationFailures: Schema.Array(
     Schema.Struct({ id: Schema.String, label: Schema.String, error: Schema.String }),
@@ -57,6 +76,7 @@ export const V1Report = Schema.Struct({
   connectionFailures: Schema.Array(
     Schema.Struct({
       reason: Schema.String,
+      reconnect: Schema.optional(Schema.Literal(true)),
       connections: Schema.Array(
         Schema.Struct({ id: Schema.String, label: Schema.String, integration: Schema.String }),
       ),
@@ -92,6 +112,50 @@ export const V1Report = Schema.Struct({
       reason: Schema.String,
     }),
   ),
+  /** Integrations that move as an app per connection, with each connection's app. */
+  splitIntegrations: Schema.optionalKey(
+    Schema.Array(
+      Schema.Struct({
+        id: Schema.String,
+        label: Schema.String,
+        apps: Schema.Array(
+          Schema.Struct({
+            connection: Schema.String,
+            label: Schema.String,
+            owner: Schema.String,
+            name: Schema.String,
+            status: Schema.String,
+            v2Id: Schema.optionalKey(Schema.String),
+            reason: Schema.optionalKey(Schema.String),
+            rules: Schema.optionalKey(
+              Schema.Struct({
+                omitted: Schema.Number,
+                always: Schema.Number,
+                never: Schema.Number,
+                otherwise: Schema.NullOr(Schema.String),
+              }),
+            ),
+          }),
+        ),
+      }),
+    ),
+  ),
+  billing: Schema.optionalKey(
+    Schema.Struct({
+      subscription: Schema.NullOr(
+        Schema.Struct({
+          plan: Schema.String,
+          version: Schema.Number,
+          pricing: Schema.String,
+          v2Pricing: Schema.String,
+          trialing: Schema.Boolean,
+          cancelling: Schema.Boolean,
+        }),
+      ),
+      problem: Schema.NullOr(Schema.String),
+      carried: Schema.optionalKey(Schema.Boolean),
+    }),
+  ),
   v2Organization: Schema.optionalKey(Schema.Struct({ id: Schema.String, slug: Schema.String })),
   verification: Schema.optionalKey(
     Schema.Struct({
@@ -167,6 +231,45 @@ const AggregatePage = Schema.Union([
   Schema.Struct({ cursor: Schema.Null, aggregate: Aggregate }),
 ]);
 
+/**
+ * Allow these v1 organizations to be imported, as a person with database access does: a row each
+ * in Cloud's `private_v1_import_allowed`, which no route writes. An import of an organization
+ * without a row is refused.
+ */
+export const allowV1Import = (...organizations: readonly string[]) =>
+  writeRows(
+    "sso-database.json",
+    organizations.map((organization) => ({
+      sql: "insert into private_v1_import_allowed (v1_org_id, note) values ($1, 'E2E scenario') on conflict (v1_org_id) do nothing",
+      params: [organization],
+    })),
+  ).pipe(Effect.asVoid);
+
+/**
+ * List the v2 organization an import of this v1 organization may rename to take its slug, as a
+ * person with database access does: the allow table row's `displace_v2_org_id`.
+ */
+export const listV1SlugDisplacement = (organization: string, holder: string) =>
+  writeRows("sso-database.json", [
+    {
+      sql: "update private_v1_import_allowed set displace_v2_org_id = $2 where v1_org_id = $1",
+      params: [organization, holder],
+    },
+  ]).pipe(Effect.asVoid);
+
+/**
+ * List the existing v2 organization an import of this v1 organization moves into instead of a new
+ * one, and how, as a person with database access does: the allow table row's `into_v2_org_id` and
+ * `into_mode`, which the import reads as `nothing_to_copy` when unset.
+ */
+export const listV1Into = (organization: string, target: string, mode?: string) =>
+  writeRows("sso-database.json", [
+    {
+      sql: "update private_v1_import_allowed set into_v2_org_id = $2, into_mode = nullif($3, '') where v1_org_id = $1",
+      params: [organization, target, mode ?? ""],
+    },
+  ]).pipe(Effect.asVoid);
+
 /** A run id no other scenario uses. */
 export const v1RunId = (prefix: string) => `${prefix}-${randomUUID().slice(0, 8)}`;
 
@@ -223,6 +326,24 @@ export const v1ImportOperator = Effect.gen(function* () {
         body: { maxInFlight: 100, ...input },
         authorization: operator,
       }),
+    /** Repair a moved organization (`repair.ts`), or only plan it when `apply` is false. */
+    repair: (organization: string, apply: boolean) =>
+      send("POST", `/api/internal/v1-import/orgs/${organization}/repair`, {
+        body: { apply },
+        authorization: operator,
+      }),
+    /**
+     * Run an earlier version of one of a moved organization's imported apps again, while it still
+     * runs `expected` (`restoreApp`).
+     */
+    restore: (
+      organization: string,
+      body: { readonly app: string; readonly version: string; readonly expected: string },
+    ) =>
+      send("POST", `/api/internal/v1-import/orgs/${organization}/restore`, {
+        body,
+        authorization: operator,
+      }),
     /** The organization's report once its run has written it. */
     waitForReport: (run: string, organization: string) =>
       report(run, organization).pipe(
@@ -237,6 +358,11 @@ export const v1ImportOperator = Effect.gen(function* () {
         ),
         Effect.retry(Schedule.spaced("500 millis").pipe(Schedule.upTo({ duration: "50 seconds" }))),
       ),
+    /** Give a paid organization's subscription back to v1, as the operator command does. */
+    returnBilling: (organization: string) =>
+      send("POST", `/api/internal/v1-import/orgs/${organization}/return-billing`, {
+        authorization: operator,
+      }),
     /** Give an organization back to v1, as the operator command's `rollback` does. */
     rollback: (organization: string) =>
       send("POST", `/api/internal/v1-import/orgs/${organization}/rollback`, {
diff --git a/e2e/support/v1-session-handoff.ts b/e2e/support/v1-session-handoff.ts
new file mode 100644
index 0000000000..11ad0c493e
--- /dev/null
+++ b/e2e/support/v1-session-handoff.ts
@@ -0,0 +1,31 @@
+import { createHmac, randomBytes } from "node:crypto";
+import { Schema } from "effect";
+
+/** The secret a managed Cloud run shares with its synthetic v1 for session handoffs. */
+export const V1SessionHandoffSecret = Schema.Struct({ secret: Schema.String });
+/** Where a managed Cloud run records the secret it verifies v1 session handoffs with. */
+export const v1SessionHandoffFile = "v1-session-handoff.json";
+
+/** What v1 vouches for in a session handoff; times are Unix seconds. */
+export interface V1HandoffClaims {
+  readonly user: string;
+  readonly organization: string;
+  readonly slug: string;
+  readonly iat: number;
+  readonly exp: number;
+  readonly jti: string;
+  readonly v?: number;
+  readonly aud?: string;
+}
+
+/** A handoff token as v1's dashboard signs it, before redirecting a moved workspace's member. */
+export const v1HandoffToken = (secret: string, claims: V1HandoffClaims) => {
+  const payload = Buffer.from(
+    JSON.stringify({ v: 1, aud: "v2-session-handoff", ...claims }),
+  ).toString("base64url");
+  const signature = createHmac("sha256", secret).update(`v1hnd.${payload}`).digest("base64url");
+  return `v1hnd.${payload}.${signature}`;
+};
+
+/** A fresh token id, as v1 draws one for each handoff. */
+export const v1HandoffId = () => randomBytes(18).toString("base64url");
diff --git a/e2e/test-plan.ts b/e2e/test-plan.ts
index d977454f61..6b334b6e57 100644
--- a/e2e/test-plan.ts
+++ b/e2e/test-plan.ts
@@ -79,6 +79,12 @@ export const appWorkerBudgetLimit = 2;
  * stalled app reached during the program is told apart from one discovery gave up on.
  */
 export const lazyStallTimeoutMs = 15_000;
+/**
+ * Seconds after which the aged search rows scenarios' server renews the rows a search serves
+ * (`EXECUTOR_TOOL_LISTING_RENEW_SECONDS`), in place of the default day: MCP readers never renew
+ * the rows they read, so every app's rows age past it together.
+ */
+export const agedRowsRenewSeconds = 30;
 /** Seconds an idle app Worker stays loaded in the idle unloading scenario. */
 export const appWorkerIdleSeconds = 4;
 /** A relay callback in a valid form other than its serialization, which the SDK sends. */
@@ -172,6 +178,17 @@ export const scenarios = plan({
       local: na("Local does not publish apps."),
     },
   },
+  storageMigrationDiagnostics: {
+    legacyStorage: true,
+    file: "storage-migration-diagnostics.spec.ts",
+    title:
+      "failed executor upgrades report a safe SQLSTATE and version and leave the journal unchanged",
+    targets: {
+      "self-host": scheduled,
+      local: na("Hosted startup reports the migration diagnostics this scenario asserts."),
+      cloud: na("Requires a runner-owned database with a deliberately interrupted upgrade."),
+    },
+  },
   cloudRoleHostRoutes: {
     fixtures: "actors",
     file: "cloud-role-hosts.spec.ts",
@@ -268,6 +285,28 @@ export const scenarios = plan({
       local: na("Local does not serve the marketing site."),
     },
   },
+  releasedClientPackageNames: {
+    fixtures: "actors",
+    file: "released-client-package-names.spec.ts",
+    title:
+      "Clients released before publisher scopes read Cloud's app source and public listings by names they decode",
+    targets: {
+      cloud: sourceStorageCloud,
+      "self-host": na("Self-host does not publish apps or serve the public registry."),
+      local: na("Local does not publish apps or serve the public registry."),
+    },
+  },
+  releasedClientWriteBinding: {
+    fixtures: "actors",
+    file: "released-client-package-names.spec.ts",
+    title:
+      "Clients released before publisher scopes cannot remove a listing by its short name, and copy only the commit they were shown across a replacement, a rename and a reused slug",
+    targets: {
+      cloud: sourceStorageCloud,
+      "self-host": na("Self-host does not publish apps or serve the public registry."),
+      local: na("Local does not publish apps or serve the public registry."),
+    },
+  },
   packageScopes: {
     fixtures: "actors",
     file: "package-scopes.spec.ts",
@@ -418,6 +457,18 @@ export const scenarios = plan({
       local: na("Role hosts are Cloud's; local serves one origin."),
     },
   },
+  cloudInvocationSurface: {
+    fixtures: "actors",
+    file: "cloud-role-hosts.spec.ts",
+    title:
+      "Cloud invocation records name each request's host role, route group and client family, never its URL or user agent",
+    targets: {
+      // Records come from the Tail receiver. Alchemy's local runtime delivers no tail events to it.
+      cloud: { status: "scheduled", runtime: "attached" },
+      "self-host": na("The Tail receiver and role hosts are Cloud's."),
+      local: na("The Tail receiver and role hosts are Cloud's."),
+    },
+  },
   cloudRollbackSwitch: {
     fixtures: "actors",
     file: "cloud-rollback.spec.ts",
@@ -657,6 +708,16 @@ export const scenarios = plan({
       local: na("Hosted app version scenario"),
     },
   },
+  graphqlStatedErrors: {
+    fixtures: "actors",
+    file: "graphql-errors.spec.ts",
+    title: "GraphQL failures carry the errors the server stated, bounded and with secrets replaced",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Loopback GraphQL fixture"),
+      local: na("Hosted app version scenario"),
+    },
+  },
   mcpCatalogCache: {
     fixtures: "actors",
     file: "mcp-catalog.spec.ts",
@@ -702,6 +763,17 @@ export const scenarios = plan({
       local: na("Hosted version API scenario"),
     },
   },
+  mcpListingUpstreamChange: {
+    fixtures: "actors",
+    file: "mcp-catalog.spec.ts",
+    title:
+      "MCP execute and search reach tools an MCP server adds without announcing them, after the app's routine refresh and without a redeploy",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Loopback MCP fixture; the shared execute path is covered on self-host"),
+      local: na("Hosted version API scenario"),
+    },
+  },
   mcpExecuteSignatures: {
     fixtures: "actors",
     file: "mcp-catalog.spec.ts",
@@ -722,7 +794,31 @@ export const scenarios = plan({
       local: na("Hosted version API scenario"),
     },
   },
-  // The two Cloud listing scenarios read a running listing or a remembered timeout, which live only
+  mcpAgedSearchRows: {
+    fixtures: "actors",
+    file: "mcp-catalog-scale.spec.ts",
+    title:
+      "MCP execute serves a search from rows past the renewal age at once and renews them in the background",
+    serverEnvironment: { EXECUTOR_TOOL_LISTING_RENEW_SECONDS: String(agedRowsRenewSeconds) },
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Needs a short renewal age; Cloud serves search through the same listings code"),
+      local: na("Hosted version API scenario"),
+    },
+  },
+  mcpAgedRowsFailedRenewal: {
+    fixtures: "actors",
+    file: "mcp-catalog-scale.spec.ts",
+    title:
+      "MCP execute keeps searching an app's aged rows when renewing them fails, reports why, and renews them once its upstream recovers",
+    serverEnvironment: { EXECUTOR_TOOL_LISTING_RENEW_SECONDS: String(agedRowsRenewSeconds) },
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Needs a short renewal age and a loopback upstream; same listings code"),
+      local: na("Hosted version API scenario"),
+    },
+  },
+  // The Cloud listing scenarios read a running listing or a remembered timeout, which live only
   // in the isolate that ran the listing. The local Worker serves every search from one isolate; a
   // deployed one may not.
   mcpBackgroundListingCloud: {
@@ -750,6 +846,19 @@ export const scenarios = plan({
       local: na("Hosted version API scenario"),
     },
   },
+  mcpStoppedRenewalCloud: {
+    fixtures: "actors",
+    file: "mcp-catalog-scale.spec.ts",
+    title:
+      "Cloud keeps serving aged search rows when it stops their renewal, and does not start it again at once",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na(
+        "Self-host never refuses background work, so its aged-row renewals always run as their own and stop at the load bound",
+      ),
+      local: na("Hosted version API scenario"),
+    },
+  },
   mcpRememberedListingFailure: {
     fixtures: "actors",
     file: "mcp-catalog-scale.spec.ts",
@@ -775,13 +884,55 @@ export const scenarios = plan({
   mcpSearchConcise: {
     file: "mcp-search-concise.spec.ts",
     title:
-      "A broad MCP tool search returns concise pages within the execute output budget and describe returns full signatures",
+      "A broad MCP tool search returns concise pages within their byte budget and describe returns full signatures",
     targets: {
       local: scheduled,
       "self-host": na("Shared MCP search; covered on local"),
       cloud: na("Shared MCP search; covered on local"),
     },
   },
+  mcpLargeResult: {
+    file: "mcp-large-result.spec.ts",
+    title:
+      "MCP execute and call return a result far over 100,000 bytes whole, as a success that parses, with every log line",
+    targets: {
+      local: scheduled,
+      "self-host": na("Hosted scenario covers self-host"),
+      cloud: na("Hosted scenario covers Cloud"),
+    },
+  },
+  mcpRpcLimitForged: {
+    file: "mcp-large-result.spec.ts",
+    title:
+      "A tool failure that only imitates the runtime's 32 MiB RPC limit is a likely cause a read may retry, and the unchanged retry succeeds",
+    targets: {
+      local: scheduled,
+      "self-host": na("Shared runtime classification; covered on local"),
+      cloud: na("Shared runtime classification; covered on local"),
+    },
+  },
+  mcpLargeResultHosted: {
+    fixtures: "actors",
+    file: "mcp-large-result.spec.ts",
+    title:
+      "Self-host and Cloud return an MCP result far over 100,000 bytes whole from execute and call, as a success that parses",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("Local scenario covers local"),
+    },
+  },
+  mcpLargeResultMemoryLimit: {
+    fixtures: "actors",
+    file: "mcp-large-result.spec.ts",
+    title:
+      "A Cloud MCP result too large for the session object's 128 MB memory gets an error naming that limit at once, and the session keeps working",
+    targets: {
+      cloud: { status: "scheduled", runtime: "attached" },
+      "self-host": na("Cloud's Durable Object memory limit; self-host returns the value whole"),
+      local: na("Cloud's Durable Object memory limit; local returns the value whole"),
+    },
+  },
   mcpExecuteConcurrency: {
     fixtures: "actors",
     file: "mcp-execute-concurrency.spec.ts",
@@ -1003,6 +1154,17 @@ export const scenarios = plan({
       local: na("Hosted version API scenario"),
     },
   },
+  liveOpenapiV1Documents: {
+    fixtures: "actors",
+    file: "live-openapi-import.spec.ts",
+    title:
+      "Live OpenAPI imports the documents Executor v1 imported: loose schema references, event streams beside JSON, paths with a query or fragment, and fields v1 ignored",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Loopback upstream fixture"),
+      local: na("Hosted version API scenario"),
+    },
+  },
   liveOpenapiNaming: {
     fixtures: "actors",
     file: "live-openapi-import.spec.ts",
@@ -1149,6 +1311,39 @@ export const scenarios = plan({
       local: na("The local dashboard does not batch its reads; most of them are live streams"),
     },
   },
+  dashboardReadStatus: {
+    fixtures: "actors",
+    file: "dashboard-read-batches.spec.ts",
+    title:
+      "Each batched dashboard read's span records the status it answered, and a server error fails it",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("The local dashboard does not batch its reads; most of them are live streams"),
+    },
+  },
+  dashboardBatchAuthentication: {
+    fixtures: "actors",
+    file: "dashboard-batch-authentication.spec.ts",
+    title:
+      "A dashboard batch checks its session and each membership once, without retaining authority for the next request",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("The local dashboard does not batch its reads"),
+    },
+  },
+  dashboardBatchIsolation: {
+    fixtures: "actors",
+    file: "dashboard-batch-isolation.spec.ts",
+    title:
+      "A dashboard batch answers each read with its own caller's identity, organization and role",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("The local dashboard does not batch its reads"),
+    },
+  },
   dashboardBuildChange: {
     fixtures: "actors",
     file: "dashboard-read-batches.spec.ts",
@@ -1373,15 +1568,99 @@ export const scenarios = plan({
   desktopCrashRecovery: {
     file: "desktop-recovery.spec.ts",
     title:
-      "desktop restarts a stopped or crashed local server with backoff, stops after a crash loop and restarts from the recovery page",
+      "desktop shows a background server stopped on purpose as stopped without starting one, joins the next one the CLI starts or starts one from that page, replaces a crashed one, shows recovery after three crashes within a minute and reconnects from the recovery page",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop background server connection"),
+      "self-host": na("Desktop background server connection"),
+    },
+  },
+  desktopSharedService: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop and CLI share one background server for a data directory, which keeps running after the desktop quits",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop background server connection"),
+      "self-host": na("Desktop background server connection"),
+    },
+  },
+  desktopMigrationMoved: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop moves its old data and port into the CLI's empty data directory once, before starting the server, leaves it private whatever the old directory's mode, and explains a move it cannot make yet",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop data migration"),
+      "self-host": na("Desktop data migration"),
+    },
+  },
+  desktopMigrationReplaced: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop data replaces the CLI's data in the shared directory, which is stopped, archived and named in a notice that shows once, on the launch that moved it",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop data migration"),
+      "self-host": na("Desktop data migration"),
+    },
+  },
+  desktopMigrationReplacedClosed: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop window closed while its data replaces the CLI's data ends the app once the move is done, before any server starts and with only the app's own menu meanwhile, and the next launch names the archived CLI data in a notice that shows once",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop data migration"),
+      "self-host": na("Desktop data migration"),
+    },
+  },
+  desktopMigrationSettings: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop moving its data into a CLI data directory that holds only settings keeps the CLI's env settings with the desktop's port, leaves out the CLI's key settings and turns the service back on, uses the CLI's settings as they are when a move kept from an earlier launch finishes, and names where its settings went and what changed in a notice",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop data migration"),
+      "self-host": na("Desktop data migration"),
+    },
+  },
+  desktopSlowStop: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop shows a background server that takes seconds to stop, answering that it is stopping, as stopped, without starting one or counting a crash, and joins the next one the CLI starts",
     targets: {
       local: {
         status: "not-run",
         reason:
           "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
       },
-      cloud: na("Desktop process supervision"),
-      "self-host": na("Desktop process supervision"),
+      cloud: na("Desktop background server connection"),
+      "self-host": na("Desktop background server connection"),
     },
   },
   desktopLateLoadFailure: {
@@ -1398,6 +1677,34 @@ export const scenarios = plan({
       "self-host": na("Desktop window loading"),
     },
   },
+  desktopDashboardRetry: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop loads a dashboard that failed to load again with a fresh pairing link, shows the dashboard's own recovery page, without reset, with the failure after three failures in a row, and pairs the window again from that page",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop window loading"),
+      "self-host": na("Desktop window loading"),
+    },
+  },
+  desktopStarterDeadline: {
+    file: "desktop-recovery.spec.ts",
+    title:
+      "desktop shows the start recovery page when its server starter stops answering after starting a server, ends the start attempt a hung starter left, and starts a server from that page",
+    targets: {
+      local: {
+        status: "not-run",
+        reason:
+          "Runs against the packaged desktop in the release workflow with desktop-recovery.config.ts.",
+      },
+      cloud: na("Desktop background server connection"),
+      "self-host": na("Desktop background server connection"),
+    },
+  },
   desktopClipboard: {
     file: "desktop-recovery.spec.ts",
     title: "desktop copy buttons write to the system clipboard",
@@ -1414,7 +1721,7 @@ export const scenarios = plan({
   desktopReset: {
     file: "desktop-recovery.spec.ts",
     title:
-      "desktop missing-key failure offers reset, which backs up the data with a manifest and starts fresh, or leaves it in place when the move fails",
+      "desktop missing-key failure offers reset, which backs up the data with a manifest and starts fresh, or leaves it in place when the move fails, and resets data whose background server was killed",
     targets: {
       local: {
         status: "not-run",
@@ -1428,7 +1735,7 @@ export const scenarios = plan({
   desktopResetWithheld: {
     file: "desktop-recovery.spec.ts",
     title:
-      "desktop does not offer reset when its data is in use, its key settings do not match, or the OS credential store is unavailable or denies access",
+      "desktop does not offer reset when its data is in use, its key settings do not match, EXECUTOR_KEY_STORAGE is invalid, which creates nothing, or the OS credential store is unavailable or denies access",
     targets: {
       local: {
         status: "not-run",
@@ -1455,7 +1762,7 @@ export const scenarios = plan({
   localBootstrapPair: {
     file: "local-bootstrap.spec.ts",
     title:
-      "local pair sends the key where the directory keeps it to its running server and never creates, replaces or moves keys",
+      "local pair needs no saved keys, and executor --server sends the key where the directory keeps it to its running server, never creating, replacing or moving keys",
     targets: {
       local: {
         status: "not-run",
@@ -1506,7 +1813,7 @@ export const scenarios = plan({
   localPair: {
     file: "local-pair.spec.ts",
     title:
-      "local pair prints a link for the running server and explains missing keys, a rejected key, a wrong port or another service on it without changing keys",
+      "local pair prints a link from the registered server whatever EXECUTOR_PORT says, and explains no running server, a rejected supplied key, a bad port or another service on it without changing keys",
     targets: {
       local: scheduled,
       cloud: na("Local CLI pairing"),
@@ -1516,7 +1823,7 @@ export const scenarios = plan({
   localUpgrade: {
     file: "local-upgrade.spec.ts",
     title:
-      "executor upgrade installs the newest release with the detected or chosen package manager, refuses an old Node, prints commands for one-shot and unknown installs, verifies the new command and names a running server to restart",
+      "executor upgrade installs the newest release with the detected or chosen package manager, refuses an old Node, prints commands for one-shot and unknown installs, verifies the new command, and stops a running background server for the install and starts it again on the new version, or the old one when the install fails",
     targets: {
       local: scheduled,
       cloud: na("Local CLI upgrade"),
@@ -1533,59 +1840,265 @@ export const scenarios = plan({
       "self-host": na("Local CLI commands"),
     },
   },
-  localStartupObservability: {
-    file: "local-startup-observability.spec.ts",
-    title: "local startup failures retain their resource phase and safe system code",
+  localServiceSharedStart: {
+    // The CLI starts and stops its own servers; an outer managed server would compete with them.
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "two concurrent `executor service start` share one background server on the configured port, registered in a private server.json",
     targets: {
       local: scheduled,
-      cloud: na("Local process startup"),
-      "self-host": na("Local process startup"),
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
     },
   },
-  optimisticObservability: {
-    fixtures: "actors",
-    file: "optimistic-observability.spec.ts",
-    appOrigin: true,
-    title: "optimistic replay failures are delivered without changing a submitted write",
+  localServiceJoin: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor` joins the running background server, prints where it runs, opens a one-use link that pairs a browser and exits; the start that created keys.json names it",
     targets: {
-      cloud: scheduled,
-      "self-host": scheduled,
-      local: na("Shared app client covered on hosted targets"),
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
     },
   },
-  browserErrorProvenance: {
-    fixtures: "actors",
-    file: "browser-error-provenance.spec.ts",
-    title: "automatic browser error reports include only failures raised by first-party scripts",
+  localServiceVersion: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor` replaces a background server of another version, and `executor service start` keeps the version that runs",
     targets: {
-      cloud: managedCloud,
-      "self-host": na("Cloud Sentry receiver"),
-      local: na("Cloud Sentry receiver"),
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
     },
   },
-  safariErrorProvenance: {
-    file: "safari-error-provenance.spec.ts",
-    title: "Safari reports only the page's own failures, not code evaluated into it",
+  localServiceStandalone: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor --standalone` runs a private server on another port without registering it, which a background start cannot stop, stops it when interrupted, fails once it stops on its own, and states its own reason when the background server holds the data directory",
     targets: {
-      cloud: managedCloud,
-      "self-host": na("Cloud Sentry receiver"),
-      local: na("Cloud Sentry receiver"),
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
     },
   },
-  hostedMalformedResourceLinks: {
-    fixtures: "actors",
-    file: "malformed-resource-links.spec.ts",
-    title: "Hosted resource links with malformed identifiers show the missing-page state",
+  localServicePortInUse: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service start` names EXECUTOR_PORT or `executor service set port`, whichever chose the port another program holds, and `executor apps` reports it as a LocalServerUnavailable failure",
     targets: {
-      cloud: scheduled,
-      "self-host": scheduled,
-      local: na("Local has no organization routes; its links run in the local scenario."),
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
     },
   },
-  localMalformedResourceLinks: {
-    file: "malformed-resource-links.spec.ts",
-    title: "Local resource links with malformed identifiers show the missing-page state",
-    targets: {
+  localServiceLifecycle: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service status`, `restart` and `stop` report, replace and stop the background server, which starts with a lone EXECUTOR_API_KEY in the client's environment",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceRegistration: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title: "a background server stops within ten seconds once its server.json is removed",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServicePortSetting: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service set port` stops the background server, and the next start listens on the new port",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceDirectoryLock: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "a second `executor serve` for a data directory the registered server holds exits with the directory-in-use message naming that server's URL, on its port or another",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceAppsCli: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor apps list` without --host starts the background server, and the next command reuses it; with the service disabled it runs a private server instead",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceEarlierServer: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service start` and `executor serve` refuse a data directory whose server.json names a running Executor from before the background service, and ignore such a record once nothing answers at its URL",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceImpostor: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "a process that replays a killed background server's service info on its port is not trusted: `executor service status` reports stopped, and `executor` neither pairs with it nor sends it the password",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceStopping: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service status` reports a background server that is stopping as stopping, and `executor service start` waits for it to exit, without joining it or asking it to stop, and then starts one",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceSuspendedLock: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "a suspended background server keeps its data directory however long ago it refreshed its lock: `executor --standalone` and a foreground `executor serve` on another port refuse it after a minute, `executor service status` says it is not responding, and once resumed it serves and refreshes its lock as before",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceCrashedLock: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "the next server takes over the lock a killed background server left at once, also when its process ID now names another running program, and when that program also listens on its port",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceReusedPid: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "`executor service stop` and `executor service start` never signal a program that now has a killed background server's process ID while its port accepts connections and never answers: they remove the registration and leave that program running",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServiceKeyStorageInvalid: {
+    fixtures: "cli",
+    file: "local-service.spec.ts",
+    title:
+      "an invalid EXECUTOR_KEY_STORAGE, in the environment or saved with `executor service set env`, makes `executor`, `executor service start`, `executor --standalone` and `executor serve` refuse before they create anything in the data directory",
+    targets: {
+      local: scheduled,
+      cloud: na("Local CLI background service"),
+      "self-host": na("Local CLI background service"),
+    },
+  },
+  localServeStalledOutput: {
+    file: "local-serve-shutdown.spec.ts",
+    title: "serve stops promptly on SIGTERM while nothing reads its output",
+    targets: {
+      local: scheduled,
+      cloud: na("Local process shutdown"),
+      "self-host": na("Local process shutdown"),
+    },
+  },
+  localServeClosedOutput: {
+    file: "local-serve-shutdown.spec.ts",
+    title:
+      "the local server keeps serving after the reader of its stdout or stderr closes the pipe",
+    targets: {
+      local: scheduled,
+      cloud: na("Local process output"),
+      "self-host": na("Local process output"),
+    },
+  },
+  localStartupObservability: {
+    file: "local-startup-observability.spec.ts",
+    title: "local startup failures retain their resource phase and safe system code",
+    targets: {
+      local: scheduled,
+      cloud: na("Local process startup"),
+      "self-host": na("Local process startup"),
+    },
+  },
+  optimisticObservability: {
+    fixtures: "actors",
+    file: "optimistic-observability.spec.ts",
+    appOrigin: true,
+    title: "optimistic replay failures are delivered without changing a submitted write",
+    targets: {
+      cloud: scheduled,
+      "self-host": scheduled,
+      local: na("Shared app client covered on hosted targets"),
+    },
+  },
+  browserErrorProvenance: {
+    fixtures: "actors",
+    file: "browser-error-provenance.spec.ts",
+    title: "automatic browser error reports include only failures raised by first-party scripts",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Cloud Sentry receiver"),
+      local: na("Cloud Sentry receiver"),
+    },
+  },
+  safariErrorProvenance: {
+    file: "safari-error-provenance.spec.ts",
+    title: "Safari reports only the page's own failures, not code evaluated into it",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Cloud Sentry receiver"),
+      local: na("Cloud Sentry receiver"),
+    },
+  },
+  hostedMalformedResourceLinks: {
+    fixtures: "actors",
+    file: "malformed-resource-links.spec.ts",
+    title: "Hosted resource links with malformed identifiers show the missing-page state",
+    targets: {
+      cloud: scheduled,
+      "self-host": scheduled,
+      local: na("Local has no organization routes; its links run in the local scenario."),
+    },
+  },
+  localMalformedResourceLinks: {
+    file: "malformed-resource-links.spec.ts",
+    title: "Local resource links with malformed identifiers show the missing-page state",
+    targets: {
       local: scheduled,
       "self-host": na("Hosted links run in the organization-scoped scenario."),
       cloud: na("Hosted links run in the organization-scoped scenario."),
@@ -1986,6 +2499,28 @@ export const scenarios = plan({
       local: na("Local runs its background jobs in its own server process."),
     },
   },
+  cloudJobOutcomes: {
+    fixtures: "actors",
+    file: "cloud-job-outcomes.spec.ts",
+    title:
+      "Cloud cron jobs record their outcome on their dispatch span, including a failure the job handled and still answered 204 for",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Self-host runs its background jobs in its own server process."),
+      local: na("Local runs its background jobs in its own server process."),
+    },
+  },
+  cloudJobBatchOutcomes: {
+    fixtures: "actors",
+    file: "cloud-job-outcomes.spec.ts",
+    title:
+      "Cloud cron jobs record their outcome over a batch: partial when the mail provider refuses one welcome of two, failed when it refuses the only one",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Self-host runs its background jobs in its own server process."),
+      local: na("Local runs its background jobs in its own server process."),
+    },
+  },
   cloudScheduleCoordinatorPlaced: {
     fixtures: "actors",
     file: "cloud-database-placement.spec.ts",
@@ -1997,6 +2532,28 @@ export const scenarios = plan({
       local: na("Local runs schedules in its own server process."),
     },
   },
+  cloudScheduleConnectionsClose: {
+    fixtures: "actors",
+    file: "cloud-database-placement.spec.ts",
+    title:
+      "Cloud's schedule coordinator closes its database connections when a pass ends, so it can hibernate between wakes",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Self-host runs schedules in its own server process."),
+      local: na("Local runs schedules in its own server process."),
+    },
+  },
+  cloudScheduleCapacity: {
+    fixtures: "actors",
+    file: "cloud-schedule-capacity.spec.ts",
+    title:
+      "Cloud's schedule coordinator keeps nine slow scheduled runs in flight at once and starts another due schedule while they run",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Self-host runs schedules in its own server process, with its own pool."),
+      local: na("Local runs schedules in its own server process, with its own pool."),
+    },
+  },
   cloudScheduleWakeStream: {
     fixtures: "actors",
     file: "cloud-schedule-wakes.spec.ts",
@@ -2111,7 +2668,7 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "cloud-mcp-session-restore.spec.ts",
     title:
-      "Cloud MCP sessions continue after their session object is evicted, restored from its storage only for a bearer that names the object",
+      "Cloud MCP sessions continue after their session object is evicted, restored from its storage only for a bearer that names the object, a program waiting for approval keeps its object, and a later resume says only what the object recorded",
     targets: {
       cloud: managedCloud,
       "self-host": na(
@@ -2185,6 +2742,26 @@ export const scenarios = plan({
       local: na("Exercises the hosted app deploy and tool call APIs."),
     },
   },
+  mcpAccountFailureIsolated: {
+    fixtures: "actors",
+    file: "mcp-account-failures.spec.ts",
+    title: "One account whose MCP server fails discovery leaves the app's other accounts usable",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a loopback upstream to exercise the shared Worker MCP transport."),
+      local: na("Exercises the hosted app deploy, tool call and MCP execute APIs."),
+    },
+  },
+  mcpRefusedEventStream: {
+    fixtures: "actors",
+    file: "mcp-event-stream.spec.ts",
+    title: "Remote MCP tools stay available when the server refuses the optional event stream",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a loopback upstream to exercise the shared Worker MCP transport."),
+      local: na("Exercises the hosted app deploy and tool call APIs."),
+    },
+  },
   templateAccounts: {
     fixtures: "actors",
     file: "template-accounts.spec.ts",
@@ -2895,6 +3472,20 @@ export const scenarios = plan({
       ),
     },
   },
+  appFetchBrotliUndecoded: {
+    fixtures: "actors",
+    file: "app-fetch-brotli.spec.ts",
+    title:
+      "an app's fetch receives a Brotli-encoded response as the bytes the service sent, never decoded by the runtime",
+    targets: {
+      "self-host": scheduled,
+      // The scenario reaches a loopback fixture.
+      cloud: managedCloud,
+      local: na(
+        "Hosted app routes; local runs apps with the same runner and the same compatibility flags.",
+      ),
+    },
+  },
   appFetchUnsupportedOption: {
     fixtures: "actors",
     file: "app-fetch-errors.spec.ts",
@@ -3276,6 +3867,17 @@ export const scenarios = plan({
       local: na("Exercises the shared OAuth lifecycle through hosted APIs."),
     },
   },
+  oauthRenewalEndedGrantCodes: {
+    fixtures: "actors",
+    file: "oauth-refresh-resilience.spec.ts",
+    title:
+      "OAuth renewal refused with a service's own code for a dead refresh token, at any HTTP status, asks to reconnect, stops renewing, and traces the code",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback issuer with controlled token endpoint failures."),
+      local: na("Exercises the shared OAuth lifecycle through hosted APIs."),
+    },
+  },
   oauthRenewalAheadOfExpiry: {
     fixtures: "actors",
     file: "oauth-refresh-resilience.spec.ts",
@@ -3319,6 +3921,17 @@ export const scenarios = plan({
       local: na("Exercises the shared OAuth lifecycle through hosted APIs."),
     },
   },
+  oauthUnconfirmedReadRenewal: {
+    fixtures: "actors",
+    file: "oauth-refresh-resilience.spec.ts",
+    title:
+      "A refused query no kept listing confirms, unlisted or built on apps beta.95, renews the grant without repeating the call, and the next call uses the renewed token",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback issuer and resource with controlled token expiry."),
+      local: na("Exercises the shared OAuth lifecycle through hosted APIs."),
+    },
+  },
   oauthRenewalFailedAfterWrite: {
     fixtures: "actors",
     file: "oauth-refresh-resilience.spec.ts",
@@ -3605,6 +4218,16 @@ export const scenarios = plan({
       local: na("Exercises the shared importer and OAuth setup through hosted APIs."),
     },
   },
+  appNameValidation: {
+    fixtures: "actors",
+    file: "app-name-validation.spec.ts",
+    title: "App names with control or invisible-only characters are refused with a bad request",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud egress refuses loopback MCP hosts, so no Cloud scenario imports one."),
+      local: na("Exercises the shared importer and app rename through hosted APIs."),
+    },
+  },
   importApprovals: {
     fixtures: "actors",
     file: "import-approvals.spec.ts",
@@ -3864,6 +4487,41 @@ export const scenarios = plan({
       local: na("The hosted and local dashboards share the credential form and check contract."),
     },
   },
+  accountSecretFieldsExact: {
+    fixtures: "actors",
+    file: "account-secret-fields.spec.ts",
+    title:
+      "A multi-line secret with plus signs, percent escapes and non-ASCII text pasted into the credential form reaches the app's check exactly as pasted, before and after saving, and the accessibility tree holds none of it",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("The hosted and local dashboards share the credential form and check contract."),
+    },
+  },
+  accountSecretFieldsSummary: {
+    fixtures: "actors",
+    file: "account-secret-fields.spec.ts",
+    title:
+      "A paste or drop that spans lines replaces a credential field's value exactly and shows a summary that undo, label clicks and dragging leave unchanged, and Clear returns to the password input",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "The summary is in the shared browser form; the exact-paste scenario covers Cloud's transport.",
+      ),
+      local: na("The hosted and local dashboards share the credential form and check contract."),
+    },
+  },
+  webhookProviderSigningSecretExact: {
+    fixtures: "actors",
+    file: "account-secret-fields.spec.ts",
+    title:
+      "A provider signing secret that spans lines, pasted into a webhook's setup, reaches the webhook's handler exactly as pasted",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("Local's webhook setup uses the same shared setup form."),
+    },
+  },
   accountDescriptions: {
     fixtures: "actors",
     file: "account-descriptions.spec.ts",
@@ -4017,7 +4675,18 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "grouped-resources.spec.ts",
     title:
-      "workflow starts and webhook sources follow the caller's linked account, which a new link replaces, while unlinked history stays",
+      "workflow starts follow the caller's linked account, which a new link replaces, while unlinked history stays",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("Local resource controls have a separate paired-browser scenario."),
+    },
+  },
+  groupedWebhookSources: {
+    fixtures: "actors",
+    file: "grouped-resources.spec.ts",
+    title:
+      "webhook sources follow the caller's linked account, each configured on its own, which a new link replaces and unlinking stops",
     targets: {
       "self-host": scheduled,
       cloud: scheduled,
@@ -4166,34 +4835,91 @@ export const scenarios = plan({
       local: na("Exercises shared OAuth registration through the hosted API."),
     },
   },
-  oauthAhrefs: {
+  oauthResourceRefused: {
     fixtures: "actors",
-    file: "oauth-interop.spec.ts",
+    file: "oauth-resource-indicator.spec.ts",
     title:
-      "OAuth signs in to an Ahrefs-style MCP server whose token endpoint refuses a charset on the form media type",
+      "OAuth setup reports the resource indicator it will send, and a refused one fails sign-in naming that value and its source",
     targets: {
       "self-host": scheduled,
       cloud: na("Uses a scoped loopback OAuth issuer."),
       local: na("Exercises shared OAuth discovery and exchange through the hosted API."),
     },
   },
-  oauthCallbackNewTab: {
+  oauthResourceAudience: {
     fixtures: "actors",
-    file: "oauth-callback-new-tab.spec.ts",
-    title: "OAuth completes when the service's sign-in link opens in a new tab",
+    file: "oauth-resource-indicator.spec.ts",
+    title:
+      "A token issued for the metadata's resource and refused by the API is renewed with the same resource, and a declared resource fixes it",
     targets: {
       "self-host": scheduled,
       cloud: na("Uses a scoped loopback OAuth issuer."),
-      local: na("Covers the hosted callback page; the local page has its own scenario."),
+      local: na("Exercises shared OAuth discovery, exchange and renewal through the hosted API."),
     },
   },
-  oauthCallbackOtherUser: {
+  oauthResourceOmitted: {
     fixtures: "actors",
-    file: "oauth-callback-new-tab.spec.ts",
-    title: "Another member cannot finish a sign-in from its link, and its creator still can",
+    file: "oauth-resource-indicator.spec.ts",
+    title:
+      "OAuth setup and a refused sign-in say why no resource indicator was sent, and the app's settings can change it",
     targets: {
       "self-host": scheduled,
-      cloud: na("Uses a scoped loopback OAuth issuer."),
+      cloud: na("Uses scoped loopback OAuth issuers."),
+      local: na("Exercises shared OAuth discovery and exchange through the hosted API."),
+    },
+  },
+  oauthResourceOperator: {
+    fixtures: "actors",
+    file: "oauth-resource-indicator.spec.ts",
+    title:
+      "A refused resource indicator from the operator's OAuth client, or its absence, sends recovery to the instance administrator",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "Restarts a runner-owned product with the operator's client; managed Cloud has no per-case operator settings.",
+      ),
+      local: na("Local products have no operator OAuth clients."),
+    },
+  },
+  oauthResourceTransient: {
+    fixtures: "actors",
+    file: "oauth-resource-indicator.spec.ts",
+    title:
+      "A rate-limited or unavailable token endpoint that answers invalid_target keeps its own failure and Retry-After",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback OAuth issuer."),
+      local: na("Exercises shared OAuth exchange through the hosted API."),
+    },
+  },
+  oauthAhrefs: {
+    fixtures: "actors",
+    file: "oauth-interop.spec.ts",
+    title:
+      "OAuth signs in to an Ahrefs-style MCP server whose token endpoint refuses a charset on the form media type",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback OAuth issuer."),
+      local: na("Exercises shared OAuth discovery and exchange through the hosted API."),
+    },
+  },
+  oauthCallbackNewTab: {
+    fixtures: "actors",
+    file: "oauth-callback-new-tab.spec.ts",
+    title: "OAuth completes when the service's sign-in link opens in a new tab",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback OAuth issuer."),
+      local: na("Covers the hosted callback page; the local page has its own scenario."),
+    },
+  },
+  oauthCallbackOtherUser: {
+    fixtures: "actors",
+    file: "oauth-callback-new-tab.spec.ts",
+    title: "Another member cannot finish a sign-in from its link, and its creator still can",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Uses a scoped loopback OAuth issuer."),
       local: na("Local has one owner; hosted connections belong to the member who started them."),
     },
   },
@@ -4380,6 +5106,17 @@ export const scenarios = plan({
       local: na("Exercises shared OAuth through the hosted API."),
     },
   },
+  oauthGoogleRenewableGrant: {
+    fixtures: "actors",
+    file: "oauth-google-renewable-grant.spec.ts",
+    title:
+      "A Google sign-in asks for an offline grant with fresh consent unless the app declares otherwise",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Exercises shared OAuth sign-in through the hosted API; self-host covers it."),
+      local: na("Exercises shared OAuth sign-in through the hosted API."),
+    },
+  },
   oauthAuthorizationParams: {
     fixtures: "actors",
     file: "oauth-authorization-params.spec.ts",
@@ -4466,7 +5203,7 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "oauth-clients.spec.ts",
     title:
-      "Without an OAuth client for a service, administrators are told Executor provides none and register one from the connect form, and members enter their own details",
+      "Without an OAuth client for a service, administrators enter one in the connect form, which registers it before sign-in, keeps it when sign-in fails and edits it for the retry, and members enter their own details for one account",
     targets: {
       "self-host": scheduled,
       cloud: na("Uses a scoped loopback OAuth issuer."),
@@ -4825,6 +5562,15 @@ export const scenarios = plan({
       local: na("Local has no sign-in or SSO."),
     },
   },
+  selfHostSsoConnectPasswordAccount: {
+    file: "self-host-sso.spec.ts",
+    title: "Self-host SSO connects to a signed-in password account only for the same email",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud customer SSO has its own OIDC scenario."),
+      local: na("Local has no sign-in or SSO."),
+    },
+  },
   selfHostSsoUserinfoClaims: {
     file: "self-host-sso.spec.ts",
     title:
@@ -4913,6 +5659,30 @@ export const scenarios = plan({
       local: na("Hosted app routes; local shares the runtime and telemetry paths."),
     },
   },
+  scheduleRunTelemetry: {
+    fixtures: "actors",
+    file: "schedule-run-telemetry.spec.ts",
+    title:
+      "scheduled runs record whether the app's code or Executor's runtime failed them, and Cloud's dispatch records the due schedules it found",
+    targets: {
+      cloud: managedCloud,
+      "self-host": scheduled,
+      local: na("Hosted app routes; local shares the scheduler and runtime paths."),
+    },
+  },
+  hostApiRevision: {
+    fixtures: "actors",
+    file: "host-api-revision.spec.ts",
+    title:
+      "The Executor app keeps no tools from an API document of another revision, in its Worker or its database facet",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "Only the self-host test entry point serves another API revision; a Cloud test stage deployed twice checks the rollout itself.",
+      ),
+      local: na("Local serves no host API to its apps."),
+    },
+  },
   deferredServerPaths: {
     fixtures: "actors",
     file: "deferred-server-paths.spec.ts",
@@ -4924,6 +5694,18 @@ export const scenarios = plan({
       local: na("The API document and catalog installation are hosted product surfaces."),
     },
   },
+  cloudAppQueryAuth: {
+    fixtures: "actors",
+    file: "cloud-app-query-auth.spec.ts",
+    appOrigin: true,
+    title:
+      "Cloud app queries read current authorization without deleting expired verification records",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("AppPages has a separate Better Auth adapter only on Cloud."),
+      local: na("Local does not serve hosted app origins."),
+    },
+  },
   appUiApiDocument: {
     fixtures: "actors",
     managementApps: ["owner"],
@@ -5389,7 +6171,7 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "oauth-token-telemetry.spec.ts",
     title:
-      "Cloud OAuth token requests record their grant type, OAuth error, refresh-family revocation and client family without reporting them",
+      "Cloud OAuth token requests record their grant type, OAuth error, refresh-family revocation and client family, and registrations their refusal rule, without reporting them",
     targets: {
       cloud: managedCloud,
       "self-host": na("Cloud OAuth token endpoint instrumentation."),
@@ -5477,6 +6259,39 @@ export const scenarios = plan({
       local: na("The hosted Sentry reporter owns this behavior."),
     },
   },
+  mcpOrganizationSpans: {
+    fixtures: "actors",
+    file: "mcp-organization-spans.spec.ts",
+    title:
+      "Hosted MCP operation and bearer-check spans name only the caller's own organization and the caller by opaque ID, refused and failed ones included",
+    targets: {
+      "self-host": scheduled,
+      cloud: managedCloud,
+      local: na("Local has no organizations, so its MCP spans name none."),
+    },
+  },
+  organizationRequestSpans: {
+    fixtures: "actors",
+    file: "organization-request-spans.spec.ts",
+    title:
+      "Hosted management API request spans name only an organization the caller belongs to, and the caller, never one a refused request asks for",
+    targets: {
+      "self-host": scheduled,
+      cloud: managedCloud,
+      local: na("Local has no organizations, so its request spans name none."),
+    },
+  },
+  cloudMcpForwardOrganization: {
+    fixtures: "actors",
+    file: "mcp-organization-spans.spec.ts",
+    title:
+      "Cloud's gateway names an authenticated MCP request's organization and user on its forward even when the session object never answers",
+    targets: {
+      cloud: managedCloud,
+      "self-host": na("Self-host serves MCP sessions in its server process, with no gateway hop."),
+      local: na("Local serves MCP sessions in its server process, with no gateway hop."),
+    },
+  },
   mcpTelemetryPrivacy: {
     fixtures: "actors",
     file: "mcp-telemetry-privacy.spec.ts",
@@ -5860,6 +6675,19 @@ export const scenarios = plan({
       local: na("Local uses its configured instance API key."),
     },
   },
+  executorAppSetupLeavesVersion: {
+    fixtures: "actors",
+    legacyStorage: true,
+    file: "executor-key-account.spec.ts",
+    managementApps: ["owner", "admin"],
+    title:
+      "A member joining links their Executor key without redeploying the organization's Executor app",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Recording Executor's installed version writes the runner-owned product database."),
+      local: na("Local uses its configured instance API key."),
+    },
+  },
   sharedAuthorization: {
     fixtures: "actors",
     file: "shared-authorization.spec.ts",
@@ -6239,7 +7067,19 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "app-management-contracts.spec.ts",
     title:
-      "hosted agents read the apps release, are refused create without files, deploy the documented two-file app, get commit and deploy results as objects, see the files a commit removed, are refused a file inside a file, and learn the tool-only app has no UI",
+      "hosted agents read the apps release, are refused create without files, deploy the documented two-file app, get commit and deploy results as objects, and learn the tool-only app has no UI",
+    managementApps: ["owner"],
+    targets: {
+      "self-host": scheduled,
+      cloud: sourceStorageCloud,
+      local: na("Local runs the same agent programs in its own scenario."),
+    },
+  },
+  appManagementSavesHosted: {
+    fixtures: "actors",
+    file: "app-management-contracts.spec.ts",
+    title:
+      "hosted agents see the files a save removed and restore them, are refused a file inside a file or a path that is not Unicode, and get bounded lists of many removed files",
     managementApps: ["owner"],
     targets: {
       "self-host": scheduled,
@@ -6382,6 +7222,32 @@ export const scenarios = plan({
       local: na("Hosted account selection covers the shared catalog diagnostics."),
     },
   },
+  mcpFailureReference: {
+    fixtures: "actors",
+    file: "mcp-failure-reference.spec.ts",
+    title:
+      "MCP failures name their cause, the phase they stopped and the request's trace on search, call and execute",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "The failing MCP server is a loopback listener; the shared MCP diagnostics are covered on self-host.",
+      ),
+      local: na("Hosted self-host covers the shared MCP diagnostics."),
+    },
+  },
+  mcpFailureReferenceMatchedLimit: {
+    fixtures: "actors",
+    file: "mcp-failure-reference.spec.ts",
+    title:
+      "MCP failures call a runtime limit matched from an app Worker's own error a cause Executor has not confirmed",
+    targets: {
+      "self-host": na(
+        "The scenario above asserts the same unconfirmed match for the forged rejection on self-host.",
+      ),
+      cloud: managedCloud,
+      local: na("Hosted Cloud covers the shared runtime presentation."),
+    },
+  },
   mcpExecuteAppThrew: {
     fixtures: "actors",
     file: "mcp-execute-failures.spec.ts",
@@ -6418,7 +7284,7 @@ export const scenarios = plan({
     fixtures: "actors",
     file: "mcp-execute-failures.spec.ts",
     title:
-      "MCP approvals show exact arguments wherever they fit, shorten the saved prompt, run once approved and refuse requests too large to return with their size",
+      "MCP approvals show exact arguments wherever they fit, shorten the saved prompt, offer requests far over 100,000 bytes whole and run once approved",
     targets: {
       "self-host": scheduled,
       cloud: scheduled,
@@ -6487,6 +7353,27 @@ export const scenarios = plan({
       local: na("Hosted self-host covers the shared app runtime error mapping."),
     },
   },
+  mcpExecuteHintedReadTimedOut: {
+    fixtures: "actors",
+    file: "mcp-execute-failures.spec.ts",
+    title:
+      "MCP tools only their server labels read-only are not offered as retries after they time out",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("The silent MCP server is a loopback listener."),
+      local: na("Hosted self-host covers the shared app runtime error mapping."),
+    },
+  },
+  mcpExecuteToolReportedError: {
+    fixtures: "actors",
+    file: "mcp-execute-failures.spec.ts",
+    title: "MCP tool results that say the tool failed are listed as failed calls",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("The reporting MCP server is a loopback listener."),
+      local: na("Hosted self-host covers the shared execute path."),
+    },
+  },
   mcpExecutePendingWriteRefused: {
     fixtures: "actors",
     file: "mcp-execute-failures.spec.ts",
@@ -6564,6 +7451,17 @@ export const scenarios = plan({
       local: na("Hosted self-host covers the shared tool call path."),
     },
   },
+  mcpExecuteColdQueryNotReevaluated: {
+    fixtures: "actors",
+    file: "mcp-execute-failures.spec.ts",
+    title:
+      "A query that fails before its app's tools were listed is reported as possibly written without evaluating the app again",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("The recording service is a loopback listener."),
+      local: na("Hosted self-host covers the shared tool call path."),
+    },
+  },
   patMcpInFlight: {
     fixtures: "actors",
     file: "pat-mcp-in-flight.spec.ts",
@@ -6808,6 +7706,30 @@ export const scenarios = plan({
       cloud: na("Advances the wall clock and reads stored rows of a runner-owned product process."),
     },
   },
+  webhookSourceReconnectWait: {
+    fixtures: "actors",
+    legacyStorage: true,
+    file: "webhook-source-retry-backoff.spec.ts",
+    title:
+      "a webhook source whose account must reconnect checks it again after twice as long each time it still waits, and reconnecting the account resumes it at once",
+    targets: {
+      local: na("Hosted link and webhook source routes."),
+      "self-host": scheduled,
+      cloud: na("Advances the wall clock and reads stored rows of a runner-owned product process."),
+    },
+  },
+  webhookSourceSetupWait: {
+    fixtures: "actors",
+    legacyStorage: true,
+    file: "webhook-source-retry-backoff.spec.ts",
+    title:
+      "a webhook source waiting for its manual setup tries again after twice as long each time it still waits, and completing the setup runs it at once",
+    targets: {
+      local: na("Hosted link and webhook source routes."),
+      "self-host": scheduled,
+      cloud: na("Advances the wall clock and reads stored rows of a runner-owned product process."),
+    },
+  },
   webhookSourceEditors: {
     fixtures: "actors",
     file: "webhook-source-status.spec.ts",
@@ -7141,6 +8063,17 @@ export const scenarios = plan({
       local: na("Local has no organization roles or account audiences."),
     },
   },
+  hostedDepartedMemberAppLink: {
+    fixtures: "actors",
+    file: "departed-member-app-links.spec.ts",
+    title:
+      "an app link to a member's personal account stops filling the app's requirement when the member leaves and stays listed for its managers, while a shared account linked beside it keeps serving",
+    targets: {
+      local: na("Hosted members leave organizations; Local has one owner."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
   hostedAppLinkRoleLock: {
     fixtures: "actors",
     file: "app-account-link-role-lock.spec.ts",
@@ -7209,6 +8142,139 @@ export const scenarios = plan({
       cloud: scheduled,
     },
   },
+  hostedAccountWebhookDependencies: {
+    fixtures: "actors",
+    file: "account-webhook-dependencies.spec.ts",
+    title:
+      "deleting an account a live webhook registration ran with is refused naming that subscription, over REST and through the Executor app, while a disabled registration holds only its source account",
+    targets: {
+      local: na("Local has no organization members to depart."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedAccountWebhookHiddenDependents: {
+    fixtures: "actors",
+    file: "account-webhook-dependencies.spec.ts",
+    title:
+      "a member deleting their account refused for webhook subscriptions they can't see is told how many, never which apps or subscriptions, and can delete it once those are removed",
+    targets: {
+      local: na("Local has one user, who sees every app and subscription."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookAcrossDeploys: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual app-account webhook keeps its subscription, callback URL and secret across deploys that keep its setup, a deploy that changes the setup replaces it, and a caller's create is refused as app-managed",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookRollback: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "activating an earlier version moves a carried manual webhook back to it, so its deliveries run the active code, and activating the later version moves it forward again",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookStateSchema: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual webhook keeps its setup when a deploy reorders its state fields, and a deploy that changes what they accept replaces it in either direction",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookStateReference: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a deploy that reorders the anyOf branches a manual webhook's state schema references by position replaces its setup",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookNestedRequired: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual webhook keeps its setup when a deploy reorders a list of field names nested anywhere in its state schema, such as a Draft 7 dependency's required fields",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookDeepStateSchema: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual webhook keeps its setup across a deploy when its state schema nests 64 levels deep, and a deploy of an unchanged schema 65 or more levels deep replaces it instead of leaving its source pending",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookDeepConfiguration: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual webhook keeps its setup across a deploy when its configuration nests 64 levels deep, and a deploy of an unchanged configuration 65 or more levels deep replaces it instead of leaving its source pending",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookWideSetup: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a manual webhook keeps its setup across a deploy when the setup it compares is as long as the comparison allows, and a deploy of an unchanged setup one character longer replaces it",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookNestedWideSetup: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a deploy of an unchanged manual webhook setup whose configuration nests wide lists in each other, each fitting the comparison alone, replaces it",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      cloud: scheduled,
+    },
+  },
+  hostedManualWebhookConcurrentActivations: {
+    fixtures: "actors",
+    file: "app-account-webhooks.spec.ts",
+    title:
+      "a webhook source reconciling for an activation that another supersedes, also one back to the same version, is ready only once its manual and registered webhooks run the active version",
+    targets: {
+      local: na("Hosted managers and app links; Local has no organization roles."),
+      "self-host": scheduled,
+      // Deployed Cloud refuses the loopback provider fixture; the local Cloud Worker reaches it.
+      cloud: managedCloud,
+    },
+  },
   hostedAppSchedules: {
     fixtures: "actors",
     file: "app-schedules.spec.ts",
@@ -7486,6 +8552,39 @@ export const scenarios = plan({
       local: na("This scenario uses hosted memberships, API keys and MCP."),
     },
   },
+  workflowControls: {
+    fixtures: "actors",
+    file: "workflow-controls.spec.ts",
+    title:
+      "in-app workflow controls answer apps built before the version rename and refuse an over-long key before starting a run",
+    targets: {
+      "self-host": scheduled,
+      cloud: scheduled,
+      local: na("This scenario uses hosted app management routes."),
+    },
+  },
+  workflowStartReadBack: {
+    fixtures: "actors",
+    file: "workflow-controls.spec.ts",
+    title:
+      "an in-app workflow start whose saved run cannot be read back names the run, is not retryable, and starting again as advised makes no second run",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("The storage fault is mounted by the self-host test entry point."),
+      local: na("This scenario uses hosted app management routes."),
+    },
+  },
+  workflowStartCommit: {
+    fixtures: "actors",
+    file: "workflow-controls.spec.ts",
+    title:
+      "an in-app workflow start whose commit is refused, times out or loses its answer says the run may exist without offering a retry, and answers with the run once it reads it back",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("The storage fault is mounted by the self-host test entry point."),
+      local: na("This scenario uses hosted app management routes."),
+    },
+  },
   workflowStarts: {
     fixtures: "actors",
     file: "workflows.spec.ts",
@@ -7782,7 +8881,55 @@ export const scenarios = plan({
   },
   remoteRegistryFailures: {
     file: "registry-failures.spec.ts",
-    title: "Public app catalog refuses registry redirects and reports distinct registry failures",
+    title:
+      "Public app catalog refuses registry redirects, reports distinct registry failures and leaves out listings it cannot read",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud serves the registry from its own database instead of a remote origin."),
+      local: na(
+        "Local uses the same registry client; only self-host starts a scenario-owned server.",
+      ),
+    },
+  },
+  idlePollTraces: {
+    file: "idle-poll-traces.spec.ts",
+    title:
+      "An idle server's checks for due runs, queued jobs and event deliveries export no traces",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud dispatches on alarms and requests, not by polling."),
+      local: na(
+        "Local runs the same scheduler and event loops; only self-host starts a scenario-owned server.",
+      ),
+    },
+  },
+  telemetryStoreIdleAtBound: {
+    file: "telemetry-store-bound.spec.ts",
+    title:
+      "The bundled collector at its size bound keeps its traces while an idle server's exports trickle in",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud exports to its own collector, not the bundled one."),
+      local: na("Local ships the same collector bundle; the self-host run covers it."),
+    },
+  },
+  failedPollTraces: {
+    legacyStorage: true,
+    file: "idle-poll-traces.spec.ts",
+    title:
+      "A failing check for due runs, queued jobs or event deliveries exports which statement failed",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud dispatches on alarms and requests, not by polling."),
+      local: na(
+        "Local runs the same scheduler and event loops; only self-host starts a scenario-owned server.",
+      ),
+    },
+  },
+  remoteRegistryReleasedClients: {
+    file: "registry-failures.spec.ts",
+    title:
+      "Clients released before publisher scopes find a remote registry's listings by the names they were shown, are refused a name two listings share, and copy only the commit they were shown",
     targets: {
       "self-host": na(
         "This fork's self-host serves an organization-only registry from its own database, not a remote origin.",
@@ -7841,6 +8988,12 @@ export const scenarios = plan({
     title: "Cloud onboarding with Google opens prepared team confirmation",
     targets: cloudOnboarding,
   },
+  onboardingAssistant: {
+    file: "cloud-onboarding.spec.ts",
+    title:
+      "Cloud onboarding's assistant step notices any MCP client, and Claude's guide calls connected only an assistant that connects over MCP after it opens",
+    targets: cloudOnboarding,
+  },
   onboardingGithub: {
     file: "cloud-onboarding.spec.ts",
     title: "Cloud onboarding with GitHub retains edited team details through a failed confirmation",
@@ -7878,6 +9031,23 @@ export const scenarios = plan({
       "Cloud onboarding experiment serves accounts first without an exposure when its flag is unavailable",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  onboardingRequiredAccountsFirst: {
+    file: "cloud-onboarding-skip-experiment.spec.ts",
+    title:
+      "Cloud onboarding skip experiment required keeps accounts_first setup until both steps are done",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  onboardingRequiredAssistantFirst: {
+    file: "cloud-onboarding-skip-experiment.spec.ts",
+    title:
+      "Cloud onboarding skip experiment required keeps assistant_first setup until both steps are done",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  onboardingSkippable: {
+    file: "cloud-onboarding-skip-experiment.spec.ts",
+    title: "Cloud onboarding skip experiment skippable still skips both steps to the dashboard",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   // The v1 check reads the emulated v1 database only a managed local Cloud has, and its
   // scenarios write that database; deployed stages leave the check off.
   v1SignInStop: {
@@ -7932,18 +9102,72 @@ export const scenarios = plan({
       "Cloud v1 import keeps a workspace that fails verification frozen in v1, and accepts MCP requests v1 forwards for an imported workspace, with a new signed bearer for each request of a session, scopes a toolkit's bearer to the caller's own copy, and refuses a wrong signature, an expired or too long-lived bearer, an account, organization or toolkit copy the import never mapped, and a toolkit claim without its connection",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportOptInToolkits: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import moves an organization into the toolkit copies the opt-in import keyed by the toolkit alone, updating the copy its member kept and keeping the one they changed in v2 without making either a second copy, and runs v1's forwarded toolkit requests under those copies",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1HandoffSignIn: {
+    file: "cloud-v1-session-handoff.spec.ts",
+    title:
+      "Cloud v1 import hands a moved workspace's member from their v1 session to v2: the handoff starts a session for the user the import mapped and opens the organization with no referrer, a browser signed in as them is only redirected, one signed in as another member keeps its session, and a used token opens sign-in",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1HandoffRefusals: {
+    file: "cloud-v1-session-handoff.spec.ts",
+    title:
+      "Cloud v1 import opens v2 sign-in without a session for a handoff with a wrong signature, an expired or too long-lived token, another audience or version, a WorkOS user the import never mapped, or a member who has left the organization",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportToolkitCalls: {
     file: "cloud-v1-import.spec.ts",
     title:
       "Cloud v1 import makes toolkits over the workspace's and a member's connections callable through their v1 URLs, running the org toolkit's copy as the app the workspace's account is linked to and the personal toolkit's as the member's account",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportSplitConnections: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import moves an integration whose connections have different v1 rules as an app per connection, each with only its connection's account, tools and rules and a member's private to them, keeps one app for an integration whose moving connections share their rules, selects both apps for a toolkit over both connections and forwards each v1 call to its connection's app, plans the same apps in its dry run, and reuses every app, account and toolkit copy when it runs again",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportStampedApprovals: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import keeps asking before an MCP tool v1 stamped as needing approval after its server drops the destructive hint, and leaves the tools v1 allowed without a rule of their own",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportUnlistedRules: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import decides the tools v1 never listed by v1's rules: an MCP tool a rule blocks by name is left out, one no rule names asks as v1's catch-all rule says, an OpenAPI operation v1 compiled asks as its rule says, and the repair finds the import's own apps unchanged",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportRepair: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import repairs an MCP app moved before v1's approval stamps became rules: it plans without writing, deploys the earlier importer's app with the stamp as its own rule, gives an app an earlier import deployed the importer's source now, leaves an app whose users turned its approvals off or dropped them in v2 as they chose, keeps the code of an app its users changed beside its approvals and adds v1's approvals beneath it, finds nothing left on a second run, and runs the version a repair replaced again only while the app still runs the repair's",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportRollback: {
     file: "cloud-v1-import-run.spec.ts",
     title:
       "Cloud v1 import marks a verified workspace moved in v1 and gives it back on rollback only once its v2 organization is deleted, clearing its import map but its users",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportPaidBilling: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import carries a paid v1 Team subscription over to v2's Team plan on the same Stripe subscription with its renewal: per member with its seats and a cancellation at the end of its period, a flat price kept with unlimited members, and a grandfathered Hobby organization moved to v2's Free plan with its v1 customer untouched",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportBillingReturn: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import keeps a paid workspace whose subscription did not carry over frozen with its billing held, offering no v2 billing or checkout, gives the subscription back to v1 on the same Stripe subscription with its seats, past a free customer v1 made meanwhile, and then deleting the v2 organization cancels nothing and the workspace rolls back",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportRequests: {
     file: "cloud-v1-import.spec.ts",
     title:
@@ -7956,11 +9180,17 @@ export const scenarios = plan({
       "Cloud v1 import signs in and renews OAuth accounts with each connection's v1 client, granted scopes and resource, not the integration's method, refuses a token endpoint v1 no longer trusted, sends an OAuth integration's fixed credentials from a second account linked for everyone, and leaves out fixed headers that repeat the connection's own client ID and secret",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportCopiedMove: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import moves an organization already copied to v2 into that copy: its dry run reports the copy's slug, an account v1 renewed later takes v1's newer tokens while one v2 renewed keeps its own, both keep fitting their app after v1 renamed its integration, and an app its members deployed in v2 since keeps their version, while what they removed in v2 stays removed, also when v1 removed it too, and a teammate they added stays",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   // The operator clients it moves grants to are the ones every managed local Cloud starts with.
   v1ImportFirstParty: {
     file: "cloud-v1-import.spec.ts",
     title:
-      "Cloud v1 import moves connections that signed in through Executor's own apps to v2's operator client of the same name, including a GitHub-shaped MCP server that names the scopeless client's endpoints, which renews them with the granted scopes, sends the token to each of a service's hosts the client reaches, and refuses an app v2 does not offer, a scope it does not allow and a host its tokens never reach",
+      "Cloud v1 import moves connections that signed in through Executor's own apps to v2's operator client of the same name, including a GitHub-shaped MCP server that names the scopeless client's endpoints, which renews them with the granted scopes, sends the token to each of a service's hosts the client reaches, and refuses an app v2 does not offer, a scope it does not allow, a host its tokens never reach, a server that does not sign in with it and one whose resource metadata names another resource, each of which its dry run refuses first for the same reason",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
   v1ImportBuilds: {
@@ -7969,18 +9199,66 @@ export const scenarios = plan({
       "Cloud v1 import writes an OpenAPI document with characters beyond ASCII as ASCII JSON that reads as v1's, also for a large API whose name and base URL path go beyond Latin-1, which builds and calls with its v1 key, builds OpenAPI and GraphQL apps whose v1 OAuth clients set scopes in their authorization URLs, which reconnect sending v1's authorization and token requests, refusing a client whose request v2 cannot send as v1 did, and says why and where a stored specification cannot be read",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportMicrosoftGraph: {
+    file: "cloud-v1-import.spec.ts",
+    title:
+      "Cloud v1 import reads the large Graph document v1's Microsoft presets share one entry at a time, as v1 read it, and moves each preset into an app with exactly its v1 operations under v1's names and only the components they reach, skips a preset whose document has an entry that cannot be parsed, naming its line, and refuses one whose document is not block YAML",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportPlanOutage: {
     file: "cloud-v1-import.spec.ts",
     title:
       "Cloud v1 import retries v1 plan reads that time out or fail and still reports the organization",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportSplitNames: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import numbers the apps of members' connections that share a name when their integration becomes an app per connection, each private to its member, beside the workspace connection's app for everyone",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportShared: {
     file: "cloud-v1-import-run.spec.ts",
     title:
       "Cloud v1 import moves a shared workspace on the server and cuts it over once it verifies: the oldest admin owns it, members keep their roles without a welcome email, org connections become shared accounts linked for everyone and members' their own, a member's approve rule is dropped while their block applies to everyone, every member gets their own copy of an org toolkit, and a former member's rows stay behind",
     targets: { ...cloudOnboarding, cloud: managedCloud },
   },
+  v1ImportSlugDisplacement: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import gives a v1 workspace the slug a v2 team holds only when the operator listed that team in its allow table row: the dry run plans the team's new slug and writes nothing, the import renames the team and creates the workspace at the slug in one transaction, the team's member keeps it and its apps at the new slug while the old slug names the workspace, a listed team that does not hold the slug is reported and left alone, and an unlisted holder keeps its slug while the workspace takes a suffix",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportInto: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import moves an empty v1 workspace into the v2 team its one member owns when the operator listed that team in its allow table row: the dry run plans it and writes nothing, the import records the workspace against the team and marks it moved at the team's slug without creating an organization, user, membership or billing hold or changing the team, v1's forwarded MCP requests run in the team, starting it again and a later dry run find the team through its map row, billing return is refused, and a rollback gives the workspace back to v1 without deleting the team",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportIntoLeave: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import moves a v1 workspace into its member's v2 team without its data when the operator lists it to leave v1's data behind: the dry run counts v1's items and plans none, the import marks it moved at the team's slug with nothing copied and v1's rows untouched, and a rollback gives it back without changing the team",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportIntoCopy: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import copies a paid, shared v1 workspace into the empty v2 team its owner owns when the operator lists it: the team keeps its name and slug, gains the workspace's app, accounts and toolkit copies, its teammate joins, its subscription carries over to the team, a second copy into the team is refused as it is no longer empty, and after its billing goes back a rollback removes only what the import added",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportIntoRefused: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import refuses to move a v1 workspace into a listed existing v2 organization when it has items to copy, a second active member, a pending invitation or a paid plan, also when it would leave its data behind, when its owner has no v2 account or does not own the organization, also to copy into it, when the organization does not exist, and when the listed mode is unknown: the dry run says why, and the import holds it back and gives it to v1 again without writing its import map or changing the organization",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
+  v1ImportAllowed: {
+    file: "cloud-v1-import-run.spec.ts",
+    title:
+      "Cloud v1 import writes only organizations with a row in its allow table, refuses one without a row, a start that adds one and a start that pages through v1, writing nothing to v1 or v2, and runs dry runs whatever the table holds",
+    targets: { ...cloudOnboarding, cloud: managedCloud },
+  },
   v1ImportDryRun: {
     file: "cloud-v1-import-run.spec.ts",
     title:
@@ -8020,6 +9298,20 @@ export const scenarios = plan({
       ),
     },
   },
+  localSkillsInputSchema: {
+    file: "local-skills.spec.ts",
+    title:
+      "MCP skills accept exactly the inputs their advertised schema accepts, and every skills call the tool descriptions and Executor skills show succeeds",
+    targets: {
+      local: scheduled,
+      "self-host": na(
+        "Every product serves the same skills tool, descriptions and Executor skills from packages/mcp and app-templates; local reaches all three modes with one bearer.",
+      ),
+      cloud: na(
+        "Every product serves the same skills tool, descriptions and Executor skills from packages/mcp and app-templates; local reaches all three modes with one bearer.",
+      ),
+    },
+  },
   skillReadTelemetry: {
     fixtures: "actors",
     managementApps: ["owner"],
@@ -8083,6 +9375,16 @@ export const scenarios = plan({
       cloud: na("The CLI's hosted path needs a browser OAuth login; local uses an API key."),
     },
   },
+  localAppsCliPipedOutput: {
+    file: "local-apps-cli.spec.ts",
+    title:
+      "apps CLI prints source larger than a pipe holds in full to a slow reader, and stops quietly for one that closes early",
+    targets: {
+      local: scheduled,
+      "self-host": na("The CLI's hosted path needs a browser OAuth login; local uses an API key."),
+      cloud: na("The CLI's hosted path needs a browser OAuth login; local uses an API key."),
+    },
+  },
   localAppsCliRelease: {
     file: "local-apps-cli.spec.ts",
     title:
@@ -8504,6 +9806,21 @@ export const scenarios = plan({
       ),
     },
   },
+  oauthRefreshRedirectUri: {
+    legacyStorage: true,
+    file: "oauth-refresh-redirect-uri.spec.ts",
+    title:
+      "OAuth refreshes repeat the callback the sign-in used, and a grant an earlier release saved without one still refreshes without it",
+    targets: {
+      local: scheduled,
+      "self-host": na(
+        "Both hosts refresh grants through the same SDK; Local reaches the stored grant without organization fixtures.",
+      ),
+      cloud: na(
+        "Legacy rows need a runner-owned database; Cloud cases share one Worker and database.",
+      ),
+    },
+  },
   hostedSchedules: {
     fixtures: "actors",
     file: "hosted-schedules.spec.ts",
diff --git a/e2e/tests/account-health.spec.ts b/e2e/tests/account-health.spec.ts
index 09a5835003..ff3e271539 100644
--- a/e2e/tests/account-health.spec.ts
+++ b/e2e/tests/account-health.spec.ts
@@ -1,4 +1,5 @@
 import { expect, layer } from "@effect/vitest";
+import type { Page } from "playwright";
 import { Effect, Schema } from "effect";
 import { Actors } from "../support/actors.ts";
 import { Api, body } from "../support/api.ts";
@@ -6,6 +7,7 @@ import { Browser } from "../support/browser.ts";
 import { HostedLive, withHostedCase } from "../support/case.ts";
 import { Resource } from "../support/contracts.ts";
 import { connectionsPath, linkAccount } from "../support/app-accounts.ts";
+import { holdQuery, refreshVisiblePage } from "../support/query-transition.ts";
 import { acceptedToken, accountCheckUpstream } from "../support/account-check-upstream.ts";
 import { appsManifest } from "../support/apps-release.ts";
 import { scenarios } from "../test-plan.ts";
@@ -419,6 +421,90 @@ layer(HostedLive, { excludeTestServices: true })("Account health", (it) => {
           status: "healthy",
           current: true,
         });
+
+        // A redeploy while the page stays open outdates the result it already rechecked. Returning
+        // to the tab reads the accounts again, and the open page checks the account once more,
+        // showing the check in progress instead of the outdated result until it finishes.
+        yield* upstream.answer({ kind: "hang" });
+        const third = yield* api.request(actors.owner, "POST", `${identityPath}/deploy`, {
+          files: [
+            {
+              path: "index.ts",
+              content: `${source(identityCheck(upstream.origin))}\n// redeployed a third time`,
+            },
+            appsManifest,
+          ],
+        });
+        expect(third.status, JSON.stringify(third.body)).toBe(200);
+        expect(entry(yield* read(), identity)?.check).toMatchObject({ current: false });
+        yield* refreshVisiblePage;
+        const row = (page: Page) =>
+          page.locator(".accounts-section li").filter({ hasText: "Default" });
+        yield* browser.use("The open page checks the outdated result again", (page) =>
+          row(page).locator('[data-check-status="checking"]').waitFor(),
+        );
+        yield* browser.checkpoint("Outdated result being checked again");
+        yield* browser.use("Record every state the row shows until the check finishes", (page) =>
+          page.evaluate(() => {
+            const states: string[] = [];
+            Reflect.set(window, "checkStates", states);
+            new MutationObserver(() => {
+              const pill = [...document.querySelectorAll(".accounts-section li")]
+                .find((item) => item.textContent?.includes("Default"))
+                ?.querySelector<HTMLElement>("[data-check-status]");
+              states.push(`${pill?.dataset.checkStatus}:${pill?.dataset.checkCurrent}`);
+            }).observe(document.body, {
+              subtree: true,
+              childList: true,
+              attributes: true,
+              characterData: true,
+            });
+          }),
+        );
+        yield* browser.use("The new result replaces the check in progress", (page) =>
+          row(page)
+            .locator('[data-check-status="check_failed"][data-check-current="true"]')
+            .waitFor({ timeout: 30_000 }),
+        );
+        // The finished check shows its result at once; the row never falls back to the outdated one.
+        const states = yield* browser.use("Read the states the row showed", (page) =>
+          page.evaluate(() => Reflect.get(window, "checkStates") as string[]),
+        );
+        expect(
+          states.filter((state) => state.endsWith(":false")),
+          states.join(" > "),
+        ).toEqual([]);
+        yield* upstream.answer({ kind: "user" });
+
+        // A recheck that cannot reach the server leaves the outdated result, so the row says the
+        // check could not run and offers to try again instead of showing the outdated result.
+        const lost = yield* holdQuery(/\/accounts\/[^/]+\/health$/, "fail", { method: "POST" });
+        const fourth = yield* api.request(actors.owner, "POST", `${identityPath}/deploy`, {
+          files: [
+            {
+              path: "index.ts",
+              content: `${source(identityCheck(upstream.origin))}\n// redeployed a fourth time`,
+            },
+            appsManifest,
+          ],
+        });
+        expect(fourth.status, JSON.stringify(fourth.body)).toBe(200);
+        yield* refreshVisiblePage;
+        yield* lost.requested;
+        yield* lost.release;
+        yield* browser.use("The row says the check could not run", (page) =>
+          row(page).locator('[data-check-status="recheck_failed"]').waitFor(),
+        );
+        yield* browser.checkpoint("Recheck that could not run");
+        yield* browser.use("Try the check again", (page) =>
+          row(page).getByRole("button", { name: "Try again" }).click(),
+        );
+        yield* browser.use("Trying again shows the new result", (page) =>
+          row(page)
+            .locator('[data-check-status="healthy"][data-check-current="true"]')
+            .waitFor({ timeout: 30_000 }),
+        );
+        yield* browser.checkpoint("Result after trying again");
       }),
     ),
   );
diff --git a/e2e/tests/account-secret-fields.spec.ts b/e2e/tests/account-secret-fields.spec.ts
new file mode 100644
index 0000000000..37760f0e36
--- /dev/null
+++ b/e2e/tests/account-secret-fields.spec.ts
@@ -0,0 +1,472 @@
+/**
+ * A secret entered in the credential form reaches the app exactly as the user entered it. A
+ * single-line input turns pasted line breaks into spaces, so a paste or drop that spans lines
+ * replaces the field's value exactly and the field shows a summary without the secret's text.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import type { Locator } from "playwright";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { appLinksFixture, keyProvider } from "../support/app-links.ts";
+import { Browser } from "../support/browser.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { settleWebhookSubscriptions } from "../support/webhook-sources.ts";
+import { scenarios } from "../test-plan.ts";
+import { appsManifest } from "../support/apps-release.ts";
+
+const Check = Schema.Struct({
+  status: Schema.String,
+  info: Schema.NullOr(Schema.Struct({ displayName: Schema.optionalKey(Schema.String) })),
+  message: Schema.optionalKey(Schema.String),
+});
+const Checked = Schema.Struct({ fields: Schema.Struct({ privateKey: Schema.String }) });
+const Saved = Schema.Struct({ id: Schema.String });
+const Health = Schema.Struct({
+  apps: Schema.Array(
+    Schema.Struct({
+      app: Schema.String,
+      check: Schema.NullOr(Schema.Struct({ status: Schema.String })),
+    }),
+  ),
+  info: Schema.NullOr(Schema.Struct({ displayName: Schema.optionalKey(Schema.String) })),
+});
+const Control = Schema.Struct({
+  tag: Schema.String,
+  type: Schema.NullOr(Schema.String),
+  text: Schema.String,
+  focused: Schema.Boolean,
+});
+const Delivered = Schema.Struct({ secret: Schema.String });
+
+/**
+ * A synthetic PEM-shaped key with every character a form or URL decoder would change: line
+ * breaks, `+`, `%` escapes, `&`, `=`, a space and non-ASCII text. It is not a real key.
+ */
+const pasted =
+  "-----BEGIN PRIVATE KEY-----\nsynthetic+key/AB+cd==\r\nnot+a%2Breal&key=x%25 é€😀+\n-----END PRIVATE KEY-----\n";
+
+/**
+ * The control of the field labelled `name`: its input, or its summary. A label's text includes the
+ * summary's text, so the label can't be matched exactly.
+ */
+const labelled = (scope: Locator, name: string) => scope.getByLabel(name);
+
+/**
+ * Deploy an app whose key check passes only for `expected` and names each code point it received
+ * otherwise, then open its connection dialog in the browser.
+ */
+const openConnect = (expected: string) =>
+  Effect.gen(function* () {
+    const actors = yield* Actors;
+    const api = yield* Api;
+    const browser = yield* Browser;
+    const prefix = `/api/organizations/${actors.organization.id}`;
+    const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+      name: `Secret fields ${randomUUID().slice(0, 8)}`,
+      files: [
+        {
+          path: "index.ts",
+          content: `
+import { defineApp, defineProvider, object, plain, raw, router, secrets, string } from "apps";
+const expected = ${JSON.stringify(expected)};
+const codes = (text: string) => [...text].map((c) => c.codePointAt(0)).join(" ");
+const service = defineProvider({
+  name: "Signing fixture",
+  hosts: ["signing.invalid"],
+  auth: {
+    key: secrets({
+      label: "API key",
+      fields: object({ keyId: plain(string()), privateKey: raw(string()) }),
+    }),
+  },
+  async health({ account }) {
+    const received = account.fields.privateKey;
+    if (received !== expected) throw new Error("received code points " + codes(received));
+    return { accountInfo: { externalId: account.fields.keyId, displayName: "exact" } };
+  },
+});
+export default defineApp({ user: { accounts: { service } } }, async () => ({ tools: router({}) }));
+`,
+        },
+        appsManifest,
+      ],
+    });
+    expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+    const app = yield* body(App, deployed);
+    const account: { id?: string } = {};
+    yield* Effect.addFinalizer(() =>
+      Effect.gen(function* () {
+        if (account.id !== undefined)
+          yield* api.request(actors.owner, "DELETE", `${prefix}/accounts/${account.id}`);
+        yield* api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`);
+      }).pipe(Effect.orDie),
+    );
+
+    yield* browser.login(actors.owner);
+    yield* browser.use("Open the app's accounts", (page) =>
+      page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=accounts`),
+    );
+    yield* browser.use("Connect a new account", (page) =>
+      page.getByRole("button", { name: "Connect new account", exact: true }).click(),
+    );
+    const connect = yield* browser.use("The connection dialog opens", (page) => {
+      const dialog = page.getByRole("dialog", { name: "Connect Signing fixture", exact: true });
+      return dialog.waitFor({ state: "visible" }).then(() => dialog);
+    });
+    yield* browser.use("Enter the key id and allow the clipboard", (page) =>
+      connect
+        .getByLabel("Key Id", { exact: true })
+        .fill("synthetic-key-id")
+        .then(() => page.context().grantPermissions(["clipboard-read", "clipboard-write"])),
+    );
+    return { connect, prefix, app, account };
+  });
+
+/** Copy `text` to the clipboard and paste it into `field` with a real Ctrl+V. */
+const paste = (field: Locator, text: string) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    yield* browser.use(`Paste ${JSON.stringify(text)}`, (page) =>
+      page
+        .evaluate((value) => navigator.clipboard.writeText(value), text)
+        .then(() => field.focus())
+        .then(() => page.keyboard.press("ControlOrMeta+V")),
+    );
+  });
+
+/** Focus `field` and press `keys`. */
+const press = (field: Locator, keys: string) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    yield* browser.use(`Press ${keys}`, (page) =>
+      field.focus().then(() => page.keyboard.press(keys)),
+    );
+  });
+
+/** The element that shows `field`, its text and whether it has focus. */
+const control = (field: Locator) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    const read = yield* browser.use("Read the field's control", () =>
+      field.evaluate((element) => ({
+        tag: element.tagName.toLowerCase(),
+        type: element.getAttribute("type"),
+        text: element.textContent ?? "",
+        focused: document.activeElement === element,
+      })),
+    );
+    return yield* Schema.decodeUnknownEffect(Control)(read);
+  });
+
+/** A focused password input. */
+const password = { tag: "input", type: "password", text: "", focused: true };
+/** The focused summary of a value with `lines` lines. */
+const summary = (lines: number) => ({
+  tag: "output",
+  type: null,
+  text: `Multi-line value · ${lines} lines`,
+  focused: true,
+});
+
+/** Chromium's accessibility tree for the page, which assistive software reads, as JSON. */
+const accessibilityTree = Effect.gen(function* () {
+  const browser = yield* Browser;
+  return yield* browser.use("Read the accessibility tree", (page) =>
+    page
+      .context()
+      .newCDPSession(page)
+      .then((session) =>
+        session
+          .send("Accessibility.getFullAXTree")
+          .then((tree) => session.detach().then(() => JSON.stringify(tree.nodes))),
+      ),
+  );
+});
+
+/** Drag `text` out of a scratch textarea in `scope` and drop it on `field` with the mouse. */
+const drop = (scope: Locator, field: Locator, text: string) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    yield* browser.use(`Drop ${JSON.stringify(text)}`, (page) => {
+      const source = page.locator("#drag-source");
+      return scope
+        .evaluate((element, value) => {
+          const area = document.createElement("textarea");
+          area.id = "drag-source";
+          area.value = value;
+          area.style.cssText = "font: 16px monospace; padding: 0; width: 12rem; height: 4rem";
+          element.append(area);
+        }, text)
+        .then(() => source.selectText())
+        .then(() => source.dragTo(field, { sourcePosition: { x: 4, y: 8 } }))
+        .then(() => source.evaluate((element) => element.remove()));
+    });
+  });
+
+layer(HostedLive, { excludeTestServices: true })("Account secret fields", (it) => {
+  it.effect(scenarios.accountSecretFieldsExact.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api;
+        const actors = yield* Actors;
+        const browser = yield* Browser;
+        const { connect, prefix, app, account } = yield* openConnect(pasted);
+        const field = labelled(connect, "Private Key");
+        yield* paste(field, pasted);
+        const checked = yield* browser
+          .use("Validate the pasted key", (page) =>
+            Promise.all([
+              page.waitForResponse(
+                (response) =>
+                  response.request().method() === "POST" &&
+                  new URL(response.url()).pathname.endsWith("/credential-checks"),
+              ),
+              connect.getByRole("button", { name: "Validate API key", exact: true }).click(),
+            ]).then(([response]) => response.json() as Promise<unknown>),
+          )
+          .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Check)));
+        // The unsaved key reaches the app's check exactly as pasted: CRLF, LF and the final break.
+        expect(checked).toEqual({ status: "healthy", info: { displayName: "exact" } });
+        // The field shows how many lines it holds, and assistive software can't read the key.
+        expect(yield* control(field)).toMatchObject({ tag: "output", text: summary(4).text });
+        const tree = yield* accessibilityTree;
+        expect(tree).toContain("Multi-line value · 4 lines");
+        expect(tree).not.toContain("synthetic+key");
+        expect(tree).not.toContain("not+a%2Breal");
+
+        const saved = yield* browser
+          .use("Save the checked key", (page) =>
+            Promise.all([
+              page.waitForResponse(
+                (response) =>
+                  response.request().method() === "POST" &&
+                  new URL(response.url()).pathname.endsWith("/submit"),
+              ),
+              connect.getByRole("button", { name: "Continue", exact: true }).click(),
+            ]).then(([response]) => response.json() as Promise<unknown>),
+          )
+          .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Saved)));
+        account.id = saved.id;
+
+        // The stored key reaches the app's check unchanged too.
+        const response = yield* api.request(
+          actors.owner,
+          "POST",
+          `${prefix}/accounts/${saved.id}/health`,
+        );
+        expect(response.status, JSON.stringify(response.body)).toBe(200);
+        const health = yield* body(Health, response);
+        expect(health.apps.find((entry) => entry.app === app.id)?.check?.status).toBe("healthy");
+        expect(health.info?.displayName).toBe("exact");
+      }),
+    ),
+  );
+
+  it.effect(scenarios.accountSecretFieldsSummary.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const browser = yield* Browser;
+        const { connect } = yield* openConnect(pasted);
+        const field = labelled(connect, "Private Key");
+        const keyId = connect.getByLabel("Key Id", { exact: true });
+        const clear = connect.getByRole("button", { name: "Clear", exact: true });
+        /** The key the form sends to the app's check, once the form shows the check's result. */
+        const sent = browser
+          .use("Validate the key", (page) =>
+            Promise.all([
+              page.waitForRequest(
+                (request) =>
+                  request.method() === "POST" &&
+                  new URL(request.url()).pathname.endsWith("/credential-checks"),
+              ),
+              connect.getByRole("button", { name: "Validate API key", exact: true }).click(),
+            ]).then(([request]) =>
+              connect
+                .getByRole("button", { name: /^Continue/ })
+                .waitFor()
+                .then((): unknown => request.postDataJSON()),
+            ),
+          )
+          .pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Checked)),
+            Effect.map((checked) => checked.fields.privateKey),
+          );
+        const value = browser.use("Read the field", () => field.inputValue());
+
+        // A single-line paste goes into the password input, as on main, which shows only bullets.
+        yield* paste(field, "AB+%2B&=é");
+        expect(yield* control(field)).toEqual(password);
+        expect(yield* accessibilityTree).not.toContain("AB+%2B");
+        expect(yield* sent).toBe("AB+%2B&=é");
+
+        // Type into another field, which puts its edit last on the page's undo stack.
+        yield* press(keyId, "End");
+        yield* browser.use("Type into the key id", (page) => page.keyboard.type("-2"));
+        // A paste that spans lines replaces the whole value, even with the caret inside it.
+        yield* press(field, "End");
+        yield* press(field, "ArrowLeft");
+        yield* paste(field, "synthetic+SECRET\r\nsecond-line");
+        expect(yield* control(field)).toEqual(summary(2));
+        const tree = yield* accessibilityTree;
+        expect(tree).toContain("Multi-line value · 2 lines");
+        expect(tree).not.toContain("synthetic+SECRET");
+        expect(tree).not.toContain("second-line");
+
+        // Undo, a click on the label and dragging the summary change nothing.
+        yield* press(field, "ControlOrMeta+Z");
+        yield* browser.use("Click the field's label", () =>
+          connect.getByText("Private Key", { exact: true }).click(),
+        );
+        yield* browser.use("Drag the summary onto the key id and within itself", () =>
+          field
+            .click({ clickCount: 3 })
+            .then(() => field.dragTo(keyId))
+            .then(() => field.dragTo(field, { targetPosition: { x: 60, y: 8 } })),
+        );
+        expect(yield* control(field)).toMatchObject({ tag: "output", text: summary(2).text });
+        expect(yield* browser.use("Read the key id", () => keyId.inputValue())).toBe(
+          "synthetic-key-id-2",
+        );
+        expect(yield* sent).toBe("synthetic+SECRET\r\nsecond-line");
+
+        // Clear goes back to the empty password input and moves focus there.
+        yield* browser.use("Clear the value", () => clear.click());
+        expect(yield* control(field)).toEqual(password);
+        expect(yield* value).toBe("");
+
+        // Another paste that spans lines replaces the value exactly, with the breaks at its ends,
+        // into an empty input and over a single-line value alike.
+        yield* paste(field, "\nEF\nGH\n");
+        expect(yield* control(field)).toEqual(summary(3));
+        expect(yield* sent).toBe("\nEF\nGH\n");
+        yield* browser.use("Clear the value", () => clear.click());
+        yield* browser.use("Type a key", (page) => page.keyboard.type("old"));
+        yield* press(field, "ControlOrMeta+A");
+        yield* paste(field, "\nEF\nGH\n");
+        expect(yield* control(field)).toEqual(summary(3));
+        expect(yield* sent).toBe("\nEF\nGH\n");
+
+        // After Clear, a single-line paste is the input's own, as on main: Chromium drops the line
+        // break at its end, into an empty input and over a value alike.
+        yield* browser.use("Clear the value", () => clear.click());
+        yield* paste(field, "AB\r\n");
+        expect(yield* control(field)).toEqual(password);
+        expect(yield* sent).toBe("AB");
+        yield* press(field, "ControlOrMeta+A");
+        yield* browser.use("Type a key", (page) => page.keyboard.type("old"));
+        yield* press(field, "ControlOrMeta+A");
+        yield* paste(field, "AB\r\n");
+        expect(yield* sent).toBe("AB");
+
+        // Dropping text that spans lines works as pasting it.
+        yield* press(field, "ControlOrMeta+A");
+        yield* press(field, "Delete");
+        yield* drop(connect, field, "IJ\nKL");
+        expect(yield* control(field)).toEqual(summary(2));
+        expect(yield* sent).toBe("IJ\nKL");
+
+        // A plain field shows its value, so a paste that spans lines stays in its text input, as on
+        // main, where Chromium turns the line break into a space.
+        const plain = labelled(connect, "Key Id");
+        yield* press(plain, "ControlOrMeta+A");
+        yield* paste(plain, "plain-ID\nplain-tail");
+        expect(yield* control(plain)).toEqual({ ...password, type: "text" });
+        expect(yield* browser.use("Read the key id", () => plain.inputValue())).toBe(
+          "plain-ID plain-tail",
+        );
+      }),
+    ),
+  );
+
+  it.effect(scenarios.webhookProviderSigningSecretExact.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const browser = yield* Browser;
+        // The handler answers with the signing secret it was given.
+        const fixture = yield* appLinksFixture([
+          {
+            path: "index.ts",
+            content: `import { defineApp, defineProvider, secrets, query, object, string, router } from "apps";
+const team = ${keyProvider("Signing secret fixture")};
+const incoming = { account: { app: "team" }, config: object({}), state: object({}),
+  setup: { instructions: "Paste the provider's signing secret.", signingSecret: "provider" },
+  handle: async (ctx, { secret }) => Response.json({ secret }) };
+export default defineApp({ app: { accounts: { team: team.many() } } },
+  async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }), webhooks: { incoming } }));`,
+          },
+        ]);
+        const { api, actors, prefix, app, path, connect } = fixture;
+        const team = yield* connect(actors.owner, "app", "team", "owner-team");
+        const settled = (status: string) =>
+          settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+            hooks.some((hook) => hook.sourceAccount === team && hook.status === status),
+          ).pipe(
+            Effect.map((hooks) => hooks.find((hook) => hook.sourceAccount === team)),
+            Effect.flatMap((hook) =>
+              hook === undefined ? Effect.die(new Error("Webhook missing")) : Effect.succeed(hook),
+            ),
+          );
+        const hook = yield* settled("setup-required");
+        const setupPath = `${prefix}/webhook-setup/${app.id}/${hook.id}`;
+        // Remove the webhook, set up or not, so the app can be removed.
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            yield* api.request(actors.owner, "DELETE", setupPath);
+            yield* api.request(actors.owner, "POST", `${setupPath}/confirm-removal`);
+          }).pipe(Effect.orDie),
+        );
+        /** A synthetic signing secret that spans lines. It is not a real secret. */
+        const secret = "synthetic+signing/secret==\nsecond line%2B é\n";
+
+        yield* browser.login(actors.owner);
+        yield* browser.use("Open the webhook's setup", (page) =>
+          page
+            .goto(`/org/${actors.organization.slug}/webhooks/${app.id}/${hook.id}`)
+            .then(() => page.getByRole("heading", { name: "Set up webhook" }).waitFor())
+            .then(() => page.context().grantPermissions(["clipboard-read", "clipboard-write"])),
+        );
+        const field = yield* browser.use("Find the signing secret field", (page) =>
+          Promise.resolve(labelled(page.locator("form"), "Provider signing secret")),
+        );
+        yield* paste(field, secret);
+        const shown = yield* control(field);
+        const finished = yield* browser.use("Finish the setup", (page) =>
+          page
+            .getByRole("checkbox", { name: "I added this webhook in the provider." })
+            .check()
+            .then(() =>
+              Promise.all([
+                page.waitForResponse(
+                  (response) =>
+                    response.request().method() === "POST" &&
+                    new URL(response.url()).pathname === setupPath,
+                ),
+                page.getByRole("button", { name: "Finish setup", exact: true }).click(),
+              ]),
+            )
+            .then(([response]) => response.status()),
+        );
+        expect(finished).toBe(200);
+        const active = yield* settled("active");
+
+        // A delivery's handler gets the signing secret exactly as pasted.
+        const delivered = yield* api.request(
+          yield* api.session(),
+          "POST",
+          new URL(active.callbackUrl).pathname,
+          {},
+        );
+        expect(delivered.status, JSON.stringify(delivered.body)).toBe(200);
+        expect(yield* body(Delivered, delivered)).toEqual({ secret });
+        // The field showed a summary of the secret.
+        expect(shown).toEqual(summary(2));
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/account-webhook-dependencies.spec.ts b/e2e/tests/account-webhook-dependencies.spec.ts
new file mode 100644
index 0000000000..a54c09a878
--- /dev/null
+++ b/e2e/tests/account-webhook-dependencies.spec.ts
@@ -0,0 +1,300 @@
+/**
+ * A webhook subscription depends on its source account and on every account its registration ran
+ * with. Deleting an account those subscriptions still use is refused, naming them; a subscription
+ * that no longer uses the account does not hold it.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { body, type Session } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { appLinksFixture, keyProvider, ok, okBody } from "../support/app-links.ts";
+import {
+  settleWebhookSubscriptions,
+  webhookSubscriptions,
+  type WebhookSubscriptionRow,
+} from "../support/webhook-sources.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { managementApp } from "../support/management-app.ts";
+import { scenarios } from "../test-plan.ts";
+
+/**
+ * A registered webhook on the `source` requirement whose registration also runs with the `token`
+ * requirement's accounts, and a webhook on `manualSource` set up by hand.
+ */
+const source = `import { defineApp, defineProvider, secrets, query, object, string, router } from "apps";
+const team = ${keyProvider("Webhook dependency fixture")};
+const incoming = { account: { app: "source" }, config: object({}), state: object({}),
+  register: async () => ({}), unregister: async () => {},
+  handle: async (ctx) => Response.json({ token: ctx.app.accounts.token.map((item) => item.id) }) };
+const manual = { account: { app: "manualSource" }, config: object({}), state: object({}),
+  setup: { instructions: "Paste the callback URL into the provider's webhook settings.", signingSecret: "executor" },
+  handle: async () => Response.json({ received: true }) };
+export default defineApp({ app: { accounts: { source: team.many(), token: team.many(), manualSource: team.many() } } },
+  async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }), webhooks: { incoming, manual } }));`;
+/** A webhook on each member's `source`, registered with the app's `token` accounts. */
+const memberSource = `import { defineApp, defineProvider, secrets, query, object, string, router } from "apps";
+const team = ${keyProvider("Hidden webhook dependency fixture")};
+const incoming = { account: { user: "source" }, config: object({}), state: object({}),
+  register: async () => ({}), unregister: async () => {}, handle: async () => Response.json({}) };
+export default defineApp({ app: { accounts: { token: team.many() } }, user: { accounts: { source: team.many(), seed: team.many() } } },
+  async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }), webhooks: { incoming } }));`;
+/** The body clients decoded before the refusal named its subscriptions; it is closed. */
+const EarlierRefusal = Schema.Struct({
+  _tag: Schema.Literal("AccountWebhooksActive"),
+  account: Schema.String,
+  message: Schema.String,
+});
+const SessionIdentity = Schema.Struct({ user: Schema.Struct({ email: Schema.String }) });
+const Token = Schema.Struct({ key: Schema.RedactedFromValue(Schema.String), id: Schema.String });
+const Execution = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Boolean,
+    value: Schema.optional(Schema.Unknown),
+    error: Schema.optional(Schema.Unknown),
+  }),
+});
+
+layer(HostedLive, { excludeTestServices: true })("Account webhook dependencies", (it) => {
+  it.effect(scenarios.hostedAccountWebhookDependencies.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const fixture = yield* appLinksFixture([{ path: "index.ts", content: source }]);
+        const { api, actors, prefix, app, path, connect, unlink } = fixture;
+        const mcp = yield* McpClient;
+        const subscription = (name: string, account: string, status: string) =>
+          settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+            hooks.some(
+              (hook) =>
+                hook.name === name &&
+                hook.sourceAccount === account &&
+                hook.status === status &&
+                hook.failure === null,
+            ),
+          ).pipe(
+            Effect.map((hooks) =>
+              hooks.find(
+                (hook) =>
+                  hook.name === name && hook.sourceAccount === account && hook.status === status,
+              ),
+            ),
+            Effect.flatMap((hook) =>
+              hook === undefined ? Effect.die(new Error("Webhook missing")) : Effect.succeed(hook),
+            ),
+          );
+        const remove = (actor: Session, account: string) =>
+          api.request(actor, "DELETE", `${prefix}/accounts/${account}`);
+        /** Deleting the account is refused, naming exactly these subscriptions. */
+        const refusedFor = (
+          account: string,
+          blocking: ReadonlyArray<{ hook: WebhookSubscriptionRow; status: string }>,
+        ) =>
+          Effect.gen(function* () {
+            const response = yield* remove(actors.owner, account);
+            expect(response.status, JSON.stringify(response.body)).toBe(409);
+            // Clients and Executor apps holding the earlier document decode a closed object.
+            const refusal = yield* Schema.decodeUnknownEffect(EarlierRefusal)(response.body, {
+              onExcessProperty: "error",
+            });
+            expect(refusal.account).toBe(account);
+            for (const { hook, status } of blocking)
+              expect(refusal.message).toContain(`${app.id}/${hook.id} (${status})`);
+            expect(refusal.message.match(/whk_/g)?.length ?? 0).toBe(blocking.length);
+            return refusal.message;
+          });
+
+        // An API token for the app's own requirement, then a source account: the source's
+        // registration runs with both.
+        const token = yield* connect(actors.owner, "app", "token", "api-token", {
+          kind: "shared",
+          audience: { kind: "everyone" },
+        });
+        const own = yield* connect(actors.owner, "app", "source", "owner-source");
+        const registered = yield* subscription("incoming", own, "active");
+        // Unlinking the token leaves the registration depending on it: removing the subscription
+        // at the provider runs with the accounts it registered with.
+        yield* ok(yield* unlink(actors.owner, "token", token));
+        // No subscription names the token as its source, as the reporter saw.
+        expect(
+          (yield* webhookSubscriptions(actors.owner, path)).filter(
+            (hook) => hook.sourceAccount === token,
+          ),
+        ).toEqual([]);
+        const message = yield* refusedFor(token, [{ hook: registered, status: "active" }]);
+        expect(message).toContain("webhooks.remove");
+
+        // An agent deleting the account through the Executor app reads the same subscriptions.
+        const key = yield* body(
+          Token,
+          yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+            name: "Account webhook dependencies",
+          }),
+        );
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+            .pipe(Effect.orDie),
+        );
+        yield* managementApp(actors.owner);
+        const client = yield* mcp.connect(key.key, "account-webhook-dependencies", {
+          organization: actors.organization.id,
+        });
+        const disconnect = `return await tools.executor.accounts.disconnect(${JSON.stringify({ path: { organization: actors.organization.id, account: token } })})`;
+        const attempted = yield* Schema.decodeUnknownEffect(Execution)(
+          (yield* client.use("An agent deletes the API token account", (mcpClient, signal) =>
+            mcpClient.callTool({ name: "execute", arguments: { code: disconnect } }, undefined, {
+              signal,
+            }),
+          )).structuredContent,
+        );
+        expect(attempted.execution.ok, JSON.stringify(attempted.execution)).toBe(false);
+        expect(JSON.stringify(attempted.execution.error)).toContain(
+          `${app.id}/${registered.id} (active)`,
+        );
+
+        // Unlinking the source removes its registration with the token; then the token goes.
+        yield* ok(yield* unlink(actors.owner, "source", own));
+        yield* subscription("incoming", own, "stopped");
+        yield* ok(yield* remove(actors.owner, token));
+
+        // A registration Executor could not remove waits, disabled, for a person to remove it at
+        // the provider. That needs none of its accounts, so it does not hold the token it ran with.
+        const second = yield* connect(actors.owner, "app", "token", "second-token", {
+          kind: "shared",
+          audience: { kind: "everyone" },
+        });
+        const departed = yield* connect(actors.admin, "app", "source", "admin-source");
+        const stranded = yield* subscription("incoming", departed, "active");
+        const { user } = yield* body(
+          SessionIdentity,
+          yield* api.request(actors.admin, "GET", "/api/auth/get-session"),
+        );
+        yield* ok(
+          yield* api.request(actors.owner, "POST", "/api/auth/organization/remove-member", {
+            organizationId: actors.organization.id,
+            memberIdOrEmail: user.email,
+          }),
+        );
+        yield* ok(yield* unlink(actors.owner, "source", departed));
+        expect((yield* subscription("incoming", departed, "disabled")).id).toBe(stranded.id);
+        yield* ok(yield* unlink(actors.owner, "token", second));
+        yield* ok(yield* remove(actors.owner, second));
+
+        // A disabled subscription still holds its source: confirming its removal in the
+        // dashboard needs access to that account. Once confirmed, the source can go.
+        const manualAccount = yield* connect(actors.owner, "app", "manualSource", "manual-source");
+        const manual = yield* subscription("manual", manualAccount, "setup-required");
+        yield* ok(yield* unlink(actors.owner, "manualSource", manualAccount));
+        yield* subscription("manual", manualAccount, "disabled");
+        expect(yield* refusedFor(manualAccount, [{ hook: manual, status: "disabled" }])).toContain(
+          "webhooks.confirmRemoval",
+        );
+        for (const hook of [manual, stranded])
+          expect(
+            yield* okBody(
+              Schema.Struct({ status: Schema.String }),
+              yield* api.request(
+                actors.owner,
+                "POST",
+                `${path}/webhooks/${hook.id}/confirm-removal`,
+              ),
+            ),
+          ).toEqual({ status: "stopped" });
+        yield* ok(yield* remove(actors.owner, manualAccount));
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+
+  it.effect(scenarios.hostedAccountWebhookHiddenDependents.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const { api, actors, prefix, app, path, connect, link, unlink } = yield* appLinksFixture([
+          { path: "index.ts", content: memberSource },
+        ]);
+        const remove = (token: string) =>
+          api.request(actors.member, "DELETE", `${prefix}/accounts/${token}`);
+        const refusal = (token: string) =>
+          Effect.gen(function* () {
+            const response = yield* remove(token);
+            expect(response.status, JSON.stringify(response.body)).toBe(409);
+            return {
+              text: JSON.stringify(response.body),
+              message: (yield* Schema.decodeUnknownEffect(EarlierRefusal)(response.body)).message,
+            };
+          });
+        const registered = (actor: Session, account: string, status: string) =>
+          settleWebhookSubscriptions(actor, path, (hooks) =>
+            hooks.some((hook) => hook.sourceAccount === account && hook.status === status),
+          ).pipe(
+            Effect.map((hooks) => hooks.find((hook) => hook.sourceAccount === account)),
+            Effect.flatMap((hook) =>
+              hook === undefined ? Effect.die(new Error("Webhook missing")) : Effect.succeed(hook),
+            ),
+          );
+
+        // A member's shared token, linked by the owner for the app's own requirement, and a
+        // source account each: both registrations run with the token.
+        const token = yield* connect(actors.member, "user", "seed", "member-token", {
+          kind: "shared",
+          audience: { kind: "everyone" },
+        });
+        yield* ok(yield* link(actors.owner, "token", token));
+        const ownerSource = yield* connect(actors.owner, "user", "source", "owner-source");
+        const memberAccount = yield* connect(actors.member, "user", "source", "member-source");
+        const hidden = yield* registered(actors.owner, ownerSource, "active");
+        const own = yield* registered(actors.member, memberAccount, "active");
+        yield* ok(yield* unlink(actors.owner, "token", token));
+
+        const removers =
+          "Ask the person it runs as, or a manager of its app who can use its source account, to remove it.";
+        // The member sees only their own subscription; the refusal names only that one and
+        // counts the owner's.
+        expect((yield* webhookSubscriptions(actors.member, path)).map((hook) => hook.id)).toEqual([
+          own.id,
+        ]);
+        const partly = yield* refusal(token);
+        expect(partly.message).toContain(`${app.id}/${own.id} (active)`);
+        expect(partly.text).not.toContain(hidden.id);
+        expect(partly.message).toContain(
+          `1 webhook subscription you can't see also uses it. ${removers}`,
+        );
+
+        // Once the member can't see the app, the refusal names neither it nor its subscriptions.
+        yield* ok(
+          yield* api.request(
+            actors.member,
+            "DELETE",
+            `${path}/accounts/user/source/${memberAccount}`,
+          ),
+        );
+        yield* registered(actors.member, memberAccount, "stopped");
+        const access = yield* okBody(
+          Schema.Struct({ revision: Schema.String }),
+          yield* api.request(actors.owner, "GET", `${path}/access`),
+        );
+        yield* ok(
+          yield* api.request(actors.owner, "PATCH", `${path}/access`, {
+            revision: access.revision,
+            audience: { kind: "groups", groups: [] },
+          }),
+        );
+        expect((yield* api.request(actors.member, "GET", `${path}/webhooks`)).status).toBe(403);
+        const hiddenApp = yield* refusal(token);
+        expect(hiddenApp.text).not.toContain(app.id);
+        expect(hiddenApp.text).not.toContain("whk_");
+        expect(hiddenApp.message).toContain(
+          `1 webhook subscription you can't see uses this account, so it can't be deleted. ${removers}`,
+        );
+
+        // The hidden subscription still holds the token until its owner removes it.
+        yield* ok(
+          yield* api.request(actors.owner, "DELETE", `${path}/accounts/user/source/${ownerSource}`),
+        );
+        yield* registered(actors.owner, ownerSource, "stopped");
+        yield* ok(yield* remove(token));
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/api-document-patterns.spec.ts b/e2e/tests/api-document-patterns.spec.ts
index cb5db841cd..b630b5e4af 100644
--- a/e2e/tests/api-document-patterns.spec.ts
+++ b/e2e/tests/api-document-patterns.spec.ts
@@ -29,10 +29,30 @@ layer(TestLive, { excludeTestServices: true })("API document patterns", (it) =>
         const { paths } = yield* body(Document, response);
         const app = local ? "/v1/apps/{app}" : "/api/organizations/{organization}/apps/{app}";
 
-        // App names need a visible character; an expected commit is a full SHA-1.
-        expect(paths[`${app}/name`]).toMatchObject({
-          patch: { requestBody: json({ properties: { name: { pattern: "\\S" } } }) },
+        // App names are one line with a visible character. A caller compiles the published
+        // pattern without JavaScript's `u` flag, as most engines read patterns, and gets the rule.
+        const Rename = Schema.Struct({
+          patch: Schema.Struct({
+            requestBody: Schema.Struct({
+              content: Schema.Struct({
+                "application/json": Schema.Struct({
+                  schema: Schema.Struct({
+                    properties: Schema.Struct({ name: Schema.Struct({ pattern: Schema.String }) }),
+                  }),
+                }),
+              }),
+            }),
+          }),
         });
+        const name = new RegExp(
+          (yield* Schema.decodeUnknownEffect(Rename)(paths[`${app}/name`])).patch.requestBody
+            .content["application/json"].schema.properties.name.pattern,
+        );
+        for (const valid of ["Clock", " Café 日本語 👨‍👩‍👧 "])
+          expect(name.test(valid), valid).toBe(true);
+        for (const invalid of ["", " ", "Two\nlines", "Zero\u0000Width", "\u200b\u200d"])
+          expect(name.test(invalid), JSON.stringify(invalid)).toBe(false);
+        // An expected commit is a full SHA-1.
         const commit = { type: "string", pattern: "^[a-f0-9]{40}$" };
         expect(paths[`${app}/commits`]).toMatchObject({
           post: {
diff --git a/e2e/tests/app-account-picker.spec.ts b/e2e/tests/app-account-picker.spec.ts
index e32ab64cf1..2e8f925db4 100644
--- a/e2e/tests/app-account-picker.spec.ts
+++ b/e2e/tests/app-account-picker.spec.ts
@@ -720,14 +720,14 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
               .count(),
           ),
         ).toBe(0);
-        // Without a registered client, administrators are offered registration before entering one.
-        yield* browser.use("Administrators are offered client registration", (page) =>
+        // Without a registered client, administrators enter one and choose who can use it.
+        yield* browser.use("Administrators choose who can use the client", (page) =>
           page
             .getByRole("dialog")
-            .getByRole("button", { name: "Register OAuth client", exact: true })
+            .getByRole("combobox", { name: "Who can use this client", exact: true })
             .waitFor({ state: "visible" }),
         );
-        yield* browser.use("Enter client details instead", enterClientDetails);
+        yield* browser.use("Enter client details for this account", enterClientDetails);
         expect(
           yield* browser.use("Required client fields are present before submission", (page) =>
             page.getByRole("textbox", { name: "Client ID", exact: true }).count(),
@@ -745,7 +745,8 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
             dialog.getByRole("combobox").count(),
             dialog.getByRole("button", { name: "Copy redirect URL" }).count(),
           ]).then((counts) => {
-            expect(counts).toEqual([0, 0, 1]);
+            // The one selector asks who can use the client.
+            expect(counts).toEqual([0, 1, 1]);
           });
         });
         expect(
@@ -842,10 +843,10 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
           view: "accounts",
         });
 
-        yield* browser.use("The next attempt again offers registration first", (page) =>
+        yield* browser.use("The next attempt again asks who can use the client", (page) =>
           page
             .getByRole("dialog")
-            .getByRole("button", { name: "Register OAuth client", exact: true })
+            .getByRole("combobox", { name: "Who can use this client", exact: true })
             .waitFor({ state: "visible" }),
         );
         yield* browser.use("Enter client details for the next attempt", enterClientDetails);
diff --git a/e2e/tests/app-account-webhooks.spec.ts b/e2e/tests/app-account-webhooks.spec.ts
index ab9fdb1168..391c9767d7 100644
--- a/e2e/tests/app-account-webhooks.spec.ts
+++ b/e2e/tests/app-account-webhooks.spec.ts
@@ -4,9 +4,11 @@
  * themselves, and its registrations are removed with its last app link.
  */
 import { expect, layer } from "@effect/vitest";
-import { Effect, Schema } from "effect";
+import { Effect, Option, Schedule, Schema } from "effect";
 import { body, type Session } from "../support/api.ts";
 import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { Target } from "../support/platform.ts";
 import {
   linkAccount,
   linkAccountResponse,
@@ -24,6 +26,8 @@ import {
   userWebhookRequirements,
   userWebhookRequirementsSource,
 } from "../support/user-webhook-requirements.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { webhookRegistrationFixture } from "../support/webhook-registration.ts";
 import { scenarios } from "../test-plan.ts";
 
 /**
@@ -60,7 +64,65 @@ const manual = (account) => ({ account, config: object({}), state: object({}),
 export default defineApp({ app: { accounts: { team: team.many() } }, user: { accounts: { personal: team.many() } } },
   async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }),
     webhooks: { appHook: manual({ app: "team" }), personalHook: manual({ user: "personal" }) } }));`;
+/** Provider registration URLs for webhooks that register before and after the manual one. */
+interface Around {
+  readonly before: string;
+  readonly after: string;
+}
+/**
+ * One app-account webhook registered by hand, whose handler reports its code's `release` and
+ * whether the request carried the subscription's secret. `signingSecret` is the setup's, and
+ * `state` the source of the schema of the fields a person enters during setup, and `config` of its
+ * configuration's. With `around`, it is declared between two webhooks whose registrations call
+ * those URLs, so a scenario can hold a source's reconciliation before and after it reaches the
+ * manual one; their handlers report `release` too.
+ */
+const carriedSource = (
+  release: string,
+  signingSecret: "executor" | "provider",
+  state = "object({})",
+  around?: Around,
+  config = "object({})",
+) =>
+  `import { defineApp, defineProvider, secrets, query, object, string, number, json, jsonSchema, router } from "apps";
+const team = ${keyProvider("Carried webhook fixture")};
+const inbound = { account: { app: "team" }, config: ${config}, state: ${state},
+  setup: { instructions: ${JSON.stringify(`Paste the callback URL into the provider (${release}).`)}, signingSecret: ${JSON.stringify(signingSecret)} },
+  handle: async (ctx, { request, secret }) => Response.json({ release: ${JSON.stringify(release)}, signed: request.headers.get("x-secret") === secret }) };
+const registered = (url) => ({ account: { app: "team" }, config: object({}), state: object({}),
+  register: async (ctx) => { const response = await ctx.fetch(url, { method: "POST" }); if (!response.ok) throw new Error("Registration failed"); return {}; },
+  unregister: async () => {},
+  handle: async () => Response.json({ release: ${JSON.stringify(release)} }) });
+export default defineApp({ app: { accounts: { team: team.many() } } },
+  async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }),
+    webhooks: ${around === undefined ? "{ inbound }" : `{ before: registered(${JSON.stringify(around.before)}), inbound, after: registered(${JSON.stringify(around.after)}) }`} }));`;
 const Configure = Schema.Struct({ step: Schema.Literal("configure"), revision: Schema.String });
+const ConfigureWithSecret = Schema.Struct({
+  step: Schema.Literal("configure"),
+  revision: Schema.String,
+  signingSecret: Schema.Struct({ source: Schema.Literal("executor"), value: Schema.String }),
+});
+const StateSchemaSetup = Schema.Struct({
+  ...ConfigureWithSecret.fields,
+  stateSchema: Schema.Json,
+});
+const Pinned = Schema.Struct({
+  id: Schema.String,
+  name: Schema.String,
+  version: Schema.String,
+  status: Schema.String,
+  callbackUrl: Schema.String,
+});
+const Deployed = Schema.Struct({ version: Schema.Struct({ id: Schema.String }) });
+const Released = Schema.Struct({ release: Schema.String, signed: Schema.Boolean });
+const RegisteredRelease = Schema.Struct({ release: Schema.String });
+/** `WebhookFailed` as clients and Executor apps holding an earlier API document decode it. */
+const EarlierWebhookFailed = Schema.Struct({
+  _tag: Schema.Literal("WebhookFailed"),
+  reason: Schema.Literals(["unavailable", "definition", "input", "delivery", "inactive"]),
+  message: Schema.String,
+});
+const ActiveVersion = Schema.Struct({ activeVersion: Schema.String });
 const Subscription = Schema.Struct({ id: Schema.String, status: Schema.String });
 const Delivered = Schema.Struct({
   user: Schema.Boolean,
@@ -69,6 +131,154 @@ const Delivered = Schema.Struct({
 });
 const SessionIdentity = Schema.Struct({ user: Schema.Struct({ email: Schema.String }) });
 
+/** Deploys of the carried-webhook app, and reads and deliveries of its subscriptions. */
+const carriedWebhook = (fixture: Effect.Success<ReturnType<typeof appLinksFixture>>) => {
+  const { api, actors, prefix, app, path } = fixture;
+  const setupPath = (subscription: string) => `${prefix}/webhook-setup/${app.id}/${subscription}`;
+  const subscriptions = Effect.gen(function* () {
+    return (yield* okBody(
+      Schema.Array(Pinned),
+      yield* api.request(actors.owner, "GET", `${path}/webhooks`),
+    )).filter((row) => row.status !== "stopped");
+  });
+  const deploy = (
+    release: string,
+    signingSecret: "executor" | "provider",
+    state?: string,
+    around?: Around,
+    config?: string,
+  ) =>
+    api
+      .request(actors.owner, "POST", `${path}/deploy`, {
+        files: [
+          {
+            path: "index.ts",
+            content: carriedSource(release, signingSecret, state, around, config),
+          },
+          appsManifest,
+        ],
+      })
+      .pipe(
+        Effect.flatMap((response) => okBody(Deployed, response)),
+        Effect.map(({ version }) => version.id),
+      );
+  /**
+   * The app's subscriptions that are not stopped, once one is `status` (or any status) on `version`
+   * and every one still delivering is pinned to it: reconciliation creates or moves a version's
+   * subscription before it disables the ones that version replaced.
+   */
+  const pinnedTo = (version: string, status?: string) =>
+    Effect.gen(function* () {
+      for (;;) {
+        const rows = yield* subscriptions;
+        if (
+          rows.some(
+            (row) => row.version === version && (status === undefined || row.status === status),
+          ) &&
+          rows.every((row) => row.status === "disabled" || row.version === version)
+        )
+          return rows;
+        yield* Effect.sleep("100 millis");
+      }
+    }).pipe(
+      Effect.timeoutOrElse({
+        duration: "30 seconds",
+        orElse: () =>
+          Effect.die(new Error(`No subscription is ${status ?? "pinned"} on ${version}`)),
+      }),
+    );
+  /** A provider's delivery to a callback URL, signed with `secret`. */
+  const post = (callbackUrl: string, secret: string) =>
+    Effect.gen(function* () {
+      return yield* api.request(
+        yield* api.session(),
+        "POST",
+        new URL(callbackUrl).pathname,
+        {},
+        { "x-secret": secret },
+      );
+    });
+  const deliver = (callbackUrl: string, secret: string) =>
+    post(callbackUrl, secret).pipe(Effect.flatMap((response) => okBody(Released, response)));
+  /** Activate `version` while `expectedVersion` is active. */
+  const activate = (version: string, expectedVersion: string) =>
+    Effect.gen(function* () {
+      yield* ok(
+        yield* api.request(actors.owner, "POST", `${path}/activate`, { version, expectedVersion }),
+      );
+    });
+  /** Removing every subscription by hand, and confirming it at the provider, lets the app go. */
+  const removeAll = Effect.gen(function* () {
+    for (const row of yield* subscriptions) {
+      if (row.status !== "disabled")
+        expect(
+          yield* okBody(
+            Subscription,
+            yield* api.request(actors.owner, "DELETE", setupPath(row.id)),
+          ),
+        ).toMatchObject({ status: "disabled" });
+      expect(
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", `${setupPath(row.id)}/confirm-removal`),
+        ),
+      ).toMatchObject({ status: "stopped" });
+    }
+  });
+  /**
+   * Deploys `state` and `config` twice, the second time with only the handler changed, and expects
+   * the second deploy to replace the subscription the first gave instead of keeping it: a setup too
+   * deep or too long to compare counts as changed, as every deploy did before setups were carried.
+   * The source settles instead of staying pending.
+   */
+  const redeployReplaces = (release: string, state: string, config?: string) =>
+    Effect.gen(function* () {
+      const [replaced] = (yield* pinnedTo(
+        yield* deploy(`${release}-before`, "executor", state, undefined, config),
+        "setup-required",
+      )).filter((row) => row.status === "setup-required");
+      if (replaced === undefined) return yield* Effect.die(new Error("Webhook missing"));
+      const redeployed = yield* pinnedTo(
+        yield* deploy(release, "executor", state, undefined, config),
+        "setup-required",
+      );
+      expect(redeployed.find((row) => row.id === replaced.id)?.status).toBe("disabled");
+      const live = redeployed.filter((row) => row.status !== "disabled");
+      expect(live.map((row) => row.status)).toEqual(["setup-required"]);
+      const [replacement] = live;
+      if (replacement === undefined) return yield* Effect.die(new Error("Replacement missing"));
+      expect(replacement.id).not.toBe(replaced.id);
+      yield* settleWebhookSources(
+        actors.owner,
+        path,
+        (sources) =>
+          sources.length === 1 &&
+          sources[0]?.status === "failed" &&
+          sources[0]?.failure === "cleanup",
+      );
+      const opened = yield* okBody(
+        ConfigureWithSecret,
+        yield* api.request(actors.owner, "GET", setupPath(replacement.id)),
+      );
+      expect(yield* deliver(replacement.callbackUrl, opened.signingSecret.value)).toEqual({
+        release,
+        signed: true,
+      });
+      expect((yield* post(replaced.callbackUrl, opened.signingSecret.value)).status).toBe(410);
+    });
+  return {
+    setupPath,
+    subscriptions,
+    deploy,
+    pinnedTo,
+    post,
+    deliver,
+    activate,
+    removeAll,
+    redeployReplaces,
+  };
+};
+
 layer(HostedLive, { excludeTestServices: true })("App account webhooks", (it) => {
   it.effect(scenarios.hostedAppAccountWebhooks.title, (context) =>
     withHostedCase(
@@ -241,6 +451,40 @@ layer(HostedLive, { excludeTestServices: true })("App account webhooks", (it) =>
         yield* unlink(actors.member, "user", "personal", personal);
         yield* stopped("personalHook", personal);
         yield* settleWebhookSources(actors.owner, path, (sources) => sources.length === 0);
+
+        // Each webhook command's runtime span names its app and the part of the webhook's life it
+        // ran, so one app's failing handler can be told from the runtime's failures.
+        const telemetry = yield* Telemetry,
+          evidence = yield* Evidence,
+          target = yield* Target;
+        const runtime = target.metadata.target === "cloud" ? "runtime.cloud" : "runtime.workerd";
+        const operations = yield* telemetry
+          .spans(`${runtime}.webhook`, { "executor.app.id": fixture.app.id })
+          .pipe(
+            Effect.map((spans) => spans.map((tags) => tags["executor.webhook.operation"])),
+            Effect.flatMap((operations) =>
+              operations.filter((operation) => operation === "handle").length >= 4 &&
+              operations.includes("register") &&
+              operations.includes("unregister")
+                ? Effect.succeed(operations)
+                : Effect.fail(new Error("The webhook commands' spans have not all arrived")),
+            ),
+            Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
+          );
+        yield* evidence.json("webhook-commands.json", operations);
+        expect(
+          operations.filter((operation) => operation === "handle"),
+          "One span for each delivery",
+        ).toHaveLength(4);
+        for (const operation of operations)
+          expect([
+            "definitions",
+            "validate",
+            "complete",
+            "register",
+            "unregister",
+            "handle",
+          ]).toContain(operation);
       }),
     ),
   );
@@ -365,6 +609,10 @@ layer(HostedLive, { excludeTestServices: true })("App account webhooks", (it) =>
           }),
         );
         expect(completed).toMatchObject({ id: appHook.id, status: "active" });
+        // Finishing the setup runs the admin's source, which is ready once it finds it active.
+        yield* settleWebhookSources(actors.owner, path, (sources) =>
+          sources.some((source) => source.account === adminAccount && source.status === "ready"),
+        );
         // They remove it, then confirm it was removed at the provider.
         const removed = yield* okBody(
           Subscription,
@@ -433,6 +681,668 @@ layer(HostedLive, { excludeTestServices: true })("App account webhooks", (it) =>
       }),
     ),
   );
+  it.effect(scenarios.hostedManualWebhookAcrossDeploys.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor") },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll } = carriedWebhook(fixture);
+
+        // Linking an account for the app creates its manual subscription, waiting for setup.
+        const account = yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+
+        // A deploy that keeps the setup keeps the subscription waiting for it: the same callback
+        // URL and generated secret, so a setup the person already started at the provider holds,
+        // and the page they opened before the deploy still completes it.
+        const second = yield* deploy("second", "executor");
+        const waiting = yield* pinnedTo(second, "setup-required");
+        expect(waiting.map((row) => row.id)).toEqual([first.id]);
+        const reopened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        expect(reopened.signingSecret.value).toBe(opened.signingSecret.value);
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: {},
+          }),
+        );
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "second",
+          signed: true,
+        });
+
+        // A completed setup stays active on the next deploy, and the new code handles its
+        // deliveries at the URL the provider already has.
+        const third = yield* deploy("third", "executor");
+        const active = yield* pinnedTo(third, "active");
+        expect(active.map((row) => row.id)).toEqual([first.id]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "third",
+          signed: true,
+        });
+
+        // A caller cannot create an app-account webhook's subscription; the refusal says the
+        // app's link creates it instead of reporting a generic mismatch.
+        const explicit = yield* api.request(actors.owner, "POST", `${path}/webhooks`, {
+          key: "explicit",
+          name: "inbound",
+          sourceAccount: account,
+          config: {},
+        });
+        const created = yield* refused(explicit, 422, "WebhookFailed");
+        expect(created.reason).toBe("input");
+        // Clients and Executor apps holding an earlier document still decode the refusal, which
+        // they check as a closed object, and get its explanation.
+        const earlier = Schema.decodeUnknownOption(EarlierWebhookFailed, {
+          onExcessProperty: "error",
+        })(explicit.body);
+        expect(Option.getOrUndefined(earlier)?.message).toMatch(
+          /source is an app account, so a caller cannot create its subscription/,
+        );
+
+        // A deploy whose setup takes the secret from the provider instead cannot keep the setup:
+        // it needs a new one, and the old subscription waits for removal at the provider.
+        const fourth = yield* deploy("fourth", "provider");
+        const replaced = yield* pinnedTo(fourth, "setup-required");
+        expect(replaced.find((row) => row.id === first.id)?.status).toBe("disabled");
+        expect(replaced.filter((row) => row.id !== first.id).map((row) => row.status)).toEqual([
+          "setup-required",
+        ]);
+        yield* removeAll;
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookRollback.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor") },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, activate, removeAll } =
+          carriedWebhook(fixture);
+        const original = yield* okBody(
+          ActiveVersion,
+          yield* api.request(actors.owner, "GET", path),
+        );
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: {},
+          }),
+        );
+        yield* deploy("second", "executor");
+        const third = yield* deploy("third", "executor");
+        expect((yield* pinnedTo(third, "active")).map((row) => row.id)).toEqual([first.id]);
+
+        // Activating the first version again moves the subscription back to it: the provider's
+        // deliveries reach the code that is active, not the later code that carried it.
+        yield* activate(original.activeVersion, third);
+        const rolledBack = yield* pinnedTo(original.activeVersion, "active");
+        expect(rolledBack.map((row) => row.id)).toEqual([first.id]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "first",
+          signed: true,
+        });
+
+        // And forward again, to the version that carried it before.
+        yield* activate(third, original.activeVersion);
+        const restored = yield* pinnedTo(third, "active");
+        expect(restored.map((row) => row.id)).toEqual([first.id]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "third",
+          signed: true,
+        });
+        yield* removeAll;
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookStateSchema.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const declared = "object({ alpha: string(), beta: string() })";
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor", declared) },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll } = carriedWebhook(fixture);
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+
+        // Declaring the same fields in another order accepts the same entries, so the setup holds.
+        const reordered = yield* deploy(
+          "reordered",
+          "executor",
+          "object({ beta: string(), alpha: string() })",
+        );
+        expect((yield* pinnedTo(reordered, "setup-required")).map((row) => row.id)).toEqual([
+          first.id,
+        ]);
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: { alpha: "a", beta: "b" },
+          }),
+        );
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "reordered",
+          signed: true,
+        });
+
+        // A change to what the fields accept needs a new setup, in either direction: each of these
+        // replaces the subscription, and the one it replaces waits for removal at the provider.
+        let current = first.id;
+        for (const [release, state] of [
+          ["optional", "object({ alpha: string(), beta: string().optional() })"],
+          ["required", declared],
+          ["retyped", "object({ alpha: number(), beta: string() })"],
+          ["retyped-back", declared],
+          ["added", "object({ alpha: string(), beta: string(), gamma: string() })"],
+          ["removed", declared],
+        ] as const) {
+          const rows = yield* pinnedTo(yield* deploy(release, "executor", state), "setup-required");
+          expect(rows.find((row) => row.id === current)?.status, release).toBe("disabled");
+          const live = rows.filter((row) => row.status !== "disabled");
+          expect(live.length, release).toBe(1);
+          expect(live[0]?.id, release).not.toBe(current);
+          current = live[0]?.id ?? current;
+        }
+        yield* removeAll;
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookStateReference.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        /** A state field whose schema is the first branch of an `anyOf`, named by its position. */
+        const referenced = (branches: ReadonlyArray<string>) =>
+          `jsonSchema(${JSON.stringify({
+            type: "object",
+            properties: { value: { $ref: "#/$defs/choice/anyOf/0" } },
+            required: ["value"],
+            additionalProperties: false,
+            $defs: { choice: { anyOf: branches.map((type) => ({ type })) } },
+          })})`;
+        const fixture = yield* appLinksFixture([
+          {
+            path: "index.ts",
+            content: carriedSource("first", "executor", referenced(["string", "number"])),
+          },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, post, deliver, removeAll } = carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: { value: "saved-text" },
+          }),
+        );
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "first",
+          signed: true,
+        });
+
+        // Reversing the branches keeps the same set of schemas, but the reference now names the
+        // number branch, so the entered text no longer fits: the deploy needs a new setup.
+        const reordered = yield* deploy("reordered", "executor", referenced(["number", "string"]));
+        const rows = yield* pinnedTo(reordered, "setup-required");
+        expect(rows.find((row) => row.id === first.id)?.status).toBe("disabled");
+        expect(rows.filter((row) => row.id !== first.id).map((row) => row.status)).toEqual([
+          "setup-required",
+        ]);
+        expect((yield* post(first.callbackUrl, opened.signingSecret.value)).status).toBe(410);
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookNestedRequired.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        /** A Draft 7 state schema: once `trigger` is entered, `alpha` and `beta` are required too. */
+        const dependent = (required: ReadonlyArray<string>) =>
+          `jsonSchema(${JSON.stringify({
+            $schema: "http://json-schema.org/draft-07/schema#",
+            type: "object",
+            properties: {
+              trigger: { type: "boolean" },
+              alpha: { type: "string" },
+              beta: { type: "string" },
+            },
+            required: ["trigger"],
+            dependencies: { trigger: { required } },
+            additionalProperties: false,
+          })})`;
+        const fixture = yield* appLinksFixture([
+          {
+            path: "index.ts",
+            content: carriedSource("first", "executor", dependent(["alpha", "beta"])),
+          },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll } = carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        // The dependency is evaluated: without `beta` the setup is refused.
+        expect(
+          (yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: { trigger: true, alpha: "a" },
+          })).status,
+        ).toBe(422);
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: { trigger: true, alpha: "a", beta: "b" },
+          }),
+        );
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "first",
+          signed: true,
+        });
+
+        // Listing the dependency's fields in another order accepts the same entries, so the
+        // provider keeps delivering to the same callback URL, now answered by the new code.
+        const reordered = yield* deploy("reordered", "executor", dependent(["beta", "alpha"]));
+        expect((yield* pinnedTo(reordered)).map((row) => [row.id, row.status])).toEqual([
+          [first.id, "active"],
+        ]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "reordered",
+          signed: true,
+        });
+
+        // The same holds wherever a schema can hold a list of field names: one schema puts a
+        // `required` list in every keyword position that holds a schema, and every other list of
+        // names, so reversing all of them at once keeps the setup.
+        const everywhere = (names: ReadonlyArray<string>) => {
+          const inner = { required: names };
+          const schema = [
+            "additionalItems",
+            "additionalProperties",
+            "contains",
+            "contentSchema",
+            "else",
+            "if",
+            "items",
+            "not",
+            "propertyNames",
+            "then",
+            "unevaluatedItems",
+            "unevaluatedProperties",
+          ];
+          const list = ["allOf", "anyOf", "items", "oneOf", "prefixItems"];
+          const map = [
+            "definitions",
+            "dependencies",
+            "dependentSchemas",
+            "patternProperties",
+            "properties",
+          ];
+          const positions = Object.fromEntries([
+            ...schema.map((keyword) => [keyword, { [keyword]: inner }]),
+            ...list.map((keyword) => [`${keyword}List`, { [keyword]: [inner] }]),
+            ...map.map((keyword) => [`${keyword}Map`, { [keyword]: { member: inner } }]),
+            ["dependencyNames", { dependencies: { member: names } }],
+            ["dependentRequired", { dependentRequired: { member: names } }],
+            ["required", inner],
+          ]);
+          return `jsonSchema(${JSON.stringify({
+            type: "object",
+            properties: { alpha: { type: "string" }, beta: { type: "string" } },
+            $defs: positions,
+          })})`;
+        };
+        const listed = yield* pinnedTo(
+          yield* deploy("everywhere", "executor", everywhere(["alpha", "beta"])),
+          "setup-required",
+        );
+        const replacement = listed.find((row) => row.status === "setup-required");
+        if (replacement === undefined) return yield* Effect.die(new Error("Replacement missing"));
+        const reversed = yield* deploy("reversed", "executor", everywhere(["beta", "alpha"]));
+        expect(
+          (yield* pinnedTo(reversed))
+            .filter((row) => row.status !== "disabled")
+            .map((row) => [row.id, row.status]),
+        ).toEqual([[replacement.id, "setup-required"]]);
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookDeepStateSchema.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        /**
+         * A state schema `2 * wraps + 4` objects and lists deep through Draft 7 dependencies, one
+         * more with `odd`. The app builds it, since a literal this deep is more than a Worker parses.
+         */
+        const nested = (wraps: number, odd = false) =>
+          `jsonSchema((() => { let deep = ${odd ? `{ not: { required: ["alpha", "beta"] } }` : `{ required: ["alpha", "beta"] }`};
+  for (let wrap = 0; wrap < ${wraps}; wrap++) deep = { dependencies: { member: deep } };
+  return { type: "object", $defs: { deep } }; })())`;
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor", nested(30)) },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll, redeployReplaces } =
+          carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+
+        // 64 levels is as deep as a schema is compared, so the unchanged setup is kept.
+        const carried = yield* deploy("carried", "executor", nested(30));
+        expect((yield* pinnedTo(carried)).map((row) => [row.id, row.status])).toEqual([
+          [first.id, "setup-required"],
+        ]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "carried",
+          signed: true,
+        });
+
+        // One level deeper is not compared: redeploying it unchanged gives a new setup. So does a
+        // schema 2,004 levels deep, past what recursion over it could reach.
+        yield* redeployReplaces("past", nested(30, true));
+        yield* redeployReplaces("deeper", nested(1000));
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookDeepConfiguration.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        /**
+         * A configuration whose default nests `levels` objects deep with its own, built by the app
+         * as a default, so the source's submitted configuration stays empty.
+         */
+        const nested = (levels: number) =>
+          `object({ payload: json().default((() => { let deep = "synthetic";
+  for (let level = 1; level < ${levels}; level++) deep = { member: deep };
+  return deep; })()) })`;
+        const fixture = yield* appLinksFixture([
+          {
+            path: "index.ts",
+            content: carriedSource("first", "executor", undefined, undefined, nested(64)),
+          },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll, redeployReplaces } =
+          carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+
+        // A configuration is compared to the same depth as a state schema.
+        const carried = yield* deploy("carried", "executor", undefined, undefined, nested(64));
+        expect((yield* pinnedTo(carried)).map((row) => [row.id, row.status])).toEqual([
+          [first.id, "setup-required"],
+        ]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "carried",
+          signed: true,
+        });
+
+        // One level deeper, and about 1,800 levels with a shallow state schema, give a new setup
+        // instead of leaving the source pending on the old code.
+        yield* redeployReplaces("past", "object({})", nested(65));
+        yield* redeployReplaces("deeper", "object({})", nested(1802));
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookWideSetup.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const state = `jsonSchema({ type: "object" })`;
+        /**
+         * A configuration whose default is a list of zeros and one padding string, so that the
+         * setup's compared text is `length` characters long: the JSON of its configuration, the
+         * source of its secret and its state schema, with members in name order.
+         */
+        const wide = (length: number) => {
+          const text = (zeros: number) =>
+            JSON.stringify({
+              config: { payload: [...Array.from({ length: zeros }, () => 0), ""] },
+              signingSecret: "executor",
+              stateSchema: { type: "object" },
+            }).length;
+          const zeros = Math.floor((length - text(0)) / 2);
+          return `object({ payload: json().default([...Array.from({ length: ${zeros} }, () => 0), "x".repeat(${length - text(zeros)})]) })`;
+        };
+        // The longest compared text: the largest declaration a Cloud isolate keeps, 2 MiB of
+        // UTF-16.
+        const longest = 1024 * 1024;
+        const fixture = yield* appLinksFixture([
+          {
+            path: "index.ts",
+            content: carriedSource("first", "executor", state, undefined, wide(longest)),
+          },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, deploy, pinnedTo, deliver, removeAll, redeployReplaces } =
+          carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          StateSchemaSetup,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        // The state schema is compared as declared.
+        expect(opened.stateSchema).toEqual({ type: "object" });
+
+        const carried = yield* deploy("carried", "executor", state, undefined, wide(longest));
+        expect((yield* pinnedTo(carried)).map((row) => [row.id, row.status])).toEqual([
+          [first.id, "setup-required"],
+        ]);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "carried",
+          signed: true,
+        });
+
+        // One character longer is not compared.
+        yield* redeployReplaces("longer", state, wide(longest + 1));
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookNestedWideSetup.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor") },
+        ]);
+        const { actors, path, connect } = fixture;
+        const { removeAll, redeployReplaces } = carriedWebhook(fixture);
+        yield* Effect.addFinalizer(() => removeAll.pipe(Effect.orDie));
+        yield* connect(actors.owner, "app", "team", "team-key");
+        yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        // 32 lists of 60,000 zeros, each the first element of the one around it, about 3.8 million
+        // characters. Every list fits the comparison on its own; together they are refused before
+        // the levels below are queued, instead of each level spending the same allowance again.
+        yield* redeployReplaces(
+          "nested",
+          "object({})",
+          `object({ payload: json().default((() => { let nested = 0;
+  for (let level = 0; level < 32; level++) {
+    const zeros = Array.from({ length: 60000 }, () => 0);
+    zeros[0] = nested;
+    nested = zeros;
+  }
+  return nested; })()) })`,
+        );
+      }),
+    ),
+  );
+  it.effect(scenarios.hostedManualWebhookConcurrentActivations.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        // The provider registrations of the webhooks declared before and after the manual one,
+        // each held until the scenario lets it answer.
+        const before = yield* webhookRegistrationFixture;
+        const after = yield* webhookRegistrationFixture;
+        const around = { before: before.url, after: after.url };
+        const fixture = yield* appLinksFixture([
+          { path: "index.ts", content: carriedSource("first", "executor") },
+        ]);
+        const { api, actors, path, connect } = fixture;
+        const { setupPath, subscriptions, deploy, post, deliver, activate } =
+          carriedWebhook(fixture);
+        // Registered subscriptions stop on removal and manual ones once it is confirmed, which
+        // the app's removal waits for.
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            for (const provider of [before, after]) {
+              yield* provider.recover;
+              yield* provider.fail;
+            }
+            for (const row of yield* subscriptions)
+              if (row.status !== "disabled")
+                yield* api.request(actors.owner, "DELETE", `${path}/webhooks/${row.id}`);
+            for (const row of yield* subscriptions)
+              if (row.status === "disabled")
+                yield* api.request(actors.owner, "POST", `${setupPath(row.id)}/confirm-removal`);
+          }).pipe(Effect.orDie),
+        );
+        yield* connect(actors.owner, "app", "team", "team-key");
+        const [first] = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
+          hooks.some((hook) => hook.status === "setup-required"),
+        );
+        if (first === undefined) return yield* Effect.die(new Error("Webhook missing"));
+        const opened = yield* okBody(
+          ConfigureWithSecret,
+          yield* api.request(actors.owner, "GET", setupPath(first.id)),
+        );
+        yield* okBody(
+          Subscription,
+          yield* api.request(actors.owner, "POST", setupPath(first.id), {
+            revision: opened.revision,
+            state: {},
+          }),
+        );
+
+        // The source starts reconciling version A and waits on its first registration while B
+        // activates. It then reaches the last registration with the manual webhook on B, and A
+        // activates again before that registration answers.
+        const raceA = yield* deploy("raceA", "executor", undefined, around);
+        yield* before.requested;
+        const raceB = yield* deploy("raceB", "executor", undefined, around);
+        yield* before.recover;
+        yield* before.fail;
+        yield* after.requested;
+        expect((yield* subscriptions).find((row) => row.id === first.id)?.version).toBe(raceB);
+        yield* activate(raceA, raceB);
+        yield* after.recover;
+        yield* after.fail;
+
+        // Work for a superseded activation, even one of the version active again, does not count:
+        // the source is ready only once it reconciled for A, and every subscription it delivers to
+        // runs A's code, the manual one at the URL and with the secret the provider has.
+        yield* settleWebhookSources(
+          actors.owner,
+          path,
+          (sources) => sources.length === 1 && sources[0]?.status === "ready",
+        );
+        expect(
+          (yield* okBody(ActiveVersion, yield* api.request(actors.owner, "GET", path)))
+            .activeVersion,
+        ).toBe(raceA);
+        expect(yield* deliver(first.callbackUrl, opened.signingSecret.value)).toEqual({
+          release: "raceA",
+          signed: true,
+        });
+        const live = yield* subscriptions;
+        expect(
+          live
+            .map((row) => [row.name, row.version, row.status])
+            .sort(([left = ""], [right = ""]) => left.localeCompare(right)),
+        ).toEqual([
+          ["after", raceA, "active"],
+          ["before", raceA, "active"],
+          ["inbound", raceA, "active"],
+        ]);
+        for (const row of live.filter((item) => item.id !== first.id))
+          expect(
+            yield* okBody(RegisteredRelease, yield* post(row.callbackUrl, "unsigned")),
+            row.name,
+          ).toEqual({ release: "raceA" });
+      }),
+    ),
+  );
   it.effect(scenarios.hostedUserWebhookRequirements.title, (context) =>
     withHostedCase(
       context,
diff --git a/e2e/tests/app-accounts-upgrade.spec.ts b/e2e/tests/app-accounts-upgrade.spec.ts
index 63b4193ced..ef649ca922 100644
--- a/e2e/tests/app-accounts-upgrade.spec.ts
+++ b/e2e/tests/app-accounts-upgrade.spec.ts
@@ -281,7 +281,7 @@ const upgradeFlow = <E, R>(
       before: { schedulesBefore, sourcesBefore, runsBefore, linksBefore, stepBefore },
       after: { version, step, scopes, nullable, schedulesAfter, sourcesAfter, linksAfter },
     });
-    expect(version).toEqual([{ value: "4.0.15" }]);
+    expect(version).toEqual([{ value: "4.0.16" }]);
     expect(step).toEqual([{ name: "app_account_links" }]);
     // The member's user link as it was, and the app link without a subject.
     expect(linksAfter).toEqual([
diff --git a/e2e/tests/app-failure-details.spec.ts b/e2e/tests/app-failure-details.spec.ts
index 6d570a3ad3..de1b6bd7ff 100644
--- a/e2e/tests/app-failure-details.spec.ts
+++ b/e2e/tests/app-failure-details.spec.ts
@@ -345,6 +345,11 @@ export default defineApp({}, {});`,
             kind,
             input: {},
           });
+        // The caller lists the tools first: only a kept listing confirms that a query only reads,
+        // so its failures keep a read's advice.
+        expect((yield* api.request(actors.owner, "GET", `${prefix}/${app.id}/tools`)).status).toBe(
+          200,
+        );
 
         // The app's own error name and message pass through, not a fixed SDK reason.
         const query = yield* body(ToolFailed, yield* call("fail", "query"));
@@ -413,7 +418,9 @@ export default defineApp({}, {});`,
           retryable: true,
         });
         expect(failure.message).toContain(appMarker);
-        expect(failure.message).toMatch(/ Retryable \(unchanged call\): yes\.$/);
+        expect(failure.message).toMatch(
+          / Retryable \(unchanged call\): yes\. Phase: [a-z]+\. Reference: [0-9a-f]{32}\.$/,
+        );
         const cacheRetryable = (tool: string) =>
           client
             .use(`Call the app query ${tool}`, (client, signal) =>
@@ -467,7 +474,9 @@ export default defineApp({}, {});`,
             ),
           ),
         );
-        expect(written.message).toMatch(/ Retryable \(unchanged call\): no\.$/);
+        expect(written.message).toMatch(
+          / Retryable \(unchanged call\): no\. Phase: [a-z]+\. Reference: [0-9a-f]{32}\.$/,
+        );
       }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
     ),
   );
diff --git a/e2e/tests/app-failure-telemetry.spec.ts b/e2e/tests/app-failure-telemetry.spec.ts
index 7d87b9ef5f..610e2fe0f4 100644
--- a/e2e/tests/app-failure-telemetry.spec.ts
+++ b/e2e/tests/app-failure-telemetry.spec.ts
@@ -288,6 +288,10 @@ layer(HostedLive, { excludeTestServices: true })("App failure telemetry", (it) =
             yield* Effect.addFinalizer(() =>
               api.request(actors.owner, "DELETE", `${prefix}/${app.id}`).pipe(Effect.orDie),
             );
+            // List its tools, as a caller discovering them does. Only the kept listing confirms
+            // that each query only reads, so its failures keep a read's classification.
+            const listed = yield* api.request(actors.owner, "GET", `${prefix}/${app.id}/tools`);
+            expect(listed.status, JSON.stringify(listed.body)).toBe(200);
             return app;
           });
 
@@ -469,13 +473,21 @@ layer(HostedLive, { excludeTestServices: true })("App failure telemetry", (it) =
         }
         // A rejected call and a reply that fails decoding: the caller is told no usable result
         // arrived, not that the app's tools could not load.
-        for (const failed of [rejected, malformed]) {
+        // Both runtimes match the rejection's text, which the app wrote, so a match is never
+        // stated as confirmed: a thrown read is unrecognized, a reply that fails decoding only
+        // matches an invalid reply.
+        const lost = "Executor did not receive a usable result from this tool call.";
+        for (const [failed, why] of [
+          [rejected, "The runtime did not recognize why."],
+          [
+            malformed,
+            "The runtime’s error matches this cause, which Executor has not confirmed: The app's reply does not match its host protocol.",
+          ],
+        ] as const) {
           expect(failed.response.status).toBe(502);
-          expect(yield* body(ResultLost, failed.response)).toMatchObject({
-            reason: "Executor did not receive a usable result from this tool call.",
-            message:
-              "Executor did not receive a usable result from this tool call. No further failure detail is available.",
-          });
+          const result = yield* body(ResultLost, failed.response);
+          expect(result.reason).toBe(`${lost} ${why}`);
+          expect(result.message).toBe(`${result.reason} No further failure detail is available.`);
           expect(JSON.stringify(failed.response.body)).not.toContain(marker);
         }
         // A failure after the tool returned, which the app's framework reports like an invalid
diff --git a/e2e/tests/app-fetch-brotli.spec.ts b/e2e/tests/app-fetch-brotli.spec.ts
new file mode 100644
index 0000000000..c15ccf7c7c
--- /dev/null
+++ b/e2e/tests/app-fetch-brotli.spec.ts
@@ -0,0 +1,72 @@
+/**
+ * The app runtime never decodes a Brotli response. workerd's bundled Brotli decoder has
+ * CVE-2026-111497, an out-of-bounds write a crafted stream can turn into code execution, so every
+ * Worker sets `no_brotli_content_encoding` and a service's `Content-Encoding: br` body reaches app
+ * code as the bytes the service sent, through the platform's `fetch` and the framework's
+ * `ctx.fetch` alike.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Api, body } from "../support/api.ts";
+import { Actors } from "../support/actors.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { brotliBody, egressUpstream } from "../support/egress-upstream.ts";
+
+const Received = Schema.Struct({
+  status: Schema.Number,
+  encoding: Schema.NullOr(Schema.String),
+  hex: Schema.String,
+});
+
+const fetchApp = `import { defineApp, object, string, query, router } from "apps";
+const received = async (response) => ({
+  status: response.status,
+  encoding: response.headers.get("content-encoding"),
+  hex: Array.from(new Uint8Array(await response.arrayBuffer()), (byte) => byte.toString(16).padStart(2, "0")).join(""),
+});
+const input = { input: object({ url: string() }) };
+export default defineApp({}, {
+  tools: router({
+    global: query(input, async (_ctx, { url }) => received(await fetch(url))),
+    fetched: query(input, async (ctx, { url }) => received(await ctx.fetch(url))),
+  }),
+});`;
+
+layer(HostedLive, { excludeTestServices: true })("App fetch Brotli", (it) => {
+  it.effect(scenarios.appFetchBrotliUndecoded.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const upstream = yield* egressUpstream;
+        const prefix = `/api/organizations/${actors.organization.id}/apps`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/deploy`, {
+          name: `Fetch Brotli ${randomUUID().slice(0, 8)}`,
+          files: [{ path: "index.ts", content: fetchApp }, appsManifest],
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed);
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.owner, "DELETE", `${prefix}/${app.id}`).pipe(Effect.orDie),
+        );
+
+        const sent = { status: 200, encoding: "br", hex: brotliBody.toString("hex") };
+        for (const tool of ["global", "fetched"]) {
+          const response = yield* api.request(
+            actors.owner,
+            "POST",
+            `${prefix}/${app.id}/tools/call`,
+            { tool, kind: "query", input: { url: `${upstream.origin}/brotli` } },
+          );
+          expect(response.status, JSON.stringify(response.body)).toBe(200);
+          expect(yield* body(Received, response), tool).toEqual(sent);
+        }
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/app-framework-pin.spec.ts b/e2e/tests/app-framework-pin.spec.ts
index 3782ef4436..88a11f4e96 100644
--- a/e2e/tests/app-framework-pin.spec.ts
+++ b/e2e/tests/app-framework-pin.spec.ts
@@ -465,7 +465,8 @@ const startupPin = (surface: Surface) =>
  * Cloudflare Artifacts, so this organization's apps report `failed` and keep the run retrying while
  * the scenario observes it. Each retrying pass records its next start, 30 seconds after the first
  * pass and doubling; no pass starts before the previous one's time, and a tick before it starts
- * none. Nothing is ever applied.
+ * none. Nothing is ever applied. A tick's `job.dispatch` records a failed or partial run when items
+ * it handled failed, and a completed one when it only waited out the backoff.
  */
 const cloudReport = (surface: Surface) =>
   Effect.gen(function* () {
@@ -481,10 +482,12 @@ const cloudReport = (surface: Surface) =>
     );
     yield* Effect.addFinalizer(() => surface.cleanup(app).pipe(Effect.ignore));
     const passes = dataStepPasses(log, step);
-    // Delivered `data_step.advance` spans of ticks that found the step waiting out its backoff.
+    // The traces of ticks that found the step waiting out its backoff.
     const waiting = telemetry
-      .spans("data_step.advance", { "data_step.name": step, "data_step.status": "waiting" })
-      .pipe(Effect.map((spans) => spans.length));
+      .search("data_step.advance", { "data_step.name": step, "data_step.status": "waiting" })
+      .pipe(Effect.map((found) => new Set(found.data.map(({ traceId }) => traceId))));
+    const dispatches = (attributes: Readonly<Record<string, string>>) =>
+      telemetry.search("job.dispatch", { "executor.job": "data-steps", ...attributes });
     const tick = Effect.scoped(
       http
         .get(
@@ -512,6 +515,7 @@ const cloudReport = (surface: Surface) =>
 
     // Restart the run now that this scenario's app exists, once no pass holds it.
     const logged = (yield* passes).length;
+    const dispatched = new Set((yield* dispatches({})).data.map(({ traceId }) => traceId));
     const restart = yield* processes
       .string(
         ChildProcess.make(
@@ -567,6 +571,20 @@ const cloudReport = (surface: Surface) =>
     );
     // This app and the organization's Executor app.
     expect(started.summary.owners[surface.owner]).toEqual({ failed: 2 });
+    // The tick that handled them records its failed items, though its job route answered 204.
+    const failedTicks = yield* dispatches({ "executor.job.failure": "DataStepItemFailed" }).pipe(
+      Effect.flatMap((found) => {
+        const fresh = found.data.filter(({ traceId }) => !dispatched.has(traceId));
+        return fresh.length === 0
+          ? Effect.fail(new Error("No dispatch with failed items has reached Motel"))
+          : Effect.succeed(fresh);
+      }),
+      Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 60 }),
+    );
+    for (const { span } of failedTicks) {
+      expect(["partial", "failed"]).toContain(span.tags["executor.outcome"]);
+      expect(span.tags["http.response.status_code"]).toBe("204");
+    }
 
     // A tick before the first pass's retry time finds the step waiting and starts no pass.
     expect(
@@ -576,13 +594,35 @@ const cloudReport = (surface: Surface) =>
     const waited = yield* waiting;
     const before = (yield* ofRun).length;
     yield* tick;
-    yield* waiting.pipe(
-      Effect.flatMap((count) =>
-        count > waited ? Effect.void : Effect.fail(new Error("No waiting tick delivered yet")),
-      ),
+    const waitingTrace = yield* waiting.pipe(
+      Effect.flatMap((traces) => {
+        const fresh = [...traces].find((trace) => !waited.has(trace));
+        return fresh === undefined
+          ? Effect.fail(new Error("No waiting tick delivered yet"))
+          : Effect.succeed(fresh);
+      }),
       Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 120 }),
     );
     expect((yield* ofRun).length).toBe(before);
+    // Waiting out a backoff is not a failure: that tick's dispatch records a completed run.
+    const waitingDispatch = yield* telemetry.query(waitingTrace).pipe(
+      Effect.flatMap((trace) => {
+        const dispatch = trace.data.find(
+          ({ span }) =>
+            span.operationName === "job.dispatch" && span.tags["executor.job"] === "data-steps",
+        );
+        return dispatch === undefined
+          ? Effect.fail(new Error("The waiting tick's dispatch has not arrived"))
+          : Effect.succeed(dispatch.span);
+      }),
+      Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 120 }),
+    );
+    expect(waitingDispatch.status).not.toBe("error");
+    expect(waitingDispatch.tags).toMatchObject({
+      "http.response.status_code": "204",
+      "executor.outcome": "completed",
+    });
+    expect(waitingDispatch.tags).not.toHaveProperty("executor.job.failure");
 
     // Once it passes, the next tick starts the next pass. The Worker's own cron may start it first.
     yield* Effect.sleep(Duration.millis(Math.max(0, retryAt(started) - Date.now())));
diff --git a/e2e/tests/app-git-remotes.spec.ts b/e2e/tests/app-git-remotes.spec.ts
index 3cf87e2b55..f5f1e11146 100644
--- a/e2e/tests/app-git-remotes.spec.ts
+++ b/e2e/tests/app-git-remotes.spec.ts
@@ -54,21 +54,6 @@ layer(HostedLive, { excludeTestServices: true })("App Git remotes", (it) => {
           expect(printed.code, printed.stderr).toBe(0);
           expect(printed.stdout.trim()).toBe(remote);
 
-          // The dashboard shows the same remote, not one on its own origin.
-          yield* browser.login(actors.owner);
-          yield* browser.use("Open the app's source", (page) =>
-            page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=source`),
-          );
-          yield* browser.use("Open the clone details", (page) =>
-            page.getByRole("button", { name: "Clone", exact: true }).click(),
-          );
-          expect(
-            yield* browser.use("Read the dashboard's clone URL", (page) =>
-              page.getByLabel("Git clone URL").inputValue(),
-            ),
-          ).toBe(remote);
-          yield* browser.checkpoint("The dashboard shows the host's remote");
-
           // Git clones and pushes through it with the CLI's session.
           const cloned = yield* tools.git(["clone", "--quiet", remote, "."]);
           expect(cloned.code, cloned.stderr).toBe(0);
@@ -221,6 +206,24 @@ layer(HostedLive, { excludeTestServices: true })("App Git remotes", (it) => {
           expect((yield* tools.git(["pull", "--quiet", "--ff-only", "origin", "main"])).code).toBe(
             0,
           );
+
+          // The dashboard shows the same remote, not one on its own origin. The browser records
+          // its page until the case ends, and Playwright encodes the time a page shows no change
+          // only when it closes; a page opened before the Git steps above would leave minutes of
+          // video to encode while the case cleans up.
+          yield* browser.login(actors.owner);
+          yield* browser.use("Open the app's source", (page) =>
+            page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=source`),
+          );
+          yield* browser.use("Open the clone details", (page) =>
+            page.getByRole("button", { name: "Clone", exact: true }).click(),
+          );
+          expect(
+            yield* browser.use("Read the dashboard's clone URL", (page) =>
+              page.getByLabel("Git clone URL").inputValue(),
+            ),
+          ).toBe(remote);
+          yield* browser.checkpoint("The dashboard shows the host's remote");
         }),
       ),
     // Signs in through the browser, runs the CLI several times, and clones and pushes over HTTP,
diff --git a/e2e/tests/app-management-contracts.spec.ts b/e2e/tests/app-management-contracts.spec.ts
index e4a82738bf..d0de92aeed 100644
--- a/e2e/tests/app-management-contracts.spec.ts
+++ b/e2e/tests/app-management-contracts.spec.ts
@@ -42,6 +42,7 @@ const Tool = Schema.Struct({ path: Schema.String, description: Schema.String });
 const Discovered = Completed(
   Schema.Struct({
     catalog: Schema.String,
+    commit: Schema.String,
     found: Schema.Array(Tool),
     create: Schema.String,
     release: Schema.Struct({ version: Schema.String }),
@@ -112,35 +113,45 @@ const Kept = Completed(
 /** The commit result itself, returned straight from execute. */
 const Committed = Completed(Commit);
 const Located = Completed(Schema.Unknown);
+/** A created app; its other fields are not under test here. */
+const Made = Completed(Schema.Struct({ id: Schema.String }));
 type Connection = Effect.Success<ReturnType<Effect.Success<typeof McpClient>["connect"]>>;
 
+/** Local routes have no organization, and their tools accept no empty path. */
+const routes = (organization?: string) => {
+  const tenant = organization === undefined ? {} : { organization };
+  return { tenant, scope: organization === undefined ? {} : { path: tenant } };
+};
+
+/** One execute program with the Executor app in scope; the result is its structured content. */
+const executeIn = (client: Connection) => (step: string, code: string) =>
+  client
+    .use(step, (client, signal) =>
+      client.callTool(
+        { name: "execute", arguments: { code: `const executor = tools.executor;\n${code}` } },
+        undefined,
+        { signal },
+      ),
+    )
+    .pipe(Effect.map((result) => result.structuredContent));
+
+/** deploy.md's MCP example: index.ts and a package.json pinning the reported version. */
+const documentedFiles = `[
+  { path: "index.ts", content: ${JSON.stringify(helloIndex)} },
+  { path: "package.json", content: JSON.stringify({ name: "hello", private: true, type: "module", dependencies: { apps: version } }) },
+]`;
+
 /**
  * Follow deploy.md: discover the catalog's constraints and the host's apps release, then create
  * the two-file app with files and deploy it. Create without files is refused. Later commit and
- * deploy results stay objects after the source outgrows an execute result. A save that leaves a
- * file out names it in `removed`, and committing it again restores its contents. A save that
- * nests a file under a file, or names a path that is not valid Unicode, is refused and keeps the
- * existing files. Dropping 600 files reports the count and the first 100 paths in an untruncated
- * result, and dropping files with escaped names lists fewer to keep the JSON small. On hosted
- * products the tool-only app's location says it has no UI.
+ * deploy results stay objects after the source outgrows an execute result. On hosted products
+ * the tool-only app's location says it has no UI.
  */
-const authorApp = (client: Connection, organization?: string) =>
+const deployApp = (client: Connection, organization?: string) =>
   Effect.gen(function* () {
     const evidence = yield* Evidence;
-    const executor = "const executor = tools.executor;";
-    // Local routes have no organization, and their tools accept no empty path.
-    const tenant = organization === undefined ? {} : { organization };
-    const scope = organization === undefined ? {} : { path: tenant };
-    const execute = (step: string, code: string) =>
-      client
-        .use(step, (client, signal) =>
-          client.callTool(
-            { name: "execute", arguments: { code: `${executor}\n${code}` } },
-            undefined,
-            { signal },
-          ),
-        )
-        .pipe(Effect.map((result) => result.structuredContent));
+    const execute = executeIn(client);
+    const { tenant, scope } = routes(organization);
 
     const discovered = yield* execute(
       "Discover the catalog, the apps release and create",
@@ -151,14 +162,17 @@ const authorApp = (client: Connection, organization?: string) =>
 const found = await tools.search({ query: "framework.release" });
 const create = await find("appManagement.create", ".appManagement.create");
 const catalog = await find("appManagement.catalog", ".appManagement.catalog");
+const commit = await find("appManagement.commit", ".appManagement.commit");
 const release = await executor.framework.release(${JSON.stringify(scope)});
-return { catalog: catalog?.signature, found: found.items.map(({ path, description }) => ({ path, description })), create: create?.signature, release };`,
+return { catalog: catalog?.signature, commit: commit?.signature, found: found.items.map(({ path, description }) => ({ path, description })), create: create?.signature, release };`,
     );
     yield* evidence.json("discovered.json", discovered);
     const found = (yield* Schema.decodeUnknownEffect(Discovered)(discovered)).execution.value;
     // A plain service name fails the optional name filter's pattern, so its input must show it.
     const [input] = found.catalog.split("): Promise<");
     expect(input).toMatch(/@pattern \^@\[a-z0-9\][^\n]*\n\s*name\?: string \| null/);
+    // An app path parameter takes the app's ID, and its signature says so.
+    expect(found.commit).toContain("App ID, such as app_…, from the app's `id`.");
     // deploy.md names framework.release; searching for it finds it first, saying where it goes.
     expect(found.found[0]?.path).toMatch(/\.framework\.release$/);
     expect(found.found[0]?.description).toContain('{ "dependencies": { "apps": version } }');
@@ -183,14 +197,38 @@ return { catalog: catalog?.signature, found: found.items.map(({ path, descriptio
     expect(failure.message).toContain("input.body.files: Missing key");
     expect(failure.recovery.instructions).toContain("tools.search.describe");
 
-    // deploy.md's MCP example: index.ts and a package.json pinning the reported version.
+    // A request Executor's API rejects against its operation's schema states where and why,
+    // instead of a 400 the document does not declare. The input schema cannot express a root
+    // index.ts, so the call reaches Executor.
+    const unrooted = yield* execute(
+      "Create an app without a root index.ts",
+      `return await executor.appManagement.create({ ...${JSON.stringify(scope)}, body: { name: ${JSON.stringify(name)}, files: [{ path: "src/index.ts", content: "export default {};" }] } });`,
+    );
+    yield* evidence.json("create-without-root-index.json", unrooted);
+    const unrootedFailure = (yield* Schema.decodeUnknownEffect(Refused)(unrooted)).execution.error
+      .response;
+    expect(unrootedFailure).toMatchObject({ code: "RequestInvalid", status: 400 });
+    expect(unrootedFailure.message).toContain(
+      "Executor rejected this request's body because it does not match the operation's schema: $.files: expected a root index.ts.",
+    );
+    // A local CLI agent's guess at the format of `links`, a JSON array of account links.
+    if (organization === undefined) {
+      const health = yield* execute(
+        "List account health with links as a flag",
+        `return await executor.accounts.listHealth({ query: { links: "true" } });`,
+      );
+      yield* evidence.json("account-health-links-flag.json", health);
+      const healthFailure = (yield* Schema.decodeUnknownEffect(Refused)(health)).execution.error
+        .response;
+      expect(healthFailure).toMatchObject({ code: "RequestInvalid", status: 400 });
+      expect(healthFailure.message).toContain("this request's query");
+      expect(healthFailure.message).toContain("$.links");
+    }
+
     const created = yield* execute(
       "Create and deploy the documented two-file app",
       `const { version } = await executor.framework.release(${JSON.stringify(scope)});
-const files = [
-  { path: "index.ts", content: ${JSON.stringify(helloIndex)} },
-  { path: "package.json", content: JSON.stringify({ name: "hello", private: true, type: "module", dependencies: { apps: version } }) },
-];
+const files = ${documentedFiles};
 const app = await executor.appManagement.create({ ...${JSON.stringify(scope)}, body: { name: ${JSON.stringify(name)}, files } });
 const deployed = await executor.appManagement.deploy({ path: { ...${JSON.stringify(tenant)}, app: app.id }, body: { files } });
 const source = await executor.appManagement.source({ path: { ...${JSON.stringify(tenant)}, app: app.id } });
@@ -224,11 +262,53 @@ return { saved, deployed };`,
     expect(large.deployed.app.id).toBe(app.app.id);
     expect(large.deployed.version.id).toBe(large.deployed.app.activeVersion);
 
+    // ui.md: a hosted app without a UI has no address, and the location says why.
+    if (organization !== undefined) {
+      const location = yield* execute(
+        "Get the URL of the tool-only app",
+        `return await executor.appUi.location({ path: ${JSON.stringify({ organization, app: app.app.id })} });`,
+      );
+      yield* evidence.json("location.json", location);
+      expect((yield* Schema.decodeUnknownEffect(Located)(location)).execution.value).toEqual({
+        status: "unavailable",
+        url: null,
+        reason: "no_ui",
+      });
+    }
+    return app.app.id;
+  });
+
+/** The documented two-file app with the large reference the saves below remove, not deployed. */
+const createWithReference = (client: Connection, organization: string) =>
+  Effect.gen(function* () {
+    const { scope } = routes(organization);
+    const created = yield* executeIn(client)(
+      "Create an app with a large reference",
+      `const { version } = await executor.framework.release(${JSON.stringify(scope)});
+const files = [...${documentedFiles}, { path: "reference.md", content: "x".repeat(110000) }];
+return await executor.appManagement.create({ ...${JSON.stringify(scope)}, body: { name: ${JSON.stringify(`Hello ${randomUUID().slice(0, 8)}`)}, files } });`,
+    );
+    return (yield* Schema.decodeUnknownEffect(Made)(created)).execution.value.id;
+  });
+
+/**
+ * Saves of an app whose source has `reference.md`. A save that leaves a file out names it in
+ * `removed`, and committing it again restores its contents. A save that nests a file under a
+ * file, or names a path that is not valid Unicode, is refused and keeps the existing files.
+ * Dropping 600 files reports the count and the first 100 paths in an untruncated result, and
+ * dropping files with escaped names lists fewer to keep the JSON small.
+ */
+const saveSource = (client: Connection, app: string, organization?: string) =>
+  Effect.gen(function* () {
+    const evidence = yield* Evidence;
+    const execute = executeIn(client);
+    const path = JSON.stringify({ ...routes(organization).tenant, app });
+
     // deploy.md: a complete file list deletes what it leaves out, and the result names it before
     // anything is deployed. Committing the file again restores it.
     const removal = yield* execute(
       "Save the source without a file, then restore it",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 const trimmed = await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: source.files.filter((file) => file.path !== "reference.md"), message: "Drop the reference" } });
 const restored = await executor.appManagement.commit({ path, body: { expected: trimmed.revision.commit, files: source.files, message: "Restore the reference" } });
@@ -249,7 +329,7 @@ return { trimmed, restored, working: working.revision.commit, same: content(work
     // an existing file is refused before anything is written, naming both paths.
     const conflicted = yield* execute(
       "Save a file inside a path that is a file",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, { path: "reference.md/part.md", content: "part" }], message: "Nest a file" } });`,
     );
@@ -260,9 +340,24 @@ return await executor.appManagement.commit({ path, body: { expected: source.revi
     expect(conflict.message).toBe(
       "The files use reference.md as both a file and a folder: reference.md/part.md is inside it. Git can store only one of them. Rename or remove one, then save again. Nothing was saved.",
     );
+    // Only public files may be stored entries; an ordinary text file sent as one is rejected,
+    // naming the file.
+    const stored = yield* execute(
+      "Save a text file as a stored entry",
+      `const path = ${path};
+const source = await executor.appManagement.source({ path });
+return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, { path: "notes.md", object: "${"a".repeat(40)}", size: 4 }], message: "Store a note" } });`,
+    );
+    yield* evidence.json("stored-text-file.json", stored);
+    const storedFailure = (yield* Schema.decodeUnknownEffect(Refused)(stored)).execution.error
+      .response;
+    expect(storedFailure).toMatchObject({ code: "RequestInvalid", status: 400 });
+    expect(storedFailure.message).toContain(
+      "$.files: expected notes.md to be UTF-8 text: only files under ui/public/ may be binary or stored",
+    );
     const unchanged = yield* execute(
       "Read the working revision after the refused save",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 return { before: ${JSON.stringify(restored.revision.commit)}, after: source.revision.commit };`,
     );
@@ -273,7 +368,7 @@ return { before: ${JSON.stringify(restored.revision.commit)}, after: source.revi
     // `assets\uFFFD` file, so the save is refused and the file and revision survive.
     const kept = yield* execute(
       "Save a file named with U+FFFD",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, { path: "assets\\uFFFD", content: "kept" }], message: "Keep a file" } });`,
     );
@@ -281,7 +376,7 @@ return await executor.appManagement.commit({ path, body: { expected: source.revi
       .revision.commit;
     const lone = yield* execute(
       "Save a path with a lone surrogate",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, { path: "assets\\uD800/logo.txt", content: "logo" }], message: "Add a logo" } });`,
     );
@@ -293,7 +388,7 @@ return await executor.appManagement.commit({ path, body: { expected: source.revi
     );
     const survived = yield* execute(
       "Read the kept file after the refused save",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
 return { before: ${JSON.stringify(keptRevision)}, after: source.revision.commit, kept: source.files.find((file) => file.path === "assets\\uFFFD")?.content ?? null };`,
     );
@@ -304,20 +399,15 @@ return { before: ${JSON.stringify(keptRevision)}, after: source.revision.commit,
     });
 
     // A save that drops many files reports the count and the first paths, so the commit result
-    // returned from execute stays an object instead of a truncated string.
-    yield* execute(
-      "Save 600 notes",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
-const source = await executor.appManagement.source({ path });
-const notes = Array.from({ length: 600 }, (_, n) => ({ path: \`notes/\${String(n).padStart(3, "0")}-${"n".repeat(100)}.md\`, content: String(n) }));
-await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, ...notes], message: "Add notes" } });
-return {};`,
-    );
+    // returned from execute stays an object instead of a truncated string. The drop commits the
+    // files read before the notes, as the restore above does, without reading 600 notes back.
     const dropped = yield* execute(
-      "Save the source without the notes",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      "Save 600 notes, then save the source without them",
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
-return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: source.files.filter((file) => !file.path.startsWith("notes/")), message: "Drop the notes" } });`,
+const notes = Array.from({ length: 600 }, (_, n) => ({ path: \`notes/\${String(n).padStart(3, "0")}-${"n".repeat(100)}.md\`, content: String(n) }));
+const added = await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, ...notes], message: "Add notes" } });
+return await executor.appManagement.commit({ path, body: { expected: added.revision.commit, files: source.files, message: "Drop the notes" } });`,
     );
     yield* evidence.json("many-removed.json", dropped);
     const many = (yield* Schema.decodeUnknownEffect(Committed)(dropped)).execution.value;
@@ -328,19 +418,13 @@ return await executor.appManagement.commit({ path, body: { expected: source.revi
 
     // JSON escapes a control character as six bytes, so the listed paths are bounded by their
     // encoded size: 100 paths of 150 U+0001 each would be over 90 KB, past an execute result.
-    yield* execute(
-      "Save 100 files named with control characters",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
-const source = await executor.appManagement.source({ path });
-const controls = Array.from({ length: 100 }, (_, n) => ({ path: \`controls/\${String(n).padStart(3, "0")}-\${"\\u0001".repeat(150)}.md\`, content: String(n) }));
-await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, ...controls], message: "Add control files" } });
-return {};`,
-    );
     const escaped = yield* execute(
-      "Save the source without the control files",
-      `const path = ${JSON.stringify({ ...tenant, app: app.app.id })};
+      "Save 100 files named with control characters, then save the source without them",
+      `const path = ${path};
 const source = await executor.appManagement.source({ path });
-return await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: source.files.filter((file) => !file.path.startsWith("controls/")), message: "Drop the control files" } });`,
+const controls = Array.from({ length: 100 }, (_, n) => ({ path: \`controls/\${String(n).padStart(3, "0")}-\${"\\u0001".repeat(150)}.md\`, content: String(n) }));
+const added = await executor.appManagement.commit({ path, body: { expected: source.revision.commit, files: [...source.files, ...controls], message: "Add control files" } });
+return await executor.appManagement.commit({ path, body: { expected: added.revision.commit, files: source.files, message: "Drop the control files" } });`,
     );
     yield* evidence.json("escaped-removed.json", escaped);
     const controls = (yield* Schema.decodeUnknownEffect(Committed)(escaped)).execution.value;
@@ -352,21 +436,6 @@ return await executor.appManagement.commit({ path, body: { expected: source.revi
     expect(
       new TextEncoder().encode(JSON.stringify(controls.removed.paths)).length,
     ).toBeLessThanOrEqual(16 * 1024);
-
-    // ui.md: a hosted app without a UI has no address, and the location says why.
-    if (organization !== undefined) {
-      const location = yield* execute(
-        "Get the URL of the tool-only app",
-        `return await executor.appUi.location({ path: ${JSON.stringify({ organization, app: app.app.id })} });`,
-      );
-      yield* evidence.json("location.json", location);
-      expect((yield* Schema.decodeUnknownEffect(Located)(location)).execution.value).toEqual({
-        status: "unavailable",
-        url: null,
-        reason: "no_ui",
-      });
-    }
-    return app.app.id;
   });
 
 /** deploy.md's local example deploys through `apps.deploy`; local `apps.commit` saves the same way. */
@@ -399,33 +468,52 @@ return { saved, deployed };`,
     expect(result.version.id).toBe(result.app.activeVersion);
   });
 
+/**
+ * The owner's API key and management app, an MCP session on its organization, and app removal.
+ * Deploys and saves are separate cases: on a deployed Cloud stage, each runs about 30 seconds of
+ * sequential Git and build work, and together they reached the 60-second limit.
+ */
+const hostedAgent = Effect.gen(function* () {
+  const api = yield* Api,
+    actors = yield* Actors,
+    mcp = yield* McpClient;
+  const organization = actors.organization.id;
+  const issued = yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+    name: "App management contracts",
+  });
+  expect(issued.status).toBe(200);
+  const token = yield* body(Token, issued);
+  yield* Effect.addFinalizer(() =>
+    api
+      .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: token.id })
+      .pipe(Effect.orDie),
+  );
+  yield* managementApp(actors.owner);
+  const client = yield* mcp.connect(token.key, "app-management-contracts", { organization });
+  const remove = (app: string) =>
+    api.request(actors.owner, "DELETE", `/api/organizations/${organization}/apps/${app}`);
+  return { client, organization, remove };
+});
+
 layer(HostedLive, { excludeTestServices: true })("Hosted app management contracts", (it) => {
   it.effect(scenarios.appManagementContractsHosted.title, (context) =>
     withHostedCase(
       context,
       Effect.gen(function* () {
-        const api = yield* Api,
-          actors = yield* Actors,
-          mcp = yield* McpClient;
-        const organization = actors.organization.id;
-        const issued = yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
-          name: "App management contracts",
-        });
-        expect(issued.status).toBe(200);
-        const token = yield* body(Token, issued);
-        yield* Effect.addFinalizer(() =>
-          api
-            .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: token.id })
-            .pipe(Effect.orDie),
-        );
-        yield* managementApp(actors.owner);
-        const client = yield* mcp.connect(token.key, "app-management-contracts", { organization });
-        const app = yield* authorApp(client, organization);
-        yield* api.request(
-          actors.owner,
-          "DELETE",
-          `/api/organizations/${organization}/apps/${app}`,
-        );
+        const { client, organization, remove } = yield* hostedAgent;
+        yield* remove(yield* deployApp(client, organization));
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+
+  it.effect(scenarios.appManagementSavesHosted.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const { client, organization, remove } = yield* hostedAgent;
+        const app = yield* createWithReference(client, organization);
+        yield* saveSource(client, app, organization);
+        yield* remove(app);
       }).pipe(Effect.provide(McpClient.layer)),
     ),
   );
@@ -442,7 +530,8 @@ layer(TestLive, { excludeTestServices: true })("Local app management contracts",
         const session = yield* api.session();
         const headers = { authorization: `Bearer ${Redacted.value(target.apiKey)}` };
         const client = yield* mcp.connect(target.apiKey, "app-management-contracts");
-        const app = yield* authorApp(client);
+        const app = yield* deployApp(client);
+        yield* saveSource(client, app);
         yield* deployThroughApps(client, app);
         yield* session.send("DELETE", `/v1/apps/${app}`, undefined, headers);
       }).pipe(Effect.provide(McpClient.layer)),
diff --git a/e2e/tests/app-name-validation.spec.ts b/e2e/tests/app-name-validation.spec.ts
new file mode 100644
index 0000000000..bb201be7ca
--- /dev/null
+++ b/e2e/tests/app-name-validation.spec.ts
@@ -0,0 +1,63 @@
+/** App names that storage cannot hold or that would list as blank are refused, not stored or failed. */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { oauthSetupIssuer } from "../support/oauth-setup-issuer.ts";
+import { scenarios } from "../test-plan.ts";
+
+const App = Schema.Struct({ id: Schema.String, name: Schema.String });
+
+/** A NUL cannot be stored, a newline breaks the one-line name, and invisible text lists as blank. */
+const refused = ["Zero\u0000Width", "Two\nlines", "Tabbed\tname", "\u200b\u200b", "\u200d"];
+
+layer(HostedLive, { excludeTestServices: true })("App name validation", (it) => {
+  it.effect(scenarios.appNameValidation.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const issuer = yield* oauthSetupIssuer;
+        yield* issuer.configure({ serveMcp: true });
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const suffix = randomUUID().slice(0, 8);
+        const url = `${issuer.origin}/mcp`;
+
+        const imported = yield* api.request(actors.owner, "POST", `${prefix}/apps/import`, {
+          source: { kind: "mcp", name: `Named ${suffix}`, url },
+        });
+        expect(imported.status, JSON.stringify(imported.body)).toBe(200);
+        const app = yield* body(App, imported);
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+        );
+        const appPath = `${prefix}/apps/${app.id}`;
+
+        for (const name of refused) {
+          const label = JSON.stringify(name);
+          // Quick add and rename both refuse the name as a bad request, never a storage error.
+          const add = yield* api.request(actors.owner, "POST", `${prefix}/apps/import`, {
+            source: { kind: "mcp", name, url },
+          });
+          expect(add.status, `import ${label}: ${JSON.stringify(add.body)}`).toBe(400);
+          const rename = yield* api.request(actors.owner, "PATCH", `${appPath}/name`, { name });
+          expect(rename.status, `rename ${label}: ${JSON.stringify(rename.body)}`).toBe(400);
+        }
+        const unchanged = yield* body(App, yield* api.request(actors.owner, "GET", appPath));
+        expect(unchanged.name).toBe(`Named ${suffix}`);
+
+        // Names in other scripts, with accents or joined emoji, stay valid.
+        const kept = `Café 日本語 👨‍👩‍👧 ${suffix}`;
+        const renamed = yield* api.request(actors.owner, "PATCH", `${appPath}/name`, {
+          name: kept,
+        });
+        expect(renamed.status, JSON.stringify(renamed.body)).toBe(200);
+        const read = yield* body(App, yield* api.request(actors.owner, "GET", appPath));
+        expect(read.name).toBe(kept);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/app-observability.spec.ts b/e2e/tests/app-observability.spec.ts
index caa53939ab..73d8ca3e57 100644
--- a/e2e/tests/app-observability.spec.ts
+++ b/e2e/tests/app-observability.spec.ts
@@ -344,6 +344,14 @@ layer(HostedLive, { excludeTestServices: true })("App observability", (it) => {
         );
         const spans = exported.data.map((row) => row.span);
         expect(spans.some((span) => span.operationName === "sdk.apps.source")).toBe(false);
+        // The live query's runtime spans name its app and the signed-in caller's organization, so
+        // one app's failing subscriptions can be told from the runtime's.
+        if (target.metadata.target === "cloud")
+          for (const name of ["runtime.cloud.query", "runtime.cloud.changes.connect"])
+            expect(spans.find((span) => span.operationName === name)?.tags, name).toMatchObject({
+              "executor.app.id": app.id,
+              "executor.organization.id": actors.organization.id,
+            });
         const assetTrace = yield* telemetry.query(assetTraceId).pipe(
           Effect.flatMap((result) =>
             result.data.some((row) => row.span.operationName === "http.server GET")
@@ -372,6 +380,28 @@ layer(HostedLive, { excludeTestServices: true })("App observability", (it) => {
             assetTrace.data.filter((row) => row.span.operationName === "sql.connect"),
             "An authenticated asset shares one SQL connection between app and permission reads",
           ).toHaveLength(1);
+          // A statement records one span: the FumaDB operation that ran it and its wire timing
+          // are attributes of its `sql.execute`, not spans around and under it.
+          const statements = assetTrace.data.filter(
+            (row) => row.span.operationName === "sql.execute",
+          );
+          expect(
+            assetTrace.data.filter(
+              (row) =>
+                row.span.operationName.startsWith("FumaDB.") ||
+                (row.span.operationName === "sql.wire" &&
+                  statements.some((statement) => statement.span.spanId === row.span.parentSpanId)),
+            ),
+            "No span repeats a statement's interval",
+          ).toHaveLength(0);
+          expect(
+            statements.some((row) => row.span.tags["fumadb.operation"] === "findFirst"),
+            "The app read records its FumaDB operation",
+          ).toBe(true);
+          expect(
+            statements.some((row) => row.span.tags["db.wire.ready_ms"] !== undefined),
+            "A statement records its wire timing",
+          ).toBe(true);
         }
         const first = spans.find((span) => span.operationName === "ui.app.first_result");
         const headers = spans.find((span) => span.operationName === "ui.app.subscribe");
diff --git a/e2e/tests/app-reload.spec.ts b/e2e/tests/app-reload.spec.ts
index 9794d8f778..1ab8cc0333 100644
--- a/e2e/tests/app-reload.spec.ts
+++ b/e2e/tests/app-reload.spec.ts
@@ -108,18 +108,26 @@ layer(HostedLive, { excludeTestServices: true })("Hosted app reload", (it) => {
         const url = yield* waitForAppUrl(actors.owner, `${path}/ui`);
         const bookmark = `${url}/notes?filter=active#draft`;
         yield* browser.omitNetworkTrace;
-        for (const endpoint of ["version", "watch.js"]) {
-          expect(
-            (yield* browser.use("Unsigned watcher requests stay private", (page) =>
-              page.context().request.get(`${url}/_executor/${endpoint}`),
-            )).status(),
-          ).toBe(401);
-        }
+        expect(
+          (yield* browser.use("Unsigned version watches stay private", (page) =>
+            page.context().request.get(`${url}/_executor/version`),
+          )).status(),
+        ).toBe(401);
         yield* browser.login(actors.owner);
+        // The page carries its watcher, so opening it fetches no separate watcher script.
+        const watcherScripts: string[] = [];
+        yield* browser.use("Watch for a watcher script request", (page) => {
+          page.on("request", (request) => {
+            if (new URL(request.url()).pathname === "/_executor/watch.js")
+              watcherScripts.push(request.url());
+          });
+          return Promise.resolve();
+        });
         yield* openPrivateApp(bookmark);
         yield* browser.use("A page without app queries is ready", (page) =>
           page.getByRole("heading", { name: "Static version", exact: true }).waitFor(),
         );
+        expect(watcherScripts).toEqual([]);
         // The initial page's watcher stays open. Disable only the next document's
         // version connection, so its query stream must recover a missed notification.
         let blockedVersions = 0;
diff --git a/e2e/tests/app-routers.spec.ts b/e2e/tests/app-routers.spec.ts
index 618cc7c746..0a91277e0a 100644
--- a/e2e/tests/app-routers.spec.ts
+++ b/e2e/tests/app-routers.spec.ts
@@ -24,6 +24,10 @@ const Wire = Schema.Struct({
 
 const instructions = "Search the docs before answering. Cite the page you used.";
 
+/** Property documentation a server or document gives, which only describe shows agents. */
+const startDoc = "Start time in unix milliseconds, not an ISO 8601 string.";
+const statusDoc = "One of: draft, open, paid.";
+
 /** An MCP server that describes itself during initialization. One tool name contains a dot. */
 const docsServer = Effect.gen(function* () {
   const routes = Layer.mergeAll(
@@ -54,7 +58,14 @@ const docsServer = Effect.gen(function* () {
             tools: ["lookup", "search.pages"].map((name) => ({
               name,
               description: `Synthetic ${name}`,
-              inputSchema: { type: "object", properties: {}, additionalProperties: false },
+              inputSchema: {
+                type: "object",
+                properties:
+                  name === "lookup"
+                    ? { start: { type: ["integer", "string"], description: startDoc } }
+                    : {},
+                additionalProperties: false,
+              },
               // One tool declares the shape of its structured content; the other declares none.
               ...(name === "lookup"
                 ? {
@@ -102,10 +113,20 @@ const billing = (origin: string) => ({
       get: {
         operationId: "listInvoices",
         tags: ["invoices"],
+        // OpenAPI documents a parameter on the parameter, beside its schema.
+        parameters: [
+          { $ref: "#/components/parameters/Status" },
+          { name: "page", in: "query", deprecated: true, schema: { type: "integer" } },
+        ],
         responses: { "200": { description: "Invoices" } },
       },
     },
   },
+  components: {
+    parameters: {
+      Status: { name: "status", in: "query", description: statusDoc, schema: { type: "string" } },
+    },
+  },
 });
 
 /** Static routers, an MCP server and an OpenAPI document under keys, and a server that is down. */
@@ -470,6 +491,36 @@ return { items: described.items, lookup: await docs.lookup({}), pages: await doc
             "const name: unknown = value.structuredContent?.tool;",
           ),
         ).toEqual([]);
+        // Describe documents each property with the text its server or document gives, attached
+        // to the property it describes. Search's one-line input type stays compact without it.
+        const documented = yield* execute(
+          "Describe documented properties",
+          `const found = await tools.search({ namespace: ${JSON.stringify(app.slug)}, limit: 50 });
+const paths = found.items.map((item) => item.path).filter((path) => /\\.(docs\\.lookup|listInvoices)$/.test(path));
+const described = await tools.search.describe({ paths });
+return { found: found.items.filter((item) => paths.includes(item.path)), items: described.items };`,
+        );
+        const properties = yield* Schema.decodeUnknownEffect(
+          Schema.Struct({
+            found: Schema.Array(Schema.Struct({ path: Schema.String, input: Schema.String })),
+            items: Described.fields.items,
+          }),
+        )(documented.execution.value);
+        const describedAs = (path: string) =>
+          properties.items.find((item) => item.path.endsWith(path))?.signature ?? "";
+        expect(describedAs(".docs.lookup")).toMatch(
+          new RegExp(`/\\*\\* ${startDoc} \\*/\\s*start\\?: number \\| string`),
+        );
+        expect(describedAs(".listInvoices")).toMatch(
+          new RegExp(`/\\*\\* ${statusDoc} \\*/\\s*status\\?: string`),
+        );
+        expect(describedAs(".listInvoices")).toMatch(
+          /\/\*\* @deprecated @integer \*\/\s*page\?: number/,
+        );
+        expect(properties.found.map((item) => item.input).sort()).toEqual([
+          "{ query?: { status?: string, page?: number } }",
+          "{ start?: number | string }",
+        ]);
         const failed = yield* execute(
           "Call a tool in the router whose server is down",
           `return await tools[${JSON.stringify(app.slug)}].offline.anything({});`,
diff --git a/e2e/tests/app-ui.spec.ts b/e2e/tests/app-ui.spec.ts
index f117a64898..c83e930b81 100644
--- a/e2e/tests/app-ui.spec.ts
+++ b/e2e/tests/app-ui.spec.ts
@@ -26,6 +26,7 @@ import { managementApp } from "../support/management-app.ts";
 import { holdQuery } from "../support/query-transition.ts";
 import { appsManifest } from "../support/apps-release.ts";
 import { targetHosts } from "../support/role-hosts.ts";
+import { siteless } from "../support/failure-site.ts";
 
 const files = [
   {
@@ -300,10 +301,10 @@ return { items };`,
           "Get the URL of an app that has never been deployed",
           `return await ${tools}.appUi.location({ path: ${JSON.stringify({ ...organization, app: app.id })} });`,
         );
-        expect(
-          (yield* Schema.decodeUnknownEffect(ApiFailure)(location.structuredContent)).execution
-            .error,
-        ).toEqual({
+        const notDeployed = (yield* Schema.decodeUnknownEffect(ApiFailure)(
+          location.structuredContent,
+        )).execution.error;
+        expect({ ...notDeployed, message: siteless(notDeployed.message) }).toEqual({
           message:
             "AppNotDeployed (HTTP 409): The app has no active version to load. Recovery: Open Source and deploy the app before using its tools or accounts. Retryable (unchanged call): no.",
           response: {
@@ -333,11 +334,17 @@ return { items };`,
             "Do not automatically repeat this call or duplicate its change. Executor could not confirm its outcome.",
           instructions: `This call may have changed data or may still complete. A safe read can show effects but cannot rule out later completion. Tell the user what is known and get their agreement before repeating the change. ${readAdvice(`${declared.action} ${declared.instructions}`)} Repairing the cause does not establish whether the earlier call completed.`,
         };
-        expect(
-          (yield* Schema.decodeUnknownEffect(ApiFailure)(taken.structuredContent)).execution.error,
-        ).toEqual({
+        const slugTaken = (yield* Schema.decodeUnknownEffect(ApiFailure)(taken.structuredContent))
+          .execution.error;
+        expect({ ...slugTaken, message: siteless(slugTaken.message) }).toEqual({
           message: `AppSlugTaken (HTTP 409): ${message} Recovery: ${recovery.action} Retryable (unchanged call): no.`,
-          response: { code: "AppSlugTaken", status: 409, message, recovery, retryable: false },
+          response: {
+            code: "AppSlugTaken",
+            status: 409,
+            message,
+            recovery,
+            retryable: false,
+          },
         });
       }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
     ),
diff --git a/e2e/tests/catalog-official-apps.spec.ts b/e2e/tests/catalog-official-apps.spec.ts
index d93a6ac1bf..4dfb958d09 100644
--- a/e2e/tests/catalog-official-apps.spec.ts
+++ b/e2e/tests/catalog-official-apps.spec.ts
@@ -191,9 +191,39 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         );
         yield* browser.checkpoint("The tracker shows its catalog icon");
         expect(logos).toEqual([]);
+        // Add app keeps its layout while the catalog loads: the placeholders take the loaded
+        // toolbar's and rows' places, so nothing moves when the catalog answers.
+        const layout = (page: Page, row: string) =>
+          Promise.all(
+            [".list-toolbar", row].map((selector) =>
+              page
+                .locator(selector)
+                .first()
+                .boundingBox()
+                .then((box) => box && [box.x, box.y, box.width, box.height]),
+            ),
+          );
+        const pending = yield* holdQuery(["/api/catalog"], "continue");
         yield* browser.use("Open Add app", (page) =>
           page.goto(`/org/${actors.organization.slug}/apps/add`),
         );
+        yield* pending.requested;
+        const placeholder = yield* browser.use("Add app holds its layout while loading", (page) =>
+          page
+            .getByRole("status", { name: "Loading apps" })
+            .waitFor()
+            .then(() => layout(page, '[aria-label="Loading apps"] > div')),
+        );
+        yield* browser.checkpoint("Add app holds its layout while the catalog loads");
+        yield* pending.release;
+        const loaded = yield* browser.use("The catalog fills the same places", (page) =>
+          page
+            .locator(".catalog-row")
+            .first()
+            .waitFor()
+            .then(() => layout(page, ".catalog-row")),
+        );
+        expect(loaded).toEqual(placeholder);
         yield* browser.use("Search the catalog", (page) =>
           page.getByPlaceholder("Search apps…").fill("synthetic"),
         );
@@ -258,7 +288,7 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         yield* browser.checkpoint("The added app offers Open on the same page");
 
         // A fresh visit still knows both apps are installed.
-        yield* browser.use("Reload Add app", (page) => page.reload());
+        yield* browser.use("Reload the app catalog", (page) => page.reload());
         yield* browser.use("Search the catalog again", (page) =>
           page.getByPlaceholder("Search apps…").fill("synthetic"),
         );
@@ -276,18 +306,116 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         );
         yield* browser.checkpoint("Open leads to the added app's account setup");
 
-        // A user-entered MCP URL and the agent prompt for any other service remain.
-        yield* browser.use("Open Connect a service", (page) =>
-          page.goto(`/org/${actors.organization.slug}/apps/add/custom`),
+        // Add app offers making your own app first, then the app catalog.
+        yield* browser.use("Return to Apps", (page) =>
+          page.goto(`/org/${actors.organization.slug}/apps`),
+        );
+        const choose = (choice: string) =>
+          browser.use(`Choose ${choice}`, (page) =>
+            page
+              .getByRole("button", { name: "Add app", exact: true })
+              .click()
+              .then(() => page.getByRole("menuitem", { name: new RegExp(`^${choice}`) }).click()),
+          );
+        yield* browser.use("Open Add app", (page) =>
+          page.getByRole("button", { name: "Add app", exact: true }).click(),
+        );
+        const menu = yield* browser.use("Add app lists the ways to add an app", (page) =>
+          page
+            .getByRole("menuitem")
+            .first()
+            .waitFor()
+            .then(() =>
+              Promise.all([
+                page.getByRole("menu").getByText("Create your own", { exact: true }).count(),
+                page.getByRole("menuitem").locator(".font-medium").allTextContents(),
+              ]),
+            ),
+        );
+        expect(menu).toEqual([1, ["From scratch", "From an MCP server", "Browse app catalog"]]);
+        yield* browser.checkpoint("Add app puts creating your own before the app catalog");
+        yield* browser.use("Close the menu", (page) => page.keyboard.press("Escape"));
+
+        yield* choose("From scratch");
+        yield* browser.use("Describe the app", (page) =>
+          page
+            .getByRole("dialog", { name: "Create from scratch" })
+            .getByLabel("What should it do?")
+            .fill("Summarize my Linear issues every Monday."),
+        );
+        const prompt = yield* browser.use("The prompt carries the description", (page) =>
+          page.getByRole("region", { name: "Send this to your agent" }).textContent(),
+        );
+        expect(prompt).toContain("What it should do: Summarize my Linear issues every Monday.");
+        yield* browser.checkpoint("From scratch hands the description to the agent");
+        yield* browser.use("Close the From scratch dialog", (page) =>
+          page.keyboard.press("Escape"),
+        );
+
+        // URL import is for MCP servers only; anything else, such as OpenAPI, starts from scratch.
+        yield* choose("From an MCP server");
+        const mcp = yield* browser.use("The MCP server dialog offers one URL form", (page) => {
+          const dialog = page.getByRole("dialog", { name: "Create from an MCP server" });
+          return dialog
+            .getByLabel("MCP server URL", { exact: true })
+            .waitFor()
+            .then(() =>
+              Promise.all([
+                dialog.getByRole("textbox").count(),
+                dialog.getByRole("link").count(),
+                dialog.getByText(/build an app from it/i).count(),
+              ]),
+            );
+        });
+        expect(mcp).toEqual([2, 0, 0]);
+        yield* browser.checkpoint("The MCP server dialog imports MCP URLs only");
+        yield* browser.use("Send other services to From scratch", (page) =>
+          page
+            .getByRole("button", { name: "Start from scratch", exact: true })
+            .click()
+            .then(() => page.getByRole("dialog", { name: "Create from scratch" }).waitFor()),
+        );
+        yield* browser.use("Close the From scratch dialog", (page) =>
+          page.keyboard.press("Escape"),
+        );
+
+        yield* choose("Browse app catalog");
+        yield* browser.use("Browse app catalog opens the catalog", (page) =>
+          page
+            .waitForURL(`**/org/${actors.organization.slug}/apps/add`)
+            .then(() => page.getByRole("heading", { name: "App catalog", exact: true }).waitFor()),
+        );
+        const makeYourOwn = yield* browser.use("The catalog offers Make your own twice", (page) =>
+          page.getByRole("button", { name: "Make your own", exact: true }).count(),
+        );
+        expect(makeYourOwn).toBe(2);
+        yield* browser.checkpoint(
+          "App catalog offers Make your own in its header and below the apps",
         );
-        yield* browser.use("Only an MCP URL is accepted directly", (page) =>
-          page.getByLabel("MCP server URL", { exact: true }).waitFor(),
+        yield* browser.use("The header's Make your own opens the same create choices", (page) =>
+          page
+            .getByRole("button", { name: "Make your own", exact: true })
+            .first()
+            .click()
+            .then(() => page.getByRole("menuitem", { name: /^From an MCP server/ }).click())
+            .then(() => page.getByRole("dialog", { name: "Create from an MCP server" }).waitFor()),
+        );
+        yield* browser.checkpoint("The catalog's Make your own opens the MCP server dialog");
+        yield* browser.use("Close the MCP server dialog", (page) => page.keyboard.press("Escape"));
+        yield* browser.use("Search for a missing app", (page) =>
+          page.getByPlaceholder("Search apps…").fill("no such service"),
         );
-        const generic = yield* browser.use("Other services get a prompt", (page) =>
-          page.getByRole("region", { name: "Any other service" }).textContent(),
+        const noResults = yield* browser.use("No results still offer Make your own", (page) =>
+          page
+            .getByRole("heading", { name: "No matching apps", exact: true })
+            .waitFor()
+            .then(() =>
+              page.getByRole("button", { name: "Make your own", exact: true }).last().waitFor(),
+            )
+            .then(() => page.getByRole("button", { name: "Make your own", exact: true }).count()),
         );
-        expect(generic).toContain("Ask me which service I want to connect.");
-        yield* browser.checkpoint("Connect a service offers MCP or an agent prompt");
+        expect(noResults).toBe(2);
+        yield* browser.checkpoint("No results offer Make your own");
       }),
     ),
   );
diff --git a/e2e/tests/ci-selection.spec.ts b/e2e/tests/ci-selection.spec.ts
index e8a289bf31..f1486e5176 100644
--- a/e2e/tests/ci-selection.spec.ts
+++ b/e2e/tests/ci-selection.spec.ts
@@ -312,7 +312,7 @@ layer(NodeServices.layer)("CI E2E selection", (it) => {
   );
 
   it.effect(
-    "a full run splits local and self-host by spec file and spreads Cloud over three runners",
+    "a full run splits local and self-host by spec file and spreads Cloud over four runners",
     () =>
       Effect.gen(function* () {
         const [main, all, named] = yield* Effect.all(
@@ -355,9 +355,10 @@ layer(NodeServices.layer)("CI E2E selection", (it) => {
           }
           const runners = cloudRunners(run.outputs);
           expect(runners.map(({ name }) => name)).toEqual([
-            "cloud, cloud-autumn, cloud-isolate, cloud-v1-bound",
+            "cloud, cloud-isolate",
             "cloud-workers, cloud-locks, cloud-batch, cloud-rollback",
-            "cloud-product, cloud-domains, cloud-rate-limit, cloud-oauth-proxy-preview",
+            "cloud-product",
+            "cloud-domains, cloud-autumn, cloud-v1-bound, cloud-rate-limit, cloud-oauth-proxy-preview",
           ]);
           // Each Cloud job's pattern is on exactly one runner and empty on the others. The runner
           // runs it unchanged, except cloud-product past what one local Cloud holds: its local
diff --git a/e2e/tests/cloud-app-query-auth.spec.ts b/e2e/tests/cloud-app-query-auth.spec.ts
new file mode 100644
index 0000000000..dcd790db2f
--- /dev/null
+++ b/e2e/tests/cloud-app-query-auth.spec.ts
@@ -0,0 +1,146 @@
+import { expect, layer } from "@effect/vitest";
+import { Effect, Redacted, Schedule, Schema } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { randomUUID } from "node:crypto";
+import { Actors, freshOwnerSession } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { targetHosts } from "../support/role-hosts.ts";
+import { Target } from "../support/platform.ts";
+import { scenarios } from "../test-plan.ts";
+
+const App = Schema.Struct({ id: Schema.String, activeVersion: Schema.String });
+const Location = Schema.Struct({ status: Schema.Literal("ready"), url: Schema.String });
+const Answer = Schema.fromJsonString(Schema.Struct({ answer: Schema.Int }));
+
+layer(HostedLive, { excludeTestServices: true })("Cloud app query authorization", (it) => {
+  it.effect(scenarios.cloudAppQueryAuth.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors,
+          api = yield* Api,
+          client = yield* HttpClient.HttpClient,
+          telemetry = yield* Telemetry,
+          evidence = yield* Evidence;
+        const session = yield* freshOwnerSession;
+        const dashboard = targetHosts(yield* Target).browser;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const app = yield* body(
+          App,
+          yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Query authorization ${randomUUID().slice(0, 8)}`,
+            files: [
+              {
+                path: "index.ts",
+                content: `import { defineApp, query, object, router } from "apps";
+export default defineApp({}, async () => ({ tools: router({
+  hello: query({ input: object({}) }, async () => ({ answer: 42 })),
+}) }));`,
+              },
+              { path: "ui/index.html", content: "<!doctype html><title>Query</title><p>Query</p>" },
+              appsManifest,
+            ],
+          }),
+        );
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.admin, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+        );
+        const location = yield* body(
+          Location,
+          yield* api.request(actors.owner, "GET", `${prefix}/apps/${app.id}/ui`),
+        );
+        const appOrigin = new URL(location.url).origin;
+        const dashboardCookies = Redacted.value(yield* session.cookies)
+          .map(({ name, value }) => `${name}=${value}`)
+          .join("; ");
+        const appCookies = new Map<string, string>();
+        const send = (request: HttpClientRequest.HttpClientRequest) =>
+          Effect.scoped(
+            client.execute(request).pipe(
+              Effect.flatMap((response) =>
+                response.text.pipe(
+                  Effect.map((text) => ({
+                    status: response.status,
+                    location: response.headers.location,
+                    cookies: response.cookies,
+                    text,
+                  })),
+                ),
+              ),
+            ),
+          ).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }));
+        let url = location.url;
+        let opened = false;
+        for (let redirects = 0; redirects < 6; redirects++) {
+          const origin = new URL(url).origin;
+          expect([appOrigin, dashboard]).toContain(origin);
+          const response = yield* send(
+            HttpClientRequest.get(url).pipe(
+              HttpClientRequest.setHeaders({
+                accept: "text/html",
+                "sec-fetch-mode": "navigate",
+                cookie:
+                  origin === dashboard
+                    ? dashboardCookies
+                    : [...appCookies].map(([name, value]) => `${name}=${value}`).join("; "),
+              }),
+            ),
+          );
+          if (origin === appOrigin)
+            for (const cookie of Object.values(response.cookies.cookies))
+              appCookies.set(cookie.name, cookie.valueEncoded);
+          if (origin === appOrigin && response.status === 200) {
+            opened = true;
+            break;
+          }
+          expect(response.status).toBe(302);
+          expect(response.location).toBeDefined();
+          url = new URL(response.location!, url).href;
+        }
+        expect(opened).toBe(true);
+        const query = (trace: string) =>
+          HttpClientRequest.post(`${appOrigin}/_executor/api/query`).pipe(
+            HttpClientRequest.setHeaders({
+              origin: appOrigin,
+              cookie: [...appCookies].map(([name, value]) => `${name}=${value}`).join("; "),
+              traceparent: `00-${trace}-${trace.slice(0, 16)}-01`,
+              "sec-fetch-site": "same-origin",
+            }),
+            HttpClientRequest.bodyJson({ version: app.activeVersion, name: "hello", input: {} }),
+            Effect.flatMap(send),
+            Effect.provideService(HttpClient.TracerPropagationEnabled, false),
+          );
+        for (const label of ["first", "warm"]) {
+          const trace = randomUUID().replaceAll("-", "");
+          const response = yield* query(trace);
+          expect(response.status).toBe(200);
+          expect(yield* Schema.decodeUnknownEffect(Answer)(response.text)).toEqual({ answer: 42 });
+          const spans = yield* telemetry.query(trace).pipe(
+            Effect.flatMap((result) =>
+              result.data.some(({ span }) => span.operationName === "runtime.cloud.query") &&
+              result.data.filter(({ span }) => span.operationName === "auth.sql.timing").length >= 3
+                ? Effect.succeed(result.data)
+                : Effect.fail(new Error("The completed app query trace has not reached Motel")),
+            ),
+            Effect.retry({ schedule: Schedule.spaced("1 second"), times: 40 }),
+          );
+          const auth = spans
+            .filter(({ span }) => span.operationName === "auth.sql.timing")
+            .map(({ span }) => ({
+              kind: span.tags["db.query.kind"],
+              table: span.tags["db.collection.name"],
+            }));
+          yield* evidence.json(`${label}-authorization-reads.json`, auth);
+          expect(auth).toHaveLength(3);
+          expect(auth.every(({ kind }) => kind === "SelectQueryNode")).toBe(true);
+        }
+        const signedOut = yield* api.request(session, "POST", "/api/auth/sign-out", {});
+        expect(signedOut.status).toBe(200);
+        expect((yield* query(randomUUID().replaceAll("-", ""))).status).toBe(401);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/cloud-database-placement.spec.ts b/e2e/tests/cloud-database-placement.spec.ts
index 3c61eb8296..3b9a43126f 100644
--- a/e2e/tests/cloud-database-placement.spec.ts
+++ b/e2e/tests/cloud-database-placement.spec.ts
@@ -23,6 +23,7 @@ import { Evidence, Telemetry } from "../support/evidence.ts";
 import { McpClient } from "../support/mcp-client.ts";
 import { Target } from "../support/platform.ts";
 import { appsManifest } from "../support/apps-release.ts";
+import { cloudLocks } from "../support/cloud-locks.ts";
 
 type Spans = (typeof SpanQuery.Type)["data"];
 
@@ -112,6 +113,8 @@ const Runs = Schema.Array(
   Schema.Struct({ id: Schema.String, name: Schema.String, status: Schema.String }),
 );
 
+const Connections = Schema.Array(Schema.Struct({ connections: Schema.Number }));
+
 const Completed = Schema.Struct({
   status: Schema.Literal("completed"),
   execution: Schema.Struct({ ok: Schema.Literal(true), value: Schema.Unknown }),
@@ -213,7 +216,7 @@ const toolCallStatements = Effect.gen(function* () {
             text: String(span.tags["db.query.text"] ?? "").replace(/\s+/g, " "),
             end: Date.parse(span.startTime) + span.durationMs,
             readAhead:
-              names.includes("FumaDB.SqlQuery.findFirst") && !names.includes("sdk.tools.call"),
+              span.tags["fumadb.operation"] === "findFirst" && !names.includes("sdk.tools.call"),
             runtime: names.some((name) => name.startsWith("runtime.")),
           };
         })
@@ -456,6 +459,14 @@ return out;`,
                       object: spans
                         .map(({ span }) => span.tags["executor.mcp.object_id"])
                         .find((id) => id !== undefined),
+                      // How the object reached the database for each connection it opened.
+                      routes: [
+                        ...new Set(
+                          spans
+                            .filter(({ span }) => span.operationName === "sql.connect")
+                            .map(({ span }) => String(span.tags["db.connect.route"])),
+                        ),
+                      ],
                     })
                   : Effect.fail(
                       new Error(
@@ -480,6 +491,12 @@ return out;`,
             3,
           );
           expect(first.windows, "The session's calls share one activity window").toBe(1);
+          // One object per grant: each connected directly, every active session would hold
+          // PgBouncer clients of its own, and enough active sessions exhaust PgBouncer's client
+          // limit. Through Hyperdrive they share its bounded pool.
+          expect(first.routes, "Session objects connect through Hyperdrive").toEqual([
+            "hyperdrive",
+          ]);
           const object = first.object;
           if (object === undefined) return yield* Effect.die("Missing the session object's ID");
           const owner = `mcp ${object}`;
@@ -603,6 +620,11 @@ return out;`,
             spans.some(
               (span) =>
                 span.operationName === "sql.connect" && span.tags["db.connect.attempt"] === "2",
+            ) &&
+            spans.some(
+              (span) =>
+                span.operationName === "sql.connect" &&
+                span.tags["db.connect.failure"] !== undefined,
             ),
         )).filter((span) => span.operationName === "sql.connect");
         yield* evidence.json(
@@ -610,14 +632,42 @@ return out;`,
           connects.map((span) => ({
             attempt: span.tags["db.connect.attempt"],
             retryReason: span.tags["db.connect.retry_reason"],
+            failure: span.tags["db.connect.failure"],
             durationMs: span.durationMs,
             status: span.status,
           })),
         );
-        const retried = connects.filter((span) => span.tags["db.connect.attempt"] === "2");
-        expect(retried.map((span) => span.tags["db.connect.retry_reason"])).toEqual([
-          "PgConnection: Connection timed out",
+        // The stalled attempt fails its span and says it timed out, recording only the driver's
+        // fixed sentence; the attempt made after it succeeds and records no failure.
+        expect(
+          connects
+            .filter((span) => span.tags["db.connect.failure"] !== undefined)
+            .map((span) => ({
+              attempt: span.tags["db.connect.attempt"],
+              failure: span.tags["db.connect.failure"],
+              status: span.status,
+              exceptions: span.events
+                .filter((event) => event.name === "exception")
+                .map((event) => event.attributes["exception.message"]),
+            })),
+        ).toEqual([
+          {
+            attempt: "1",
+            failure: "timeout",
+            status: "error",
+            exceptions: [
+              "The database failed (ConnectionError): PgConnection: Connection timed out",
+            ],
+          },
         ]);
+        const retried = connects.filter((span) => span.tags["db.connect.attempt"] === "2");
+        expect(
+          retried.map((span) => ({
+            retryReason: span.tags["db.connect.retry_reason"],
+            failure: span.tags["db.connect.failure"],
+            status: span.status,
+          })),
+        ).toEqual([{ retryReason: "PgConnection: Connection timed out", status: "ok" }]);
       }).pipe(Effect.provide(McpClient.layer)),
     ),
   );
@@ -851,6 +901,76 @@ return out;`,
       ),
     { timeout: 240_000 },
   );
+  it.effect(
+    scenarios.cloudScheduleConnectionsClose.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors,
+            evidence = yield* Evidence,
+            locks = yield* cloudLocks;
+          const prefix = `/api/organizations/${actors.organization.id}`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Coordinator connections ${randomUUID().slice(0, 8)}`,
+            files: [{ path: "index.ts", content: scheduledAppSource }, appsManifest],
+          });
+          expect(deployed.status).toBe(200);
+          const app = yield* body(App, deployed);
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+          );
+          const schedule = `${prefix}/apps/${app.id}/schedules/tick`;
+          expect(
+            (yield* api.request(actors.owner, "PATCH", schedule, {
+              enabled: true,
+              approvalMode: "automatic",
+            })).status,
+          ).toBe(200);
+
+          // The coordinator claims and records the run on its own connections.
+          expect((yield* api.request(actors.owner, "POST", `${schedule}/run`)).status).toBe(200);
+          yield* api.request(actors.owner, "GET", `${prefix}/scheduled-runs?app=${app.id}`).pipe(
+            Effect.flatMap((response) => body(Runs, response)),
+            Effect.flatMap((runs) =>
+              runs.some((run) => run.name === "tick" && run.status === "succeeded")
+                ? Effect.void
+                : Effect.fail(new Error("The scheduled run has not succeeded")),
+            ),
+            Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 120 }),
+          );
+
+          // An open connection keeps a Durable Object from hibernating, and the coordinator wakes
+          // at least once a minute. Connections held for the MCP sessions' 120-second window
+          // after each pass kept it in memory, billing duration, around the clock. Other
+          // scenarios' writes wake it meanwhile, so the count is read until a moment between
+          // passes, well before that window would end.
+          const counts: Array<number> = [];
+          yield* locks
+            .run({
+              sql: "select count(*)::int as connections from pg_stat_activity where application_name = $1",
+              params: ["executor schedules"],
+            })
+            .pipe(
+              Effect.flatMap(Schema.decodeUnknownEffect(Connections)),
+              Effect.orDie,
+              Effect.flatMap((rows) => {
+                const connections = rows[0]?.connections ?? 0;
+                counts.push(connections);
+                return connections === 0
+                  ? Effect.void
+                  : Effect.fail(new Error("The coordinator still holds connections"));
+              }),
+              Effect.retry({ schedule: Schedule.spaced("100 millis"), times: 300 }),
+              Effect.ensuring(
+                Effect.suspend(() => evidence.json("schedule-connections.json", counts)),
+              ),
+            );
+        }),
+      ),
+    { timeout: 120_000 },
+  );
   it.effect(
     scenarios.cloudMcpParallelCalls.title,
     (context) =>
diff --git a/e2e/tests/cloud-job-outcomes.spec.ts b/e2e/tests/cloud-job-outcomes.spec.ts
new file mode 100644
index 0000000000..598a07cab3
--- /dev/null
+++ b/e2e/tests/cloud-job-outcomes.spec.ts
@@ -0,0 +1,294 @@
+/**
+ * Most Cloud background jobs handle their own failure: they log it, and their route still answers
+ * 204 so a caller that retries until the job finishes does not retry. The cron's `job.dispatch`
+ * span records how each run ended instead: `executor.outcome`, and `executor.job.failure`, the
+ * failure's error tag, when the run did not complete. A failed run marks that span as an error.
+ *
+ * The welcome email job fails here because PostgreSQL refuses to claim the owner's welcome, which
+ * this scenario makes the oldest one waiting. Only a run over every user's welcomes claims it:
+ * a new user's own delivery claims only that user's.
+ *
+ * A welcome run sends each waiting welcome in turn, and its outcome counts them. The batch scenario
+ * adds two recipients ahead of every other waiting welcome: one with an empty address, which the
+ * mail provider refuses, and one it accepts. A trigger lets a run claim only those two, the refused
+ * one first, so the welcomes of other cases' new users cannot join the batch.
+ */
+import { randomUUID } from "node:crypto";
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schedule, Schema } from "effect";
+import { HttpClient } from "effect/http";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { writeRows } from "../support/cloud-rows.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { Target } from "../support/platform.ts";
+
+/** Better Auth user IDs; the bound keeps the trigger's name within PostgreSQL's 63 bytes. */
+const SessionUser = Schema.Struct({
+  user: Schema.Struct({ id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9]{8,40}$/u)) }),
+});
+
+const Welcomes = Schema.Array(Schema.Struct({ user_id: Schema.String, status: Schema.String }));
+
+/** Fire the cron that starts the welcome email, workflow and app domain jobs. */
+const fireFiveMinuteCron = Effect.gen(function* () {
+  const target = yield* Target;
+  const http = yield* HttpClient.HttpClient;
+  yield* Effect.scoped(
+    http
+      .get(
+        `${target.metadata.origin}/cdn-cgi/handler/scheduled?cron=${encodeURIComponent("*/5 * * * *")}`,
+      )
+      .pipe(Effect.flatMap((response) => response.text)),
+  );
+});
+
+/** The traces of every delivered dispatch of `job`. */
+const dispatchTraces = (job: string) =>
+  Effect.gen(function* () {
+    const found = yield* (yield* Telemetry).search("job.dispatch", { "executor.job": job });
+    return new Set(found.data.map((entry) => entry.traceId));
+  });
+
+/** A dispatch of `job` with `outcome` in none of the `before` traces, with its job route. */
+const dispatched = (
+  before: ReadonlySet<string>,
+  job: string,
+  outcome: "completed" | "partial" | "failed",
+) =>
+  Effect.gen(function* () {
+    const telemetry = yield* Telemetry;
+    const found = yield* telemetry.search("job.dispatch", {
+      "executor.job": job,
+      "executor.outcome": outcome,
+    });
+    const entry = found.data.find(({ traceId }) => !before.has(traceId));
+    if (entry === undefined)
+      return yield* Effect.fail(new Error(`No ${outcome} ${job} dispatch has reached Motel`));
+    const trace = yield* telemetry.query(entry.traceId);
+    const dispatch = trace.data.find(
+      ({ span }) => span.operationName === "job.dispatch" && span.tags["executor.job"] === job,
+    );
+    const route = trace.data.find(
+      ({ span }) =>
+        span.operationName.startsWith("http.server") &&
+        span.tags["url.path"] === `/api/internal/jobs/${job}`,
+    );
+    return dispatch === undefined || route === undefined
+      ? yield* Effect.fail(new Error("The dispatch and its job route have not both arrived"))
+      : { trace, dispatch: dispatch.span, route: route.span };
+  }).pipe(Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 60 }));
+
+layer(HostedLive, { excludeTestServices: true })("Cloud background job outcomes", (it) => {
+  it.effect(scenarios.cloudJobOutcomes.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          evidence = yield* Evidence;
+        const { user } = yield* body(
+          SessionUser,
+          yield* api.request(actors.owner, "GET", "/api/auth/get-session"),
+        );
+        const fault = `"e2e_welcome_fault_${user.id}"`;
+
+        // Registered before the fault, so a failure while installing it still removes it. Marks
+        // the welcome sent, so no later run sends it.
+        yield* Effect.addFinalizer(() =>
+          writeRows("sso-database.json", [
+            { sql: `drop function if exists ${fault}() cascade` },
+            {
+              sql: `update cloud_welcome_email set status = 'sent', attempted_at = now(),
+                sent_at = now() where user_id = $1`,
+              params: [user.id],
+            },
+          ]).pipe(Effect.orDie),
+        );
+        yield* evidence.step(
+          "Make the owner's welcome the oldest waiting, and refuse its claim",
+          writeRows("sso-database.json", [
+            {
+              sql: `insert into cloud_welcome_email (user_id, created_at) values ($1, '2000-01-01Z')
+                on conflict (user_id) do update set status = 'pending', attempted_at = null,
+                  sent_at = null, created_at = excluded.created_at`,
+              params: [user.id],
+            },
+            {
+              sql: `create function ${fault}() returns trigger language plpgsql as $$
+                begin raise exception 'Synthetic welcome email claim failure'; end $$`,
+            },
+            {
+              sql: `create trigger ${fault} before update on cloud_welcome_email for each row
+                when (old.user_id = '${user.id}' and new.status = 'attempting')
+                execute function ${fault}()`,
+            },
+          ]),
+        );
+
+        const before = yield* Effect.all({
+          "welcome-emails": dispatchTraces("welcome-emails"),
+          "workflow-reconcile": dispatchTraces("workflow-reconcile"),
+          "app-domain-heartbeat": dispatchTraces("app-domain-heartbeat"),
+        });
+        // The local Worker also fires this cron on its own; a tick after the fault fails the same way.
+        yield* fireFiveMinuteCron;
+
+        const failed = yield* dispatched(before["welcome-emails"], "welcome-emails", "failed");
+        yield* evidence.json("failed-welcome-dispatch.json", failed.trace);
+        // The job handled its failure: the route still answered 204 and its request is not an error.
+        expect(failed.route.tags["http.response.status_code"]).toBe("204");
+        expect(failed.route.status).not.toBe("error");
+        expect(failed.dispatch).toMatchObject({
+          status: "error",
+          tags: {
+            "http.response.status_code": "204",
+            "executor.outcome": "failed",
+            "executor.job.failure": "WelcomeEmailUnavailable",
+          },
+        });
+
+        // The same cron's other jobs finished their work.
+        for (const job of ["workflow-reconcile", "app-domain-heartbeat"] as const) {
+          const completed = yield* dispatched(before[job], job, "completed");
+          expect(completed.route.tags["http.response.status_code"]).toBe("204");
+          expect(completed.dispatch.status).not.toBe("error");
+          expect(completed.dispatch.tags).toMatchObject({
+            "http.response.status_code": "204",
+            "executor.outcome": "completed",
+          });
+          expect(completed.dispatch.tags).not.toHaveProperty("executor.job.failure");
+        }
+      }),
+    ),
+  );
+
+  it.effect(scenarios.cloudJobBatchOutcomes.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const evidence = yield* Evidence;
+        const id = randomUUID().replaceAll("-", "");
+        const refused = `e2e-refused-${id}`;
+        const accepted = `e2e-accepted-${id}`;
+        const gate = `"e2e_welcome_batch_${id}"`;
+        // The database backend of each run that claimed the refused welcome. A delivery holds one
+        // connection, so the backend names the run.
+        const claimants = `"e2e_welcome_batch_claimants_${id}"`;
+
+        // Registered before anything is installed, so a failure part-way still removes it all.
+        // Deleting the recipients deletes their welcomes.
+        yield* Effect.addFinalizer(() =>
+          writeRows("sso-database.json", [
+            { sql: `drop function if exists ${gate}() cascade` },
+            { sql: `drop table if exists ${claimants}` },
+            { sql: `delete from "user" where id in ($1, $2)`, params: [refused, accepted] },
+          ]).pipe(Effect.orDie),
+        );
+        // Taken before the batch exists, so a run the Worker's own cron starts on it is fresh too.
+        const beforeMixed = yield* dispatchTraces("welcome-emails");
+        yield* evidence.step(
+          "Add two recipients ahead of every waiting welcome, and let a run claim only them",
+          writeRows("sso-database.json", [
+            {
+              sql: `insert into "user" (id, name, email, "emailVerified", "createdAt", "updatedAt")
+                values ($1, 'Refused recipient', '', true, now(), now()),
+                  ($2, 'Accepted recipient', $3, true, now(), now())`,
+              params: [refused, accepted, `${accepted}@example.test`],
+            },
+            // A verified user's provisioning job sends their own welcome; only the welcome run may.
+            {
+              sql: `delete from hosted_provisioning where user_id in ($1, $2)`,
+              params: [refused, accepted],
+            },
+            {
+              sql: `update cloud_welcome_email set created_at = case user_id
+                  when $1 then timestamptz '2000-01-01 00:00:00Z'
+                  else timestamptz '2000-01-01 00:00:01Z' end
+                where user_id in ($1, $2)`,
+              params: [refused, accepted],
+            },
+            // A skipped claim leaves the run nothing to send, so it ends. The accepted welcome is
+            // claimed only once the refused one was tried, and only by the run that tried it, so
+            // one run sends both even when the Worker's own cron overlaps it.
+            { sql: `create table ${claimants} (pid integer not null)` },
+            {
+              sql: `create function ${gate}() returns trigger language plpgsql as $$
+                begin
+                  if old.user_id = '${refused}' then
+                    insert into ${claimants} (pid) values (pg_backend_pid());
+                    return new;
+                  end if;
+                  if old.user_id = '${accepted}'
+                    and exists (select 1 from ${claimants} where pid = pg_backend_pid())
+                    and not exists (select 1 from cloud_welcome_email
+                      where user_id = '${refused}' and status in ('pending', 'attempting'))
+                  then return new; end if;
+                  return null;
+                end $$`,
+            },
+            {
+              sql: `create trigger ${gate} before update on cloud_welcome_email for each row
+                when (new.status = 'attempting') execute function ${gate}()`,
+            },
+          ]),
+        );
+        const welcomes = writeRows("sso-database.json", [
+          {
+            sql: `select user_id, status from cloud_welcome_email where user_id in ($1, $2)
+              order by created_at`,
+            params: [refused, accepted],
+          },
+        ]).pipe(Effect.flatMap(([rows]) => Schema.decodeUnknownEffect(Welcomes)(rows)));
+
+        // The provider refuses one welcome and accepts the other: the run is partial. Two runs
+        // overlap; the one that does not claim the refused welcome claims nothing.
+        yield* Effect.all([fireFiveMinuteCron, fireFiveMinuteCron], { concurrency: "unbounded" });
+        const partial = yield* dispatched(beforeMixed, "welcome-emails", "partial");
+        yield* evidence.json("partial-welcome-dispatch.json", partial.trace);
+        expect(yield* welcomes).toEqual([
+          { user_id: refused, status: "uncertain" },
+          { user_id: accepted, status: "sent" },
+        ]);
+        expect(partial.route.tags["http.response.status_code"]).toBe("204");
+        expect(partial.route.status).not.toBe("error");
+        // A partial run is not a failed one, so its span is not an error.
+        expect(partial.dispatch.status).not.toBe("error");
+        expect(partial.dispatch.tags).toMatchObject({
+          "http.response.status_code": "204",
+          "executor.outcome": "partial",
+          "executor.job.failure": "EmailDeliveryFailed",
+        });
+
+        // With only the refused welcome waiting, every unit of the next run fails.
+        const beforeRefused = yield* dispatchTraces("welcome-emails");
+        yield* writeRows("sso-database.json", [
+          {
+            sql: `update cloud_welcome_email set status = 'pending', attempted_at = null
+              where user_id = $1`,
+            params: [refused],
+          },
+        ]);
+        yield* fireFiveMinuteCron;
+        const failed = yield* dispatched(beforeRefused, "welcome-emails", "failed");
+        yield* evidence.json("failed-welcome-batch-dispatch.json", failed.trace);
+        expect(yield* welcomes).toEqual([
+          { user_id: refused, status: "uncertain" },
+          { user_id: accepted, status: "sent" },
+        ]);
+        expect(failed.route.tags["http.response.status_code"]).toBe("204");
+        expect(failed.route.status).not.toBe("error");
+        expect(failed.dispatch).toMatchObject({
+          status: "error",
+          tags: {
+            "http.response.status_code": "204",
+            "executor.outcome": "failed",
+            "executor.job.failure": "EmailDeliveryFailed",
+          },
+        });
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/cloud-mcp-session-restore.spec.ts b/e2e/tests/cloud-mcp-session-restore.spec.ts
index 6add50e92e..0b8501e0d7 100644
--- a/e2e/tests/cloud-mcp-session-restore.spec.ts
+++ b/e2e/tests/cloud-mcp-session-restore.spec.ts
@@ -7,9 +7,14 @@
  * bearer is verified and names the object, and a session the object never stored is still not
  * found. An object keeps its 64 most recently used sessions; concurrent first requests after a
  * wake restore sessions while another opens and prunes, and every answer agrees with the store.
+ * A program waiting for approval through that idle wait keeps its own object in memory, so the
+ * person's answer still continues it (FB-069: idle eviction lost it and resume said not-found).
+ * After a restart, a resume of an answered request says what the object recorded: `answered`
+ * when it stored the answer, and, when that write failed (the local hook in
+ * `mcp-interaction-faults-local.ts`), `lost` copy that does not claim the request went unanswered.
  *
- * Not covered here: the 7-day expiry (managed Cloud has no clock control) and a failing storage
- * call (no public surface can cause one, and Cloud scenarios cannot inject storage faults).
+ * Not covered here: the 7-day expiry (managed Cloud has no clock control) and a failing session
+ * storage call (no public surface can cause one; the hook refuses only request-record writes).
  */
 import { createHmac, randomBytes, randomUUID } from "node:crypto";
 import { expect, layer } from "@effect/vitest";
@@ -17,8 +22,9 @@ import { Duration, Effect, FileSystem, Redacted, Schedule, Schema } from "effect
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { Actors } from "../support/actors.ts";
 import { Api, body } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
 import { HostedLive, withHostedCase } from "../support/case.ts";
-import type { SpanQuery } from "../support/contracts.ts";
+import { App, type SpanQuery } from "../support/contracts.ts";
 import { Evidence, Telemetry } from "../support/evidence.ts";
 import { Target } from "../support/platform.ts";
 import { scenarios } from "../test-plan.ts";
@@ -38,6 +44,39 @@ const native = "?elicitation_mode=native";
  * the wait checks that the object did restart.
  */
 const idle = Duration.seconds(270);
+/** An app whose one tool always asks for approval. */
+const reviewSource = `import { defineApp, mutation, object, string, router } from "apps";
+import { always } from "apps/operations/approval";
+export default defineApp({}, async () => ({ tools: router({
+  review: mutation({ input: object({ note: string() }), approval: always(), description: "Record a reviewed note" },
+    async (_ctx, { note }) => ({ reviewed: note })),
+}) }));`;
+const Paused = Schema.Struct({
+  result: Schema.Struct({
+    structuredContent: Schema.Struct({
+      status: Schema.Literal("approval-required"),
+      requestId: Schema.String,
+      expiresAt: Schema.Number,
+    }),
+  }),
+});
+const Unavailable = Schema.Struct({
+  result: Schema.Struct({
+    structuredContent: Schema.Struct({
+      status: Schema.Literal("unavailable"),
+      reason: Schema.String,
+      message: Schema.String,
+    }),
+  }),
+});
+const Resumed = Schema.Struct({
+  result: Schema.Struct({
+    structuredContent: Schema.Struct({
+      status: Schema.Literal("completed"),
+      execution: Schema.Struct({ ok: Schema.Boolean, value: Schema.Unknown }),
+    }),
+  }),
+});
 /** Sessions an object keeps (`mcp-session-store.ts`). */
 const kept = 64;
 
@@ -87,6 +126,8 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session restore", (i
             readonly session?: string | undefined;
             readonly protocol?: string | undefined;
             readonly query?: string | undefined;
+            /** Refuse the session object's request-record writes while this request runs. */
+            readonly refuseRecords?: boolean;
             readonly message: Readonly<Record<string, unknown>>;
           }) =>
             Effect.scoped(
@@ -104,6 +145,9 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session restore", (i
                     ...(input.protocol === undefined
                       ? {}
                       : { "mcp-protocol-version": input.protocol }),
+                    ...(input.refuseRecords === true
+                      ? { "x-executor-test-fault": "interaction-writes" }
+                      : {}),
                   }),
                 );
                 const response = yield* http.execute(
@@ -221,6 +265,8 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session restore", (i
           const owner = yield* createKey(actors.owner, "Session restore owner");
           const member = yield* createKey(actors.member, "Session restore member");
           const crowded = yield* createKey(actors.owner, "Session restore crowded");
+          const parked = yield* createKey(actors.owner, "Session restore parked");
+          const answering = yield* createKey(actors.owner, "Session restore answered");
           const session = yield* initialize(owner.key, "owner");
           const nativeSession = yield* initialize(owner.key, "owner-native", native);
           const before = yield* evidence.step(
@@ -262,11 +308,170 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session restore", (i
             ),
           );
 
+          const prefix = `/api/organizations/${organization}`;
+          const app = yield* evidence.step(
+            "Deploy an app whose tool always asks for approval",
+            Effect.gen(function* () {
+              const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+                name: `Parked review ${randomUUID().slice(0, 8)}`,
+                files: [{ path: "index.ts", content: reviewSource }, appsManifest],
+              });
+              expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+              const deployedApp = yield* body(App, deployed);
+              yield* Effect.addFinalizer(() =>
+                api
+                  .request(actors.owner, "DELETE", `${prefix}/apps/${deployedApp.id}`)
+                  .pipe(Effect.ignore),
+              );
+              return deployedApp;
+            }),
+          );
+          /** Calls the review tool, which pauses for approval. */
+          const pause = (credential: Redacted.Redacted<string>, mcpSession: string, note: string) =>
+            Effect.gen(function* () {
+              const answer = yield* post({
+                credential,
+                session: mcpSession,
+                protocol: stateful,
+                message: {
+                  id: 4,
+                  method: "tools/call",
+                  params: {
+                    name: "call",
+                    arguments: {
+                      calls: {
+                        path: `tools[${JSON.stringify(app.slug)}].review`,
+                        input: { note },
+                      },
+                    },
+                  },
+                },
+              });
+              expect(answer.status, answer.text).toBe(200);
+              const paused = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Paused))(
+                answer.text,
+              );
+              return {
+                requestId: paused.result.structuredContent.requestId,
+                activation: activation(yield* objectSpans(answer.traceId)),
+              };
+            });
+          const approve = (
+            credential: Redacted.Redacted<string>,
+            mcpSession: string,
+            requestId: string,
+            refuseRecords = false,
+          ) =>
+            post({
+              credential,
+              session: mcpSession,
+              protocol: stateful,
+              refuseRecords,
+              message: {
+                id: 5,
+                method: "tools/call",
+                params: {
+                  name: "resume",
+                  arguments: { requestId, response: { action: "accept" } },
+                },
+              },
+            });
+          const reviewed = (answer: { status: number; text: string }, note: string) =>
+            Effect.gen(function* () {
+              expect(answer.status, answer.text).toBe(200);
+              const resumed = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Resumed))(
+                answer.text,
+              );
+              expect(resumed.result.structuredContent.execution).toMatchObject({
+                ok: true,
+                value: { ok: true, value: { reviewed: note } },
+              });
+            });
+
+          // A third object, of its own API key, holds a program that waits for approval.
+          const review = yield* evidence.step(
+            "Another object pauses a call for approval",
+            Effect.gen(function* () {
+              const parkedSession = yield* open(parked.key, "parked");
+              return {
+                session: parkedSession,
+                ...(yield* pause(parked.key, parkedSession, "parked")),
+              };
+            }),
+          );
+
+          // A fourth object answers two requests. Its write of the first answer is refused, as a
+          // failing storage call would, so after the restart its record holds only the issue.
+          const answered = yield* evidence.step(
+            "Another object answers two requests, the first while it cannot write its record of the answer",
+            Effect.gen(function* () {
+              const answeredSession = yield* open(answering.key, "answered");
+              const unrecorded = yield* pause(answering.key, answeredSession, "unrecorded");
+              yield* reviewed(
+                yield* approve(answering.key, answeredSession, unrecorded.requestId, true),
+                "unrecorded",
+              );
+              const recorded = yield* pause(answering.key, answeredSession, "recorded");
+              yield* reviewed(
+                yield* approve(answering.key, answeredSession, recorded.requestId),
+                "recorded",
+              );
+              return {
+                session: answeredSession,
+                unrecorded: unrecorded.requestId,
+                recorded: recorded.requestId,
+                activation: recorded.activation,
+              };
+            }),
+          );
+
           yield* evidence.step(
             "Leave every session idle until workerd evicts the objects and their memory",
             Effect.sleep(idle),
           );
 
+          yield* evidence.step(
+            "The paused call's object stayed in memory through the wait, so approving it runs the call",
+            Effect.gen(function* () {
+              const answer = yield* approve(parked.key, review.session, review.requestId);
+              yield* reviewed(answer, "parked");
+              expect(
+                activation(yield* objectSpans(answer.traceId)),
+                "The object that held the program did not restart",
+              ).toBe(review.activation);
+            }),
+          );
+
+          yield* evidence.step(
+            "After its object restarted, a recorded answer reads answered, and an answer whose record failed reads lost without claiming the request went unanswered",
+            Effect.gen(function* () {
+              const unavailable = (requestId: string) =>
+                Effect.gen(function* () {
+                  const answer = yield* approve(answering.key, answered.session, requestId);
+                  expect(answer.status, answer.text).toBe(200);
+                  const result = yield* Schema.decodeUnknownEffect(
+                    Schema.fromJsonString(Unavailable),
+                  )(answer.text);
+                  return { ...result.result.structuredContent, traceId: answer.traceId };
+                });
+              const recorded = yield* unavailable(answered.recorded);
+              expect(recorded.reason, recorded.message).toBe("answered");
+              expect(
+                activation(yield* objectSpans(recorded.traceId)),
+                "The object restarted, so only its storage knows the requests",
+              ).not.toBe(answered.activation);
+              const unrecorded = yield* unavailable(answered.unrecorded);
+              expect(unrecorded.reason, unrecorded.message).toBe("lost");
+              expect(unrecorded.message).toContain(
+                "no retained record of an answer or of how it ended",
+              );
+              expect(unrecorded.message).toContain("the request may have been answered");
+              expect(unrecorded.message).not.toMatch(
+                /had not expired or been answered|expired before it was answered/u,
+              );
+            }),
+          );
+
           yield* evidence.step(
             "Another user's bearer with the session's id is refused before the object reads its storage",
             Effect.gen(function* () {
diff --git a/e2e/tests/cloud-mcp-session-routing.spec.ts b/e2e/tests/cloud-mcp-session-routing.spec.ts
index fe48692164..6582a5fc33 100644
--- a/e2e/tests/cloud-mcp-session-routing.spec.ts
+++ b/e2e/tests/cloud-mcp-session-routing.spec.ts
@@ -7,6 +7,7 @@
  * unknown session gets, a missing or revoked bearer is refused as before, the previous signing key
  * still verifies and an unknown one does not, the stateless protocol and OAuth refresh keep
  * working, and a session the object no longer holds is not found until the client initializes again.
+ * The gateway's spans name each request's JSON-RPC method and Executor tool from closed sets.
  */
 import { createHmac, randomBytes, randomUUID } from "node:crypto";
 import { expect, layer } from "@effect/vitest";
@@ -77,15 +78,22 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session routing", (i
               return key;
             });
 
-          /** One MCP POST under its own trace; the answer is JSON or one SSE message. */
-          const post = (input: {
-            readonly credential?: Redacted.Redacted<string> | undefined;
-            readonly session?: string | undefined;
-            readonly protocol?: string;
-            readonly message: Readonly<Record<string, unknown>>;
-            readonly headers?: Readonly<Record<string, string>>;
-            readonly query?: string;
-          }) =>
+          /**
+           * One MCP POST under its own trace; the answer is JSON or one SSE message. A `batch`
+           * sends its messages as one array in place of `message`.
+           */
+          const post = (
+            input: {
+              readonly credential?: Redacted.Redacted<string> | undefined;
+              readonly session?: string | undefined;
+              readonly protocol?: string;
+              readonly headers?: Readonly<Record<string, string>>;
+              readonly query?: string;
+            } & (
+              | { readonly message: Readonly<Record<string, unknown>> }
+              | { readonly batch: ReadonlyArray<Readonly<Record<string, unknown>>> }
+            ),
+          ) =>
             Effect.scoped(
               Effect.gen(function* () {
                 const traceId = randomBytes(16).toString("hex");
@@ -107,7 +115,12 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session routing", (i
                   }),
                 );
                 const response = yield* http.execute(
-                  yield* HttpClientRequest.bodyJson(request, { jsonrpc: "2.0", ...input.message }),
+                  yield* HttpClientRequest.bodyJson(
+                    request,
+                    "batch" in input
+                      ? input.batch.map((message) => ({ jsonrpc: "2.0", ...message }))
+                      : { jsonrpc: "2.0", ...input.message },
+                  ),
                 );
                 const text = yield* response.text;
                 const data = text
@@ -228,6 +241,14 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session routing", (i
           const forwardedAndAnswered = (list: ReadonlyArray<Span>) =>
             objectAnswered(list) &&
             list.some((span) => span.operationName === "mcp.session.forward");
+          /** As above, and the gateway's request span, which can end in a later export, arrived. */
+          const forwardedWithRequest = (list: ReadonlyArray<Span>) =>
+            forwardedAndAnswered(list) &&
+            list.some(
+              (span) =>
+                span.operationName === "mcp.session.forward" &&
+                list.some((parent) => parent.spanId === span.parentSpanId),
+            );
 
           /** A key Alchemy minted for this local Cloud, read from its state. */
           const state = yield* fs
@@ -293,6 +314,124 @@ layer(HostedLive, { excludeTestServices: true })("Cloud MCP session routing", (i
             }),
           );
 
+          yield* evidence.step(
+            "The gateway names each request's JSON-RPC method and Executor tool, never a name the caller chose",
+            Effect.gen(function* () {
+              const chosen = `private_${randomUUID().replaceAll("-", "")}`;
+              const inSession = (message: Readonly<Record<string, unknown>>) =>
+                post({
+                  credential: owner.key,
+                  session: ownerSession.session,
+                  protocol: stateful,
+                  message,
+                });
+              const cases = [
+                { label: "initialize", trace: ownerSession.trace, method: "initialize" },
+                {
+                  label: "a tool listing",
+                  trace: (yield* listTools(owner.key, ownerSession.session)).traceId,
+                  method: "tools/list",
+                },
+                {
+                  label: "an Executor tool's call",
+                  trace: (yield* inSession({
+                    id: 3,
+                    method: "tools/call",
+                    params: { name: "describe", arguments: {} },
+                  })).traceId,
+                  method: "tools/call",
+                  tool: "describe",
+                },
+                {
+                  label: "a call naming a tool Executor lacks",
+                  trace: (yield* inSession({
+                    id: 4,
+                    method: "tools/call",
+                    params: { name: chosen, arguments: { [chosen]: chosen } },
+                  })).traceId,
+                  method: "tools/call",
+                  tool: "other",
+                },
+                {
+                  label: "a notification",
+                  trace: (yield* inSession({
+                    method: "notifications/cancelled",
+                    params: { requestId: 99 },
+                  })).traceId,
+                  method: "notifications/cancelled",
+                },
+                {
+                  label: "a method MCP does not define",
+                  trace: (yield* inSession({ id: 5, method: chosen })).traceId,
+                  method: "other",
+                },
+                // MCP defines these, but only a server sends them, so Executor's server never
+                // takes them from a client.
+                {
+                  label: "a notification only a server sends",
+                  trace: (yield* inSession({
+                    method: "notifications/subscriptions/acknowledged",
+                    params: { notifications: {} },
+                  })).traceId,
+                  method: "other",
+                },
+                {
+                  label: "a request only a server sends",
+                  trace: (yield* inSession({
+                    id: 8,
+                    method: "sampling/createMessage",
+                    params: { messages: [], maxTokens: 1 },
+                  })).traceId,
+                  method: "other",
+                },
+                {
+                  label: "a client's answer to a server request",
+                  trace: (yield* inSession({ id: chosen, result: { action: "cancel" } })).traceId,
+                  method: "response",
+                },
+                {
+                  label: "a batch",
+                  trace: (yield* post({
+                    credential: owner.key,
+                    session: ownerSession.session,
+                    protocol: stateful,
+                    batch: [
+                      { id: 6, method: "ping" },
+                      { id: 7, method: chosen },
+                    ],
+                  })).traceId,
+                  method: "batch",
+                },
+              ];
+              for (const { label, trace: traceId, method, tool } of cases) {
+                const trace = yield* spans(traceId, forwardedWithRequest);
+                const forward = trace.named(trace.gateway, "mcp.session.forward");
+                const server = forward.map((span) =>
+                  trace.all.find((parent) => parent.spanId === span.parentSpanId),
+                );
+                const recorded = (span: Span | undefined) => ({
+                  name: span?.operationName,
+                  system: span?.tags["rpc.system.name"],
+                  method: span?.tags["rpc.method"],
+                  tool: span?.tags["executor.mcp.tool"],
+                });
+                const expected = { system: "jsonrpc", method, tool };
+                expect(forward.map(recorded), label).toEqual([
+                  { name: "mcp.session.forward", ...expected },
+                ]);
+                expect(server.map(recorded), `${label}: the gateway's request span`).toEqual([
+                  { name: "http.server POST", ...expected },
+                ]);
+                expect(
+                  trace.gateway.filter((span) =>
+                    JSON.stringify([span.operationName, span.tags]).includes(chosen),
+                  ),
+                  `${label}: no gateway span records the caller's names`,
+                ).toEqual([]);
+              }
+            }),
+          );
+
           /** A refused id is answered in the gateway: no forward, no object, no database. */
           const refusedInGateway = (label: string, session: string) =>
             evidence.step(
diff --git a/e2e/tests/cloud-mcp-subrequest-depth.spec.ts b/e2e/tests/cloud-mcp-subrequest-depth.spec.ts
new file mode 100644
index 0000000000..3947f7ef2c
--- /dev/null
+++ b/e2e/tests/cloud-mcp-subrequest-depth.spec.ts
@@ -0,0 +1,256 @@
+/**
+ * Cloudflare refuses a call into a Worker or Durable Object once its request has entered the
+ * Workers runtime too many times. A client that calls Cloud's MCP from deep inside its own Worker
+ * chain reaches that limit at the gateway's call to the session object. The gateway must then say
+ * why, with a 508 and a JSON-RPC error, instead of an empty 500.
+ *
+ * A disposable relay Worker calls itself through a service binding `hops` times, then posts an MCP
+ * initialize to a deployed stage. The scenario raises `hops` until the relay's own call is refused.
+ * Each step adds one Worker invocation, so the deepest request the stage still answers is the one
+ * whose call to the session object was refused, and every shallower one initializes.
+ *
+ * Local workerd does not enforce the limit, so this runs by hand against a deployed stage, with
+ * vault-bound Cloudflare credentials to upload and delete the relay:
+ * `bunx vitest run --config e2e/subrequest-depth.config.ts`. It needs
+ * `SUBREQUEST_DEPTH_MCP_URL`, the stage's MCP endpoint (`https://mcp.<slug>.<test domain>/mcp`),
+ * `SUBREQUEST_DEPTH_MCP_KEY`, an API key of a synthetic test account on that stage, and
+ * `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN`.
+ */
+import { randomBytes } from "node:crypto";
+import { expect, layer } from "@effect/vitest";
+import { Config, Console, Effect, Layer, Redacted, Schedule, Schema } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+
+class DepthScenarioFailed extends Schema.TaggedError<DepthScenarioFailed>()("DepthScenarioFailed", {
+  operation: Schema.String,
+  status: Schema.optionalKey(Schema.Number),
+}) {}
+
+/** Forwards the MCP request it holds once its own hop count reaches zero; holds no state. */
+const relaySource = `
+export default {
+  async fetch(request, env) {
+    if (request.method !== "POST" || request.headers.get("x-relay-key") !== env.RELAY_KEY)
+      return new Response(null, { status: 404 });
+    const url = new URL(request.url);
+    const hops = Number(url.searchParams.get("hops"));
+    if (!Number.isSafeInteger(hops) || hops < 0) return new Response(null, { status: 400 });
+    const body = await request.text();
+    const refused = (error) =>
+      Response.json({ outcome: "refused", message: error instanceof Error ? error.message : String(error) });
+    if (hops > 0) {
+      url.searchParams.set("hops", String(hops - 1));
+      try {
+        return await env.SELF.fetch(url, { method: "POST", headers: request.headers, body });
+      } catch (error) {
+        return refused(error);
+      }
+    }
+    const headers = new Headers();
+    for (const name of ["authorization", "accept", "content-type", "mcp-protocol-version"]) {
+      const value = request.headers.get(name);
+      if (value !== null) headers.set(name, value);
+    }
+    try {
+      const answer = await fetch(env.TARGET, { method: "POST", headers, body });
+      return Response.json({ outcome: "answered", status: answer.status, text: await answer.text() });
+    } catch (error) {
+      return refused(error);
+    }
+  },
+};
+`;
+
+const CloudflareResult = Schema.Struct({
+  success: Schema.Boolean,
+  result: Schema.optional(Schema.Unknown),
+});
+const RelayAnswer = Schema.Union([
+  Schema.Struct({
+    outcome: Schema.Literal("answered"),
+    status: Schema.Number,
+    text: Schema.String,
+  }),
+  Schema.Struct({ outcome: Schema.Literal("refused"), message: Schema.String }),
+]);
+const RefusalBody = Schema.fromJsonString(
+  Schema.Struct({
+    jsonrpc: Schema.Literal("2.0"),
+    id: Schema.Null,
+    error: Schema.Struct({ code: Schema.Number, message: Schema.String }),
+  }),
+);
+const depthLimit = /^Subrequest depth limit exceeded/u;
+/** Well past Cloudflare's 32 Worker invocations per request, so the sweep always ends refused. */
+const maximumHops = 64;
+
+layer(Layer.mergeAll(FetchHttpClient.layer), { excludeTestServices: true })(
+  "Cloud MCP subrequest depth",
+  (it) => {
+    it.effect(
+      "explains a request refused at the subrequest depth limit instead of failing with an empty 500",
+      () =>
+        Effect.gen(function* () {
+          const target = yield* Config.String("SUBREQUEST_DEPTH_MCP_URL");
+          expect(new URL(target).protocol).toBe("https:");
+          const credential = yield* Config.Redacted("SUBREQUEST_DEPTH_MCP_KEY");
+          const account = yield* Config.String("CLOUDFLARE_ACCOUNT_ID");
+          const token = yield* Config.Redacted("CLOUDFLARE_API_TOKEN");
+          const http = yield* HttpClient.HttpClient;
+          const workers = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(account)}/workers`;
+          const cloudflare = (operation: string, request: HttpClientRequest.HttpClientRequest) =>
+            Effect.scoped(
+              Effect.gen(function* () {
+                const response = yield* http.execute(
+                  request.pipe(HttpClientRequest.bearerToken(token)),
+                );
+                const value = yield* response.json.pipe(
+                  Effect.flatMap(Schema.decodeUnknownEffect(CloudflareResult)),
+                );
+                if (!value.success)
+                  return yield* new DepthScenarioFailed({ operation, status: response.status });
+                return value.result;
+              }),
+            ).pipe(
+              Effect.mapError((error) =>
+                Schema.is(DepthScenarioFailed)(error)
+                  ? error
+                  : new DepthScenarioFailed({ operation }),
+              ),
+            );
+
+          const name = `e2e-subrequest-depth-${randomBytes(4).toString("hex")}`;
+          const key = randomBytes(24).toString("hex");
+          const upload = (bindings: ReadonlyArray<Readonly<Record<string, string>>>) => {
+            const form = new FormData();
+            form.set(
+              "metadata",
+              new Blob(
+                [
+                  JSON.stringify({
+                    main_module: "relay.js",
+                    compatibility_date: "2026-09-08",
+                    bindings: [
+                      { type: "secret_text", name: "RELAY_KEY", text: key },
+                      { type: "plain_text", name: "TARGET", text: target },
+                      ...bindings,
+                    ],
+                  }),
+                ],
+                { type: "application/json" },
+              ),
+            );
+            form.set(
+              "relay.js",
+              new Blob([relaySource], { type: "application/javascript+module" }),
+              "relay.js",
+            );
+            return cloudflare(
+              "Upload the relay",
+              HttpClientRequest.put(`${workers}/scripts/${name}`).pipe(
+                HttpClientRequest.bodyFormData(form),
+              ),
+            );
+          };
+          yield* Effect.acquireRelease(upload([]), () =>
+            cloudflare(
+              "Delete the relay",
+              HttpClientRequest.delete(`${workers}/scripts/${name}?force=true`),
+            ).pipe(Effect.catch(() => Console.error(`Could not delete the relay Worker ${name}.`))),
+          );
+          // A service binding names an existing script, so the relay binds itself on its second upload.
+          yield* upload([{ type: "service", name: "SELF", service: name }]);
+          yield* cloudflare(
+            "Enable the relay's workers.dev route",
+            yield* HttpClientRequest.post(`${workers}/scripts/${name}/subdomain`).pipe(
+              HttpClientRequest.bodyJson({ enabled: true, previews_enabled: false }),
+            ),
+          );
+          const subdomain = yield* cloudflare(
+            "Read the workers.dev subdomain",
+            HttpClientRequest.get(`${workers}/subdomain`),
+          ).pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ subdomain: Schema.String }))),
+          );
+          const relay = `https://${name}.${subdomain.subdomain}.workers.dev`;
+
+          const initialize = JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+              protocolVersion: "2025-06-18",
+              capabilities: {},
+              clientInfo: { name: "subrequest-depth", version: "1" },
+            },
+          });
+          const at = (hops: number) =>
+            Effect.scoped(
+              Effect.gen(function* () {
+                const response = yield* http.execute(
+                  HttpClientRequest.post(`${relay}/?hops=${hops}`).pipe(
+                    HttpClientRequest.setHeaders({
+                      "x-relay-key": key,
+                      authorization: `Bearer ${Redacted.value(credential)}`,
+                      accept: "application/json, text/event-stream",
+                      "mcp-protocol-version": "2025-06-18",
+                    }),
+                    HttpClientRequest.bodyText(initialize, "application/json"),
+                  ),
+                );
+                if (response.status !== 200)
+                  return yield* new DepthScenarioFailed({
+                    operation: "Call the relay",
+                    status: response.status,
+                  });
+                return yield* response.json.pipe(
+                  Effect.flatMap(Schema.decodeUnknownEffect(RelayAnswer)),
+                );
+              }),
+            ).pipe(Effect.provideService(HttpClient.TracerPropagationEnabled, false));
+
+          // A new workers.dev route takes a few seconds to answer.
+          const shallowest = yield* at(0).pipe(
+            Effect.retry({ schedule: Schedule.spaced("2 seconds"), times: 45 }),
+          );
+          expect(shallowest, "The relay reaches the stage and the key initializes").toMatchObject({
+            outcome: "answered",
+            status: 200,
+          });
+
+          const answers: Array<typeof RelayAnswer.Type> = [shallowest];
+          for (let hops = 1; hops <= maximumHops; hops++) {
+            const answer = yield* at(hops);
+            answers.push(answer);
+            if (answer.outcome === "refused") break;
+          }
+          const sweep = answers.map((answer, hops) =>
+            answer.outcome === "answered"
+              ? { hops, status: answer.status }
+              : { hops, refused: answer.message },
+          );
+          const refused = answers.at(-1);
+          expect(refused?.outcome, JSON.stringify(sweep)).toBe("refused");
+          if (refused?.outcome === "refused")
+            expect(refused.message, "The sweep reached the platform's own limit").toMatch(
+              depthLimit,
+            );
+
+          const answered = answers.flatMap((answer) =>
+            answer.outcome === "answered" ? [answer] : [],
+          );
+          expect(answered.length, JSON.stringify(sweep)).toBe(answers.length - 1);
+          const deepest = answered.at(-1);
+          expect(
+            answered.slice(0, -1).map((answer) => answer.status),
+            "Every shallower request initializes",
+          ).toEqual(answered.slice(0, -1).map(() => 200));
+          expect(deepest?.status, JSON.stringify(sweep)).toBe(508);
+          const body = yield* Schema.decodeUnknownEffect(RefusalBody)(deepest?.text ?? "");
+          expect(body.error.code).toBe(-32000);
+          expect(body.error.message).toMatch(depthLimit);
+          expect(body.error.message).toContain("Call Executor from a shallower point");
+        }),
+    );
+  },
+);
diff --git a/e2e/tests/cloud-oauth-proxy.spec.ts b/e2e/tests/cloud-oauth-proxy.spec.ts
index e2674b85b3..d1c7dbdab8 100644
--- a/e2e/tests/cloud-oauth-proxy.spec.ts
+++ b/e2e/tests/cloud-oauth-proxy.spec.ts
@@ -76,6 +76,7 @@ const recordedGoogleSignIn = Effect.gen(function* () {
   return {
     identity,
     redirectUri: authorization.searchParams.get("redirect_uri"),
+    prompt: authorization.searchParams.get("prompt"),
     // Each Better Auth callback the browser passed through, without its query.
     callbacks: visited
       .filter((url) => url.pathname.startsWith("/api/auth/callback/"))
@@ -91,6 +92,8 @@ const ownSignIn = Effect.gen(function* () {
   // The provider returns to the edge's registered callback, which sends the browser to the same
   // path on the browser origin. The proxy's completion endpoint is never reached.
   expect(signIn.redirectUri).toBe(`${edge}/api/auth/callback/google`);
+  // Google lets the person choose among their signed-in accounts instead of reusing one.
+  expect(signIn.prompt).toBe("select_account");
   expect(signIn.callbacks).toEqual([
     `${edge}/api/auth/callback/google`,
     `${browser}/api/auth/callback/google`,
diff --git a/e2e/tests/cloud-onboarding-skip-experiment.spec.ts b/e2e/tests/cloud-onboarding-skip-experiment.spec.ts
new file mode 100644
index 0000000000..d67c58f019
--- /dev/null
+++ b/e2e/tests/cloud-onboarding-skip-experiment.spec.ts
@@ -0,0 +1,135 @@
+import { expect, layer } from "@effect/vitest";
+import { Effect } from "effect";
+import { TestLive, withCase } from "../support/case.ts";
+import { Onboarding } from "../support/onboarding.ts";
+import {
+  answerOnboardingFlag,
+  awaitPersonEvents,
+  flagEvaluations,
+  onboardingActions,
+  onboardingFlag,
+  onboardingSkipFlag,
+  type Captured,
+  type OnboardingOrder,
+} from "../support/onboarding-experiment.ts";
+import { Target } from "../support/platform.ts";
+import { scenarios } from "../test-plan.ts";
+
+/** The onboarding actions setup itself reports; team creation's own run before any assignment. */
+const setupActions = new Set([
+  "setup_accounts",
+  "setup_assistant",
+  "setup_guide",
+  "setup_prompt",
+  "skip_accounts",
+  "skip_assistant",
+  "continue_accounts",
+  "continue_assistant",
+  "finish_setup",
+  "leave_setup",
+]);
+const setupEvents = (events: readonly Captured[]) =>
+  onboardingActions(events).filter((event) => setupActions.has(String(event.properties.action)));
+/** The setup actions the member started, in order. */
+const started = (events: readonly Captured[]) =>
+  setupEvents(events)
+    .filter((event) => event.properties.outcome === "started")
+    .map((event) => String(event.properties.action));
+const exposures = (events: readonly Captured[], flag: string) =>
+  events
+    .filter(
+      (event) => event.event === "$feature_flag_called" && event.properties.$feature_flag === flag,
+    )
+    .map((event) => event.properties.$feature_flag_response);
+
+/**
+ * A new member signs in and PostHog assigns `order` and required steps. Setup offers no skip on
+ * either step, the dashboard sends them back to their current step until both are done, and then
+ * opens. Each experiment's exposure is recorded once, from the one evaluation, and every setup
+ * event carries both variants.
+ */
+const completeRequiredSetup = (order: OnboardingOrder) =>
+  Effect.gen(function* () {
+    const target = yield* Target;
+    expect(target.metadata.mode).toBe("managed");
+    const onboarding = yield* Onboarding;
+    yield* onboarding.socialSignIn("google");
+    const name = yield* onboarding.prepareTeam;
+    const userId = yield* onboarding.sessionUserId;
+    yield* answerOnboardingFlag(userId, { variant: order, skip: "required" });
+    yield* onboarding.requiredSetup(name, order);
+
+    const events = yield* awaitPersonEvents(
+      userId,
+      (events) =>
+        setupEvents(events).some((event) => event.properties.action === "finish_setup") &&
+        events.some((event) => event.event === "account_connected") &&
+        events.some((event) => event.event === "agent_connected"),
+    );
+    expect(yield* flagEvaluations(userId)).toBe(1);
+    expect(exposures(events, onboardingSkipFlag)).toEqual(["required"]);
+    expect(exposures(events, onboardingFlag)).toEqual([order]);
+    // Nothing was skipped: each step was continued once it was done.
+    expect(started(events)).toEqual(
+      order === "assistant_first"
+        ? ["continue_assistant", "continue_accounts", "finish_setup"]
+        : ["continue_accounts", "continue_assistant", "finish_setup"],
+    );
+    expect(
+      setupEvents(events).map((event) => [
+        event.properties.action,
+        event.properties.onboarding_skip_variant,
+        event.properties.onboarding_variant,
+      ]),
+    ).toEqual(setupEvents(events).map((event) => [event.properties.action, "required", order]));
+  });
+
+layer(TestLive, { excludeTestServices: true })("Cloud onboarding skip experiment", (it) => {
+  it.effect(scenarios.onboardingRequiredAccountsFirst.title, (context) =>
+    withCase(
+      context,
+      completeRequiredSetup("accounts_first").pipe(Effect.provide(Onboarding.layer)),
+    ),
+  );
+
+  it.effect(scenarios.onboardingRequiredAssistantFirst.title, (context) =>
+    withCase(
+      context,
+      completeRequiredSetup("assistant_first").pipe(Effect.provide(Onboarding.layer)),
+    ),
+  );
+
+  it.effect(scenarios.onboardingSkippable.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target;
+        expect(target.metadata.mode).toBe("managed");
+        const onboarding = yield* Onboarding;
+        yield* onboarding.socialSignIn("google");
+        const name = yield* onboarding.prepareTeam;
+        const userId = yield* onboarding.sessionUserId;
+        // The order flag is left out, so the order experiment serves its control untracked.
+        yield* answerOnboardingFlag(userId, { skip: "skippable" });
+        // Today's setup: each step offers Skip for now, and skipping both opens the dashboard.
+        yield* onboarding.confirmTeam(name, "skip");
+        const events = yield* awaitPersonEvents(userId, (events) =>
+          setupEvents(events).some((event) => event.properties.action === "skip_assistant"),
+        );
+        expect(yield* flagEvaluations(userId)).toBe(1);
+        expect(exposures(events, onboardingSkipFlag)).toEqual(["skippable"]);
+        expect(exposures(events, onboardingFlag)).toEqual([]);
+        expect(started(events)).toEqual(["skip_accounts", "skip_assistant"]);
+        expect(
+          setupEvents(events).map((event) => [
+            event.properties.action,
+            event.properties.onboarding_skip_variant,
+            "onboarding_variant" in event.properties,
+          ]),
+        ).toEqual(
+          setupEvents(events).map((event) => [event.properties.action, "skippable", false]),
+        );
+      }).pipe(Effect.provide(Onboarding.layer)),
+    ),
+  );
+});
diff --git a/e2e/tests/cloud-onboarding.spec.ts b/e2e/tests/cloud-onboarding.spec.ts
index 1f60a28952..4e7800e6f3 100644
--- a/e2e/tests/cloud-onboarding.spec.ts
+++ b/e2e/tests/cloud-onboarding.spec.ts
@@ -22,7 +22,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud onboarding", (it) => {
         expect(yield* onboarding.suggestedTeamName).toBe(identity.companyName);
         expect(yield* onboarding.organizations).toEqual([]);
         const name = yield* onboarding.prepareTeam;
-        const team = yield* onboarding.confirmTeam(name, "connect");
+        const team = yield* onboarding.confirmTeam(name);
         const browser = yield* Browser;
         yield* onboarding.signOut;
         const list = yield* holdOrganizationEntry;
@@ -41,6 +41,17 @@ layer(TestLive, { excludeTestServices: true })("Cloud onboarding", (it) => {
     ),
   );
 
+  it.effect(scenarios.onboardingAssistant.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const onboarding = yield* Onboarding;
+        yield* onboarding.socialSignIn("github");
+        yield* onboarding.confirmTeam(yield* onboarding.prepareTeam, "connect");
+      }).pipe(Effect.provide(Onboarding.layer)),
+    ),
+  );
+
   it.effect(scenarios.onboardingGithub.title, (context) =>
     withCase(
       context,
diff --git a/e2e/tests/cloud-role-hosts.spec.ts b/e2e/tests/cloud-role-hosts.spec.ts
index aab253c7f0..02e5e80af1 100644
--- a/e2e/tests/cloud-role-hosts.spec.ts
+++ b/e2e/tests/cloud-role-hosts.spec.ts
@@ -366,4 +366,131 @@ layer(HostedLive, { excludeTestServices: true })("Cloud role hosts", (it) => {
       }),
     ),
   );
+
+  it.effect(scenarios.cloudInvocationSurface.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          target = yield* Target,
+          telemetry = yield* Telemetry;
+        const origin = target.metadata.origin;
+        const mcp = roleHost(origin, "mcp"),
+          apiHost = roleHost(origin, "api"),
+          app = roleHost(origin, "app"),
+          edge = roleHost(origin, "edge");
+        const issued = yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+          name: "Cloud invocation surface",
+        });
+        expect(issued.status).toBe(200);
+        const pat = yield* body(Token, issued);
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: pat.id })
+            .pipe(Effect.orDie),
+        );
+        const key = Redacted.value(pat.key);
+        // A private value in each query string and in two user agents; no record may carry it.
+        const marker = `private-${randomUUID()}`;
+        const browserAgent =
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36";
+        const requests = [
+          {
+            url: `${mcp}/mcp?marker=${marker}`,
+            init: {
+              ...mcpPost(key),
+              headers: {
+                ...mcpPost(key).headers,
+                "x-executor-organization": actors.organization.id,
+              },
+            },
+            agent: `claude-code/2.1.0 (cli; ${marker})`,
+            status: 200,
+            expected: { role: "mcp", group: "mcp", family: "claude-code" },
+          },
+          {
+            url: `${apiHost}/api/organizations/${actors.organization.id}/inventory?marker=${marker}`,
+            init: bearer(key),
+            agent: "python-httpx/0.28.1",
+            status: 200,
+            expected: { role: "api", group: "api", family: "sdk" },
+          },
+          {
+            url: `${origin}/api/webhooks/${randomUUID()}/${randomUUID()}?marker=${marker}`,
+            init: { method: "POST", headers: {}, body: "{}" },
+            agent: `${marker}/1.0`,
+            status: undefined,
+            expected: { role: "deployment", group: "webhooks", family: "other" },
+          },
+          {
+            url: `${app}/login?marker=${marker}`,
+            init: { headers: { accept: "text/html" } },
+            agent: browserAgent,
+            status: 200,
+            expected: { role: "app", group: "document", family: "browser" },
+          },
+          {
+            url: `${edge}/api/auth/callback/github?code=${marker}&state=${marker}`,
+            init: { headers: {} },
+            agent: "curl/8.7.1",
+            status: 302,
+            expected: { role: "edge", group: "auth", family: "cli" },
+          },
+        ] as const;
+        const sent = [];
+        for (const request of requests) {
+          const traceId = randomBytes(16).toString("hex"),
+            parent = randomBytes(8).toString("hex");
+          const response = yield* rawRequest(request.url, {
+            ...request.init,
+            headers: {
+              ...request.init.headers,
+              "user-agent": request.agent,
+              traceparent: `00-${traceId}-${parent}-01`,
+            },
+          });
+          if (request.status !== undefined)
+            expect(response.status, request.url).toBe(request.status);
+          sent.push({ request, traceId });
+        }
+        // The API Worker's own invocation record. An MCP session object's record of the same
+        // request can arrive minutes later, past this scenario's deadline, so it is not awaited.
+        const apiWorker = ({
+          span,
+        }: {
+          readonly span: { readonly tags: Record<string, string> };
+        }) =>
+          span.tags["cloudflare.script_name"]?.startsWith("executor-next-hosted-api") === true &&
+          span.tags["cloudflare.entrypoint"] === undefined;
+        for (const { request, traceId } of sent) {
+          // The Tail receiver records each invocation shortly after it ends.
+          const span = yield* telemetry
+            .search("cloudflare.invocation", { "executor.trace_id": traceId })
+            .pipe(
+              Effect.flatMap(({ data }) => {
+                const record = data.find(apiWorker);
+                return record === undefined
+                  ? Effect.fail(new Error(`No invocation record yet for ${request.url}`))
+                  : Effect.succeed(record.span);
+              }),
+              Effect.retry({ schedule: Schedule.spaced("1 second"), times: 40 }),
+            );
+          expect(
+            {
+              role: span.tags["executor.host_role"],
+              group: span.tags["executor.route.group"],
+              family: span.tags["executor.client.family"],
+            },
+            request.url,
+          ).toEqual(request.expected);
+          // Neither the URL nor the user agent is recorded, in any form.
+          for (const recorded of ["url.full", "url.path", "url.query", "user_agent.original"])
+            expect(span.tags[recorded], request.url).toBeUndefined();
+          expect(JSON.stringify(span), request.url).not.toContain(marker);
+          expect(JSON.stringify(span), request.url).not.toContain(request.agent);
+        }
+      }),
+    ),
+  );
 });
diff --git a/e2e/tests/cloud-schedule-capacity.spec.ts b/e2e/tests/cloud-schedule-capacity.spec.ts
new file mode 100644
index 0000000000..97494d3380
--- /dev/null
+++ b/e2e/tests/cloud-schedule-capacity.spec.ts
@@ -0,0 +1,110 @@
+/**
+ * Cloud's one schedule coordinator runs every organization's scheduled runs. A run holds its slot
+ * while its mutation waits on the services it calls, so slow runs must not keep other due runs
+ * from starting. With the Node hosts' 8 slots, nine slow runs left one of them, and every later
+ * due run, waiting until a slow run finished.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schedule, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { appsManifest } from "../support/apps-release.ts";
+
+/** More slow runs than the 8 slots Cloud used to share between organizations. */
+const slowCount = 9;
+/** How long each slow run waits, standing in for a slow service. */
+const slowMs = 15_000;
+
+const slowNames = Array.from({ length: slowCount }, (_, index) => `slow${index + 1}`);
+/** Hourly schedules never fall due during the scenario; Run Now makes each one due. */
+const source = `import { defineApp, mutation, userInterval, object, router } from "apps";
+const slow = mutation({ input: object({}) }, async () => {
+  await new Promise((resolve) => setTimeout(resolve, ${slowMs}));
+  return { done: true };
+});
+const quick = mutation({ input: object({}) }, async () => ({ done: true }));
+export default defineApp({}, async () => ({ tools: router({ slow, quick }), schedules: {
+${slowNames.map((name) => `  ${name}: userInterval({ minutes: 60 }, slow, {}),`).join("\n")}
+  quick: userInterval({ minutes: 60 }, quick, {}),
+} }));`;
+
+const Runs = Schema.Array(
+  Schema.Struct({
+    name: Schema.String,
+    status: Schema.String,
+    startedAt: Schema.String,
+    finishedAt: Schema.NullOr(Schema.String),
+  }),
+);
+class Pending extends Schema.TaggedError<Pending>()("Pending", { finished: Schema.Number }) {}
+
+layer(HostedLive, { excludeTestServices: true })("Cloud schedule capacity", (it) => {
+  it.effect(
+    scenarios.cloudScheduleCapacity.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors;
+          const prefix = `/api/organizations/${actors.organization.id}`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Capacity ${randomUUID().slice(0, 8)}`,
+            files: [{ path: "index.ts", content: source }, appsManifest],
+          });
+          expect(deployed.status).toBe(200);
+          const app = yield* body(App, deployed);
+          const path = `${prefix}/apps/${app.id}`;
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
+          );
+          const names = [...slowNames, "quick"];
+          for (const name of names)
+            expect(
+              (yield* api.request(actors.owner, "PATCH", `${path}/schedules/${name}`, {
+                enabled: true,
+                approvalMode: "automatic",
+              })).status,
+            ).toBe(200);
+          // Every slow run is due before the quick one, so a full pool admits the slow runs first.
+          for (const name of names)
+            expect(
+              (yield* api.request(actors.owner, "POST", `${path}/schedules/${name}/run`)).status,
+            ).toBe(200);
+
+          // Each slow run finishes about 15 s after it starts. Waiting for all of them bounds the
+          // poll by the slow runs' own duration, not by a guess at the coordinator's speed.
+          const runs = yield* api
+            .request(actors.owner, "GET", `${prefix}/scheduled-runs?app=${app.id}`)
+            .pipe(
+              Effect.flatMap((response) => body(Runs, response)),
+              Effect.flatMap((runs) => {
+                const finished = runs.filter((run) => run.finishedAt !== null).length;
+                return finished === names.length
+                  ? Effect.succeed(runs)
+                  : Effect.fail(new Pending({ finished }));
+              }),
+              Effect.retry({
+                while: (error) => error instanceof Pending,
+                schedule: Schedule.spaced("500 millis"),
+                times: 120,
+              }),
+            );
+          expect(runs.map((run) => run.status)).toEqual(names.map(() => "succeeded"));
+          const at = (time: string) => Date.parse(time);
+          const slow = runs.filter((run) => run.name !== "quick");
+          const quick = runs.find((run) => run.name === "quick")!;
+          const firstSlowEnd = Math.min(...slow.map((run) => at(run.finishedAt!)));
+          // All nine slow runs were in flight together, and the quick run started and finished
+          // while they were: none of them waited for a slow run to free its slot.
+          expect(Math.max(...slow.map((run) => at(run.startedAt)))).toBeLessThan(firstSlowEnd);
+          expect(at(quick.finishedAt!)).toBeLessThan(firstSlowEnd);
+        }),
+      ),
+    { timeout: 120_000 },
+  );
+});
diff --git a/e2e/tests/cloud-v1-import-run.spec.ts b/e2e/tests/cloud-v1-import-run.spec.ts
index 435696792b..777a725dad 100644
--- a/e2e/tests/cloud-v1-import-run.spec.ts
+++ b/e2e/tests/cloud-v1-import-run.spec.ts
@@ -4,20 +4,107 @@
  * v1 rows into the managed Cloud's emulated v1 database, members into the emulated v1 WorkOS and
  * secrets into its Vault, and read v2's own rows to prove what was and was not written.
  */
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
 import { expect, layer } from "@effect/vitest";
-import { Effect, Layer, Schedule, Schema } from "effect";
+import { Effect, FileSystem, Layer, Redacted, Schedule, Schema } from "effect";
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientRequest,
+  HttpRouter,
+  HttpServer,
+  HttpServerRequest,
+  HttpServerResponse,
+} from "effect/http";
 import { TestLive, withCase } from "../support/case.ts";
 import { Browser } from "../support/browser.ts";
 import { writeRows, type RowStatement } from "../support/cloud-rows.ts";
 import { Emulators } from "../support/emulators.ts";
+import { McpClient } from "../support/mcp-client.ts";
 import { Telemetry } from "../support/evidence.ts";
 import { Onboarding } from "../support/onboarding.ts";
-import { v1ImportOperator, v1RunId } from "../support/v1-import.ts";
+import { Target } from "../support/platform.ts";
+import {
+  allowV1Import,
+  listV1Into,
+  listV1SlugDisplacement,
+  v1ImportOperator,
+  v1RunId,
+  type V1Report,
+} from "../support/v1-import.ts";
+import {
+  V1McpForwardSecret,
+  v1ForwardBearer,
+  v1McpForwardFile,
+} from "../support/v1-mcp-forward.ts";
 import { scenarios } from "../test-plan.ts";
 
 const services = Layer.mergeAll(Onboarding.layer, Emulators.layer);
 
+/**
+ * OAuth MCP servers at `/<name>/mcp` on loopback, for each of `names`, as far as a sign-in reaches
+ * them: each refuses a request without a token with a challenge naming its resource metadata,
+ * which names this origin's authorization server. The import discovers them before it saves an
+ * account, and the dry run does too.
+ */
+const mcpSignInServers = (names: readonly string[]) =>
+  Effect.gen(function* () {
+    const at = Effect.map(
+      HttpServerRequest.HttpServerRequest,
+      (request) => `http://${request.headers.host}`,
+    );
+    const routes = Layer.mergeAll(
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-authorization-server",
+        Effect.flatMap(at, (origin) =>
+          HttpServerResponse.json({
+            issuer: origin,
+            authorization_endpoint: `${origin}/authorize`,
+            token_endpoint: `${origin}/token`,
+            response_types_supported: ["code"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["client_secret_post"],
+          }),
+        ),
+      ),
+      ...names.flatMap((name) => [
+        HttpRouter.add(
+          "*",
+          `/${name}/mcp`,
+          Effect.map(at, (origin) =>
+            HttpServerResponse.empty({
+              status: 401,
+              headers: {
+                "www-authenticate": `Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource/${name}/mcp"`,
+              },
+            }),
+          ),
+        ),
+        HttpRouter.add(
+          "GET",
+          `/.well-known/oauth-protected-resource/${name}/mcp`,
+          Effect.flatMap(at, (origin) =>
+            HttpServerResponse.json({
+              resource: `${origin}/${name}/mcp`,
+              authorization_servers: [origin],
+            }),
+          ),
+        ),
+      ]),
+    );
+    const built = yield* Layer.build(
+      HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+        Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
+      ),
+    );
+    const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(built));
+    if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+    return `127.0.0.1:${server.address.port}`;
+  });
+
 const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
 const Rows = Schema.Array(Schema.Array(Schema.Unknown));
 
@@ -228,7 +315,157 @@ const seedShared = (
 
 const IdRow = Schema.Struct({ id: Schema.String });
 
+/** A synthetic address no other scenario uses. */
+const syntheticEmail = (label: string) => `${label}-${randomUUID().slice(0, 8)}@example.test`;
+
+/** A v2 user with a verified email, as v2 sign-in leaves them. */
+const v2User = (email: string) =>
+  Effect.gen(function* () {
+    const id = randomUUID();
+    yield* writeRows("sso-database.json", [
+      row(
+        `insert into "user" (id, name, email, "emailVerified", "createdAt", "updatedAt") values ($1, 'Synthetic member', $2, true, now(), now())`,
+        id,
+        email,
+      ),
+    ]);
+    return id;
+  });
+
+/** A v2 team its owner made. */
+const v2Team = (owner: string) =>
+  Effect.gen(function* () {
+    const id = randomUUID();
+    yield* writeRows("sso-database.json", [
+      row(
+        `insert into organization (id, name, slug, "createdAt") values ($1, 'Synthetic team', $2, now())`,
+        id,
+        `team-${randomUUID().slice(0, 8)}`,
+      ),
+      row(
+        `insert into member (id, "organizationId", "userId", role, "createdAt") values ($1, $2, $3, 'owner', now())`,
+        randomUUID(),
+        id,
+        owner,
+      ),
+    ]);
+    return id;
+  });
+
+/** A v2 user and the team they own. */
+const ownV2Team = (email: string) => Effect.flatMap(v2User(email), v2Team);
+
+/** A v1 workspace of these members, allowed and listed to move into `into`, in `mode`. */
+const listedV1Workspace = (
+  label: string,
+  members: readonly [string, ...string[]],
+  into: string,
+  mode?: string,
+) =>
+  Effect.gen(function* () {
+    const emulators = yield* Emulators;
+    const created = yield* emulators.v1Workspace(members);
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        created.organization,
+        `Synthetic ${label} workspace`,
+        `v1-${randomUUID().slice(0, 8)}`,
+      ),
+    ]);
+    yield* allowV1Import(created.organization);
+    yield* listV1Into(created.organization, into, mode);
+    return created;
+  });
+
+/** A rule of an integration v1 deleted: an item the import plans, with nothing to run. */
+const goneRule = (organization: string) =>
+  row(
+    "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, 'block', 'a0')",
+    organization,
+    `gone_${randomUUID().slice(0, 6)}.*.*.search`,
+  );
+
 layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
+  it.effect(scenarios.v1ImportSplitNames.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        const older = `older-${randomUUID().slice(0, 8)}@example.test`;
+        const first = yield* emulators.identity("google");
+        const workspace = yield* emulators.v1Workspace([older, first.email]);
+        const olderUser = workspace.user;
+        const firstUser = yield* emulators.v1User(first.email);
+        yield* emulators.setV1MemberRole(workspace.organization, olderUser, "member");
+        const former = yield* emulators.v1Workspace([
+          `former-${randomUUID().slice(0, 8)}@example.test`,
+        ]);
+        const { tracker } = yield* seedShared(
+          workspace.organization,
+          `v1-${randomUUID().slice(0, 8)}`,
+          { first: firstUser, second: olderUser, former: former.user },
+        );
+        // A workspace rule blocks searching through the team connection alone, so each connection
+        // becomes its own app; both members named their own connection `mine`.
+        yield* writeRows("v1-database.json", [
+          row(
+            "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, 'block', 'b0')",
+            workspace.organization,
+            `${tracker}.org.team.search`,
+          ),
+        ]);
+        yield* signInOnV1(first.email);
+        yield* allowV1Import(workspace.organization);
+        const run = v1RunId("split-names");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [workspace.organization],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, workspace.organization);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        const target = report.v2Organization;
+        if (target === undefined) return yield* Effect.die("The import named no organization");
+        expect(
+          (report.splitIntegrations?.[0]?.apps ?? []).map((app) => [app.name, app.status]).sort(),
+        ).toEqual([
+          ["Shared Tracker (mine 2)", "imported"],
+          ["Shared Tracker (mine)", "imported"],
+          ["Shared Tracker (team)", "imported"],
+        ]);
+        // The first member made their `mine` first, so theirs keeps the name; each member's app is
+        // theirs alone, and the team connection's is everyone's, made by the owner.
+        const userOf = (email: string) =>
+          cloudRows(
+            Schema.Struct({ id: Schema.String }),
+            `select id from "user" where lower(email) = lower($1)`,
+            email,
+          ).pipe(Effect.map((users) => users[0]?.id));
+        const firstV2 = yield* userOf(first.email);
+        const olderV2 = yield* userOf(older);
+        const access = yield* cloudRows(
+          Schema.Struct({
+            name: Schema.String,
+            audience: Schema.String,
+            creator: Schema.NullOr(Schema.String),
+          }),
+          `select a.name, h.audience, h.creator_id as creator from executor_apps a
+            join hosted_app_access h on h.id = a.id
+            where a.owner = $1 and a.name like 'Shared Tracker%'`,
+          `organization:${target.id}`,
+        );
+        expect([...access].sort((a, b) => (a.name < b.name ? -1 : 1))).toEqual([
+          { name: "Shared Tracker (mine 2)", audience: "private", creator: olderV2 },
+          { name: "Shared Tracker (mine)", audience: "private", creator: firstV2 },
+          { name: "Shared Tracker (team)", audience: "everyone", creator: firstV2 },
+        ]);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
   it.effect(scenarios.v1ImportShared.title, (context) =>
     withCase(
       context,
@@ -258,6 +495,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
         // The first member already has a v2 account with the same verified email.
         yield* signInOnV1(first.email);
 
+        yield* allowV1Import(workspace.organization);
         const run = v1RunId("shared");
         const started = yield* operator.start({
           mode: "import",
@@ -496,6 +734,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
         ]);
         yield* signInOnV1(identity.email);
 
+        yield* allowV1Import(workspace.organization);
         const run = v1RunId("rollback");
         const started = yield* operator.start({
           mode: "import",
@@ -554,6 +793,1249 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
     ),
   );
 
+  it.effect(scenarios.v1ImportPaidBilling.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        const identity = yield* emulators.identity("google");
+        const workspace = (label: string, email: string) =>
+          Effect.gen(function* () {
+            const created = yield* emulators.v1Workspace([email]);
+            yield* writeRows("v1-database.json", [
+              row(
+                "insert into organizations (id, name, slug) values ($1, $2, $3)",
+                created.organization,
+                `Synthetic ${label} workspace`,
+                `v1-${randomUUID().slice(0, 8)}`,
+              ),
+            ]);
+            return created.organization;
+          });
+        const seats = yield* workspace("per-member", identity.email);
+        const flat = yield* workspace("flat", `flat-${randomUUID().slice(0, 8)}@example.test`);
+        const hobby = yield* workspace("hobby", `hobby-${randomUUID().slice(0, 8)}@example.test`);
+        // v1's Team version 3 per member, cancelled at the end of its period; version 1 at a flat
+        // USD 49 with executions metered on top; and grandfathered Hobby, which moves to Free.
+        const perMember = yield* emulators.v1TeamSubscription(seats, {
+          version: 3,
+          seats: 1,
+          cancelled: true,
+        });
+        const flatPrice = yield* emulators.v1TeamSubscription(flat, { version: 1 });
+        yield* emulators.v1Plan(hobby, "hobby");
+        yield* signInOnV1(identity.email);
+
+        yield* allowV1Import(seats, flat, hobby);
+        const run = v1RunId("paid");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [seats, flat, hobby],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+
+        const carried = (organization: string) =>
+          Effect.gen(function* () {
+            const report = yield* operator.waitForReport(run, organization);
+            expect(report.status, report.reason ?? "").toBe("imported");
+            expect(report.cutover).toBe(true);
+            const target = report.v2Organization;
+            if (target === undefined) return yield* Effect.die("The import named no organization");
+            // v1's customer became the v2 organization's: v1's id has none left.
+            expect(yield* emulators.autumnCustomer(organization)).toBeNull();
+            const customerId = yield* emulators.v2BillingCustomer(target.id);
+            const namespace = customerId.slice(0, customerId.indexOf(":organization:"));
+            const customer = yield* emulators.autumnCustomer(customerId);
+            if (customer === null) return yield* Effect.die("The v2 organization has no customer");
+            return { report, target, customerId, namespace, customer };
+          });
+
+        const moved = yield* carried(seats);
+        expect(moved.report.billing).toEqual({
+          subscription: {
+            plan: "team",
+            version: 3,
+            pricing: "per_member",
+            v2Pricing: "per_member",
+            trialing: false,
+            cancelling: true,
+          },
+          problem: null,
+          carried: true,
+        });
+        // v2's Team plan alone bills it, on v1's Stripe subscription, renewing when v1's did and
+        // still cancelled then. v1's free plan stays scheduled after it, which v2 ignores.
+        const team = moved.customer.subscriptions.filter((sub) => sub.status !== "scheduled");
+        expect(team).toMatchObject([
+          {
+            plan_id: `${moved.namespace}-team`,
+            current_period_end: perMember.periodEnd,
+            expires_at: perMember.periodEnd,
+          },
+        ]);
+        expect(team[0]?.canceled_at).not.toBeNull();
+        expect(yield* emulators.autumnStripeSubscriptions(moved.customerId)).toEqual([
+          perMember.stripeSubscription,
+        ]);
+        // Its seats synced once the subscription was v2's.
+        expect(moved.customer.balances[`${moved.namespace}-members`]?.usage).toBe(1);
+        expect(
+          yield* cloudRows(
+            Schema.Struct({ state: Schema.String, stripe_subscription_id: Schema.String }),
+            "select state, stripe_subscription_id from private_v1_import_billing where organization_id = $1",
+            moved.target.id,
+          ),
+        ).toEqual([{ state: "carried", stripe_subscription_id: perMember.stripeSubscription }]);
+        const overview = yield* call(
+          "Read the moved organization's billing",
+          `/api/organizations/${moved.target.id}/billing`,
+        );
+        expect(overview.status).toBe(200);
+        expect(overview.body).toMatchObject({
+          subscriptions: [{ planId: `${moved.namespace}-team` }],
+        });
+
+        // A flat price stays the price, with unlimited members, on its Stripe subscription.
+        const kept = yield* carried(flat);
+        expect(kept.report.billing).toMatchObject({
+          subscription: { version: 1, pricing: "flat", v2Pricing: "flat", cancelling: false },
+          carried: true,
+        });
+        expect(kept.customer.subscriptions).toMatchObject([
+          {
+            plan_id: `${kept.namespace}-team`,
+            current_period_end: flatPrice.periodEnd,
+            canceled_at: null,
+            plan: { price: { amount: 49, interval: "month" } },
+          },
+        ]);
+        expect(kept.customer.balances[`${kept.namespace}-members`]?.unlimited).toBe(true);
+        expect(yield* emulators.autumnStripeSubscriptions(kept.customerId)).toEqual([
+          flatPrice.stripeSubscription,
+        ]);
+
+        // Hobby moves as a free organization does: nothing carries over and v1's customer is
+        // left as it was, while v2's billing puts the organization on its Free plan.
+        const free = yield* operator.waitForReport(run, hobby);
+        expect(free.status, free.reason ?? "").toBe("imported");
+        expect(free.cutover).toBe(true);
+        expect(free.billing).toBeUndefined();
+        expect(free.flags).toMatchObject({ paidPlans: ["hobby"] });
+        const freeTarget = free.v2Organization;
+        if (freeTarget === undefined) return yield* Effect.die("The import named no organization");
+        expect(yield* movedFlag(hobby)).toEqual([
+          { state: "moved", v2_org_id: freeTarget.id, v2_org_slug: freeTarget.slug },
+        ]);
+        expect(
+          yield* cloudRows(
+            Schema.Struct({ state: Schema.String }),
+            "select state from private_v1_import_billing where organization_id = $1",
+            freeTarget.id,
+          ),
+        ).toEqual([]);
+        expect((yield* emulators.autumnCustomer(hobby))?.subscriptions).toMatchObject([
+          { plan_id: "hobby" },
+        ]);
+        const freeCustomerId = yield* emulators.v2BillingCustomer(freeTarget.id);
+        const freePlan = `${freeCustomerId.slice(0, freeCustomerId.indexOf(":organization:"))}-free`;
+        const onFree = yield* emulators.autumnCustomer(freeCustomerId).pipe(
+          Effect.flatMap((customer) =>
+            customer === null
+              ? Effect.fail(new Error("v2 has not made the organization's customer yet"))
+              : Effect.succeed(customer),
+          ),
+          Effect.retry(Schedule.spaced("1 second").pipe(Schedule.upTo({ duration: "50 seconds" }))),
+        );
+        expect(onFree.subscriptions.map((sub) => sub.plan_id)).toEqual([freePlan]);
+        expect(yield* emulators.autumnStripeSubscriptions(freeCustomerId)).toEqual([]);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportBillingReturn.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators,
+          browser = yield* Browser;
+        const operator = yield* v1ImportOperator;
+        const identity = yield* emulators.identity("google");
+        const workspace = yield* emulators.v1Workspace([identity.email]);
+        yield* writeRows("v1-database.json", [
+          row(
+            "insert into organizations (id, name, slug) values ($1, $2, $3)",
+            workspace.organization,
+            "Synthetic returned workspace",
+            `v1-${randomUUID().slice(0, 8)}`,
+          ),
+        ]);
+        const v1 = yield* emulators.v1TeamSubscription(workspace.organization, {
+          version: 3,
+          seats: 1,
+        });
+        yield* signInOnV1(identity.email);
+        yield* allowV1Import(workspace.organization);
+
+        // Autumn refuses the attach once, after the customer took v2's id.
+        const fault = yield* emulators.failAutumnReads("billing.attach", { status: 400, times: 1 });
+        yield* Effect.addFinalizer(() => emulators.clearAutumnFault(fault).pipe(Effect.orDie));
+        const run = v1RunId("billing-return");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [workspace.organization],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, workspace.organization);
+        expect(report.status).toBe("failed");
+        expect(report.reason).toContain("Its subscription did not carry over");
+        expect(report.cutover).toBe(false);
+        expect(report.billing).toMatchObject({ carried: false });
+        const target = report.v2Organization;
+        if (target === undefined) return yield* Effect.die("The import named no organization");
+        // It stays frozen in v1, charged nothing, and its billing stays held.
+        expect((yield* movedFlag(workspace.organization))[0]?.state).toBe("moving");
+        const customerId = yield* emulators.v2BillingCustomer(target.id);
+        const halfway = yield* emulators.autumnCustomer(customerId);
+        expect(halfway?.subscriptions).toMatchObject([{ plan_id: "team" }]);
+        expect(
+          yield* cloudRows(
+            Schema.Struct({ state: Schema.String }),
+            "select state from private_v1_import_billing where organization_id = $1",
+            target.id,
+          ),
+        ).toEqual([{ state: "held" }]);
+        // While held, v2's billing makes no customer and offers no checkout.
+        const overview = yield* call(
+          "Read the held organization's billing",
+          `/api/organizations/${target.id}/billing`,
+        );
+        expect(overview.status).toBe(503);
+        const checkout = yield* browser.use("Try a checkout for the held organization", (page) =>
+          page.evaluate(
+            (id) =>
+              fetch(`/api/organizations/${id}/billing/checkout`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ plan: "team" }),
+              }).then((response) => response.status),
+            target.id,
+          ),
+        );
+        expect(checkout).toBe(503);
+        // v1 meters an execution meanwhile and makes itself a free customer under its id.
+        yield* emulators.v1MeteredCustomer(workspace.organization);
+
+        const returned = yield* operator.returnBilling(workspace.organization);
+        expect(returned).toEqual({
+          status: 200,
+          body: { organization: workspace.organization, billing: "returned" },
+        });
+        // v1's Team plan bills it again, on the same Stripe subscription, with v1's seats.
+        expect(yield* emulators.autumnCustomer(customerId)).toBeNull();
+        const back = yield* emulators.autumnCustomer(workspace.organization);
+        expect(back?.subscriptions).toMatchObject([
+          {
+            plan_id: "team",
+            current_period_end: v1.periodEnd,
+            canceled_at: null,
+            plan: { version: 3 },
+          },
+        ]);
+        expect(back?.balances.members?.usage).toBe(1);
+        expect(yield* emulators.autumnStripeSubscriptions(workspace.organization)).toEqual([
+          v1.stripeSubscription,
+        ]);
+        // A second return changes nothing.
+        expect((yield* operator.returnBilling(workspace.organization)).status).toBe(200);
+
+        // Deleting the v2 organization now cancels nothing, and the organization rolls back.
+        const deleted = yield* browser.use("Delete the imported v2 organization", (page) =>
+          page.evaluate(
+            (id) => fetch(`/api/organizations/${id}`, { method: "DELETE" }).then((r) => r.status),
+            target.id,
+          ),
+        );
+        expect(deleted).toBeLessThan(300);
+        const rolledBack = yield* operator.rollback(workspace.organization).pipe(
+          Effect.flatMap((response) =>
+            response.status === 200
+              ? Effect.succeed(response)
+              : Effect.fail(new Error(JSON.stringify(response.body))),
+          ),
+          Effect.retry(Schedule.spaced("1 second").pipe(Schedule.upTo({ duration: "50 seconds" }))),
+        );
+        expect(rolledBack.body).toEqual({
+          organization: workspace.organization,
+          state: "rolled_back",
+        });
+        expect(
+          (yield* emulators.autumnCustomer(workspace.organization))?.subscriptions,
+        ).toMatchObject([{ plan_id: "team", canceled_at: null }]);
+        expect(yield* emulators.autumnStripeSubscriptions(workspace.organization)).toEqual([
+          v1.stripeSubscription,
+        ]);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportSlugDisplacement.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators,
+          onboarding = yield* Onboarding,
+          browser = yield* Browser;
+        const operator = yield* v1ImportOperator;
+        // Someone else's v2 team, with its Executor app, holds the slug a v1 workspace has.
+        yield* onboarding.socialSignIn("google");
+        const team = yield* onboarding.confirmTeam(yield* onboarding.prepareTeam);
+        const slug = team.slug;
+        const SlugRow = Schema.Struct({ slug: Schema.String });
+        const slugOf = (organization: string) =>
+          cloudRows(SlugRow, "select slug from organization where id = $1", organization).pipe(
+            Effect.map((rows) => rows[0]?.slug),
+          );
+        const MemberRow = Schema.Struct({ userId: Schema.String, role: Schema.String });
+        const membersOf = (organization: string) =>
+          cloudRows(
+            MemberRow,
+            `select "userId", role from member where "organizationId" = $1 order by "userId"`,
+            organization,
+          );
+        const teamMembers = yield* membersOf(team.id);
+        const domainJobs = (organization: string) =>
+          cloudRows(
+            Schema.Struct({ jobs: Schema.Number }),
+            "select count(*)::int as jobs from hosted_provisioning where kind = 'domain' and organization_id = $1",
+            organization,
+          ).pipe(Effect.map((rows) => rows[0]?.jobs ?? 0));
+        const jobsBefore = yield* domainJobs(team.id);
+        const workspace = (label: string, workspaceSlug: string) =>
+          Effect.gen(function* () {
+            const created = yield* emulators.v1Workspace([
+              `${label}-${randomUUID().slice(0, 8)}@example.test`,
+            ]);
+            yield* writeRows("v1-database.json", [
+              row(
+                "insert into organizations (id, name, slug) values ($1, $2, $3)",
+                created.organization,
+                `Synthetic ${label} workspace`,
+                workspaceSlug,
+              ),
+            ]);
+            yield* allowV1Import(created.organization);
+            return created.organization;
+          });
+        const listed = yield* workspace("listed", slug);
+        yield* listV1SlugDisplacement(listed, team.id);
+        // Listed, but the team does not hold this workspace's slug.
+        const freeSlug = `v1-${randomUUID().slice(0, 8)}`;
+        const mislisted = yield* workspace("mislisted", freeSlug);
+        yield* listV1SlugDisplacement(mislisted, team.id);
+        // Another v2 organization holds this one's slug, and nobody listed it.
+        const heldSlug = `v1-${randomUUID().slice(0, 8)}`;
+        const holder = randomUUID();
+        yield* writeRows("sso-database.json", [
+          row(
+            `insert into organization (id, name, slug, "createdAt") values ($1, 'Synthetic holder', $2, now())`,
+            holder,
+            heldSlug,
+          ),
+        ]);
+        const unlisted = yield* workspace("unlisted", heldSlug);
+
+        const dry = v1RunId("displace-dry");
+        expect(
+          (yield* operator.start({
+            mode: "dry-run",
+            runId: dry,
+            organizations: [listed, mislisted, unlisted],
+          })).status,
+        ).toBe(200);
+        const planned = yield* operator.waitForReport(dry, listed);
+        expect(planned.status, planned.reason ?? "").toBe("planned");
+        const renamedTo = planned.slug?.displaced?.slug;
+        if (renamedTo === undefined || renamedTo === null)
+          return yield* Effect.die(
+            `The dry run planned no rename: ${JSON.stringify(planned.slug)}`,
+          );
+        // The team's new slug is its own slug with a suffix; the workspace keeps the slug as it is.
+        expect(renamedTo).toMatch(/^[a-z0-9-]+-[0-9a-f]{6}$/u);
+        expect(slug.startsWith(renamedTo.slice(0, -7))).toBe(true);
+        expect(planned.slug).toEqual({
+          v1: slug,
+          v2: slug,
+          changed: false,
+          displaced: { organization: team.id, slug: renamedTo },
+        });
+        expect((yield* operator.waitForReport(dry, mislisted)).slug).toEqual({
+          v1: freeSlug,
+          v2: freeSlug,
+          changed: false,
+          displaced: {
+            organization: team.id,
+            slug: null,
+            reason: `The listed v2 organization does not hold ${freeSlug}, which is free.`,
+          },
+        });
+        const unlistedPlan = yield* operator.waitForReport(dry, unlisted);
+        expect(unlistedPlan.slug?.changed).toBe(true);
+        expect(unlistedPlan.slug?.displaced).toBeUndefined();
+        expect(unlistedPlan.slug?.v2).toMatch(new RegExp(`^${heldSlug}-[0-9a-f]{6}$`, "u"));
+        // A dry run renames nothing.
+        expect(yield* slugOf(team.id)).toBe(slug);
+
+        const run = v1RunId("displace");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [listed, unlisted],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, listed);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        expect(report.cutover).toBe(true);
+        const target = report.v2Organization;
+        if (target === undefined) return yield* Effect.die("The import named no organization");
+        expect(target.slug).toBe(slug);
+        expect(report.slug).toEqual({
+          v1: slug,
+          v2: slug,
+          changed: false,
+          displaced: { organization: team.id, slug: renamedTo },
+        });
+        expect(yield* movedFlag(listed)).toEqual([
+          { state: "moved", v2_org_id: target.id, v2_org_slug: slug },
+        ]);
+        // The team is renamed as a rename in its settings is: its app domain is queued again.
+        expect(yield* slugOf(team.id)).toBe(renamedTo);
+        expect(yield* membersOf(team.id)).toEqual(teamMembers);
+        expect(yield* domainJobs(team.id)).toBeGreaterThan(jobsBefore);
+        expect(
+          yield* cloudRows(
+            Schema.Struct({ reason: Schema.NullOr(Schema.String) }),
+            "select reason from private_v1_import_map where v1_kind = 'organization' and v1_id = $1",
+            listed,
+          ),
+        ).toEqual([
+          {
+            reason: `Renamed v2 organization ${team.id} from ${slug} to ${renamedTo} to take its slug.`,
+          },
+        ]);
+
+        // The team's member keeps the team and its apps at the new slug; the old one is the
+        // workspace's now, which they are not a member of.
+        expect(
+          (yield* call(
+            "Read the team at its new slug",
+            `/api/organizations/${renamedTo}/inventory`,
+          )).status,
+        ).toBe(200);
+        expect(
+          (yield* call("Read the team by its id", `/api/organizations/${team.id}/inventory`))
+            .status,
+        ).toBe(200);
+        expect(
+          (yield* call("The old slug names the workspace", `/api/organizations/${slug}/inventory`))
+            .status,
+        ).toBe(403);
+        expect(yield* onboarding.organizations).toEqual([{ ...team, slug: renamedTo }]);
+        yield* browser.use("Open the team's apps at its new slug", (page) =>
+          page.goto(`/org/${renamedTo}/apps`),
+        );
+        yield* browser.use("The team's Executor app is still there", (page) =>
+          page
+            .getByRole("link", { name: "Open Executor", exact: true })
+            .waitFor({ state: "visible" }),
+        );
+
+        // Without a listing, the holder keeps its slug and the workspace takes its suffix.
+        const suffixed = yield* operator.waitForReport(run, unlisted);
+        expect(suffixed.status, suffixed.reason ?? "").toBe("imported");
+        expect(suffixed.v2Organization?.slug).toBe(unlistedPlan.slug?.v2);
+        expect(yield* slugOf(holder)).toBe(heldSlug);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportInto.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators,
+          onboarding = yield* Onboarding,
+          fs = yield* FileSystem.FileSystem,
+          target = yield* Target,
+          mcp = yield* McpClient;
+        const operator = yield* v1ImportOperator;
+        // The member already has their own v2 team.
+        const identity = yield* onboarding.socialSignIn("google");
+        const team = yield* onboarding.confirmTeam(yield* onboarding.prepareTeam);
+        const user = (yield* cloudRows(
+          IdRow,
+          `select id from "user" where email = $1`,
+          identity.email,
+        ))[0]?.id;
+        if (user === undefined) return yield* Effect.die("The member has no v2 user");
+        // Their v1 workspace has nothing to copy.
+        const workspace = yield* emulators.v1Workspace([identity.email]);
+        const slug = `v1-${randomUUID().slice(0, 8)}`;
+        yield* writeRows("v1-database.json", [
+          row(
+            "insert into organizations (id, name, slug) values ($1, $2, $3)",
+            workspace.organization,
+            "Synthetic empty workspace",
+            slug,
+          ),
+        ]);
+        yield* allowV1Import(workspace.organization);
+        yield* listV1Into(workspace.organization, team.id);
+
+        const teamRow = cloudRows(
+          Schema.Struct({ name: Schema.String, slug: Schema.String }),
+          "select name, slug from organization where id = $1",
+          team.id,
+        );
+        const teamMembers = cloudRows(
+          Schema.Struct({ userId: Schema.String, role: Schema.String }),
+          `select "userId", role from member where "organizationId" = $1 order by "userId"`,
+          team.id,
+        );
+        const before = { team: yield* teamRow, members: yield* teamMembers };
+        expect(before.team).toEqual([{ name: team.name, slug: team.slug }]);
+        /** Nothing in v2 is created or changed: the team, its members, the member's teams, billing. */
+        const unchanged = Effect.gen(function* () {
+          expect(yield* teamRow).toEqual(before.team);
+          expect(yield* teamMembers).toEqual(before.members);
+          expect(
+            yield* cloudRows(
+              Schema.Struct({ organizationId: Schema.String }),
+              `select "organizationId" from member where "userId" = $1`,
+              user,
+            ),
+          ).toEqual([{ organizationId: team.id }]);
+          expect(
+            yield* cloudRows(IdRow, "select id from organization where slug like $1", `${slug}%`),
+          ).toEqual([]);
+          expect(
+            yield* cloudRows(
+              IdRow,
+              "select organization_id as id from private_v1_import_billing where organization_id = $1",
+              team.id,
+            ),
+          ).toEqual([]);
+          expect(
+            yield* cloudRows(IdRow, `select id from "user" where email = $1`, identity.email),
+          ).toEqual([{ id: user }]);
+        });
+        const MapEntry = Schema.Struct({
+          v1_kind: Schema.String,
+          v2_kind: Schema.NullOr(Schema.String),
+          v2_id: Schema.NullOr(Schema.String),
+        });
+        const mapRows = cloudRows(
+          MapEntry,
+          "select v1_kind, v2_kind, v2_id from private_v1_import_map where v1_org_id = $1 order by v1_kind",
+          workspace.organization,
+        );
+        const plannedInto = (report: V1Report) => {
+          expect(report.status, report.reason ?? "").toBe("planned");
+          expect(report.into).toEqual({ organization: team.id, mode: "nothing_to_copy" });
+          expect(report.slug).toEqual({ v1: slug, v2: team.slug, changed: true });
+          expect(report.emailMatches).toEqual([{ email: identity.email, match: "merge" }]);
+          expect(report.counts.v2).toMatchObject({
+            users: 0,
+            mergedUsers: 1,
+            apps: 0,
+            accounts: 0,
+            mcpConnections: 0,
+            undeployedApps: 0,
+            policies: 0,
+          });
+        };
+
+        // The dry run plans the move and writes nothing.
+        const dry = v1RunId("into-dry");
+        expect(
+          (yield* operator.start({
+            mode: "dry-run",
+            runId: dry,
+            organizations: [workspace.organization],
+          })).status,
+        ).toBe(200);
+        plannedInto(yield* operator.waitForReport(dry, workspace.organization));
+        expect(yield* movedFlag(workspace.organization)).toEqual([]);
+        expect(yield* mapRows).toEqual([]);
+        yield* unchanged;
+
+        const run = v1RunId("into");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [workspace.organization],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, workspace.organization);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        expect(report.into).toEqual({ organization: team.id, mode: "nothing_to_copy" });
+        expect(report.v2Organization).toEqual({ id: team.id, slug: team.slug });
+        expect(report.slug).toEqual({ v1: slug, v2: team.slug, changed: true });
+        expect(report.verification).toEqual({
+          items: { planned: 0, withResult: 0, failed: 0 },
+          members: { planned: 1, inV2: 1 },
+          accounts: { checked: 0, unreadable: 0 },
+          apps: { checked: 0, withoutVersion: 0 },
+          passed: true,
+        });
+        expect(report.cutover).toBe(true);
+        // v1 redirects and forwards the workspace to the team, at the team's own slug.
+        expect(yield* movedFlag(workspace.organization)).toEqual([
+          { state: "moved", v2_org_id: team.id, v2_org_slug: team.slug },
+        ]);
+        expect(yield* importState(workspace.organization)).toEqual([{ state: "cutover" }]);
+        const moved = [
+          { v1_kind: "organization", v2_kind: "existing_organization", v2_id: team.id },
+          { v1_kind: "user", v2_kind: "merged_user", v2_id: user },
+        ];
+        expect(yield* mapRows).toEqual(moved);
+        yield* unchanged;
+
+        // A request v1 forwards for the workspace runs in the team, as its member.
+        const { secret } = yield* fs
+          .readFileString(`${target.directory}/${v1McpForwardFile}`)
+          .pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
+          );
+        let minted = 0;
+        const sign = () =>
+          Redacted.make(
+            v1ForwardBearer(secret, {
+              account: workspace.user,
+              organization: workspace.organization,
+              exp: Math.floor(Date.now() / 1000) + 300 + minted++,
+            }),
+          );
+        const forwarded = yield* mcp.connect(sign, "forwarded-into-team");
+        const listed = yield* forwarded.use(
+          "List the forwarded session's tools",
+          (client, signal) => client.listTools(undefined, { signal }),
+        );
+        expect(listed.tools.map((tool) => tool.name)).toContain("execute");
+        /** The status of one initialize request v1 forwards for the workspace. */
+        const initialize = Effect.scoped(
+          Effect.gen(function* () {
+            const http = yield* HttpClient.HttpClient;
+            const request = HttpClientRequest.post(`${target.metadata.origin}/mcp`).pipe(
+              HttpClientRequest.setHeaders({
+                accept: "application/json, text/event-stream",
+                authorization: `Bearer ${Redacted.value(sign())}`,
+              }),
+            );
+            const response = yield* http.execute(
+              yield* HttpClientRequest.bodyJson(request, {
+                jsonrpc: "2.0",
+                id: 1,
+                method: "initialize",
+                params: {
+                  protocolVersion: "2025-06-18",
+                  capabilities: {},
+                  clientInfo: { name: "forwarded-into", version: "1" },
+                },
+              }),
+            );
+            yield* response.text;
+            return response.status;
+          }),
+        ).pipe(Effect.provide(FetchHttpClient.layer));
+        expect(yield* initialize).toBe(200);
+
+        // Starting it again finds the same instance; a later dry run finds the team through the
+        // workspace's map row. Neither writes anything.
+        expect(
+          (yield* operator.start({
+            mode: "import",
+            runId: run,
+            organizations: [workspace.organization],
+          })).status,
+        ).toBe(200);
+        const later = v1RunId("into-later");
+        expect(
+          (yield* operator.start({
+            mode: "dry-run",
+            runId: later,
+            organizations: [workspace.organization],
+          })).status,
+        ).toBe(200);
+        plannedInto(yield* operator.waitForReport(later, workspace.organization));
+        expect(yield* mapRows).toEqual(moved);
+        yield* unchanged;
+
+        // No billing carried over, so there is none to give back.
+        const billing = yield* operator.returnBilling(workspace.organization);
+        expect(billing.status).toBe(409);
+        expect(billing.body).toEqual({
+          error: "It moved into an existing v2 organization, and no billing carried over.",
+        });
+
+        // The team is the member's own: the workspace goes back to v1 and the team stays.
+        const rolledBack = yield* operator.rollback(workspace.organization);
+        expect(rolledBack.status, JSON.stringify(rolledBack.body)).toBe(200);
+        expect(rolledBack.body).toEqual({
+          organization: workspace.organization,
+          state: "rolled_back",
+          removed: { apps: 0, accounts: 0, toolkitCopies: 0, members: 0 },
+        });
+        expect(yield* movedFlag(workspace.organization)).toEqual([
+          { state: "rolled_back", v2_org_id: null, v2_org_slug: null },
+        ]);
+        expect(yield* importState(workspace.organization)).toEqual([{ state: "rolled_back" }]);
+        expect(yield* mapRows).toEqual([{ v1_kind: "user", v2_kind: "merged_user", v2_id: user }]);
+        yield* unchanged;
+        // v2 no longer maps the workspace, so it refuses what v1 would have forwarded.
+        expect(yield* initialize).toBe(403);
+      }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportIntoLeave.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const operator = yield* v1ImportOperator;
+        // The member works in their own v2 team; their v1 workspace still has an integration and
+        // a rule, which stay in v1.
+        const address = syntheticEmail("leave");
+        const user = yield* v2User(address);
+        const team = yield* v2Team(user);
+        const teamSlug = (yield* cloudRows(
+          Schema.Struct({ slug: Schema.String }),
+          "select slug from organization where id = $1",
+          team,
+        ))[0]?.slug;
+        const workspace = yield* listedV1Workspace("leave", [address], team, "leave_v1_data");
+        const organization = workspace.organization;
+        const tracker = `left_${randomUUID().slice(0, 6)}`;
+        const toolkitRow = (collection: string, data: Record<string, string>) =>
+          row(
+            "insert into plugin_storage (tenant, owner, subject, plugin_id, collection, key, data) values ($1, 'org', '', 'toolkits', $2, $3, $4::json)",
+            organization,
+            collection,
+            data.id ?? "",
+            JSON.stringify(data),
+          );
+        yield* writeRows("v1-database.json", [
+          row(
+            "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Left Tracker', $3::json)",
+            organization,
+            tracker,
+            JSON.stringify({
+              transport: "remote",
+              endpoint: "https://left.example.com/mcp",
+              remoteTransport: "auto",
+            }),
+          ),
+          row(
+            "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, 'block', 'a0')",
+            organization,
+            `${tracker}.*.*.search`,
+          ),
+          goneRule(organization),
+          toolkitRow("toolkits", { id: "tk_left", name: "Left kit", slug: "left" }),
+          toolkitRow("toolkitConnections", {
+            id: "tc_left",
+            toolkitId: "tk_left",
+            pattern: `${tracker}.org.*.*`,
+            position: "a0",
+          }),
+        ]);
+        const v1Data = v1Rows(
+          Schema.Struct({ row_id: Schema.String }),
+          "select row_id::text from integration where tenant = $1 union all select row_id::text from tool_policy where tenant = $1 union all select row_id::text from plugin_storage where tenant = $1 order by 1",
+          organization,
+        );
+        const before = yield* v1Data;
+        expect(before).toHaveLength(5);
+        const teamMembers = cloudRows(
+          Schema.Struct({ userId: Schema.String, role: Schema.String }),
+          `select "userId", role from member where "organizationId" = $1`,
+          team,
+        );
+        const mapRows = cloudRows(
+          Schema.Struct({ v1_kind: Schema.String, v2_kind: Schema.NullOr(Schema.String) }),
+          "select v1_kind, v2_kind from private_v1_import_map where v1_org_id = $1 order by v1_kind",
+          organization,
+        );
+        const into = { organization: team, mode: "leave_v1_data" };
+
+        const dry = v1RunId("leave-dry");
+        expect(
+          (yield* operator.start({ mode: "dry-run", runId: dry, organizations: [organization] }))
+            .status,
+        ).toBe(200);
+        const planned = yield* operator.waitForReport(dry, organization);
+        expect(planned.status, planned.reason ?? "").toBe("planned");
+        expect(planned.into).toEqual(into);
+        expect(planned.slug?.v2).toBe(teamSlug);
+        // v1's items are counted, and none is planned in v2: no app, rule or toolkit copy.
+        expect(planned.counts.v1).toMatchObject({ integrations: 1, policies: 2, toolkits: 1 });
+        expect(planned.counts.v2).toMatchObject({
+          users: 0,
+          mergedUsers: 1,
+          apps: 0,
+          accounts: 0,
+          policies: 0,
+          skippedPolicies: 0,
+          mcpConnections: 0,
+        });
+        expect(planned.integrationFailures).toEqual([]);
+        expect(planned.unmatchedRules).toEqual([]);
+
+        const run = v1RunId("leave");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [organization],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, organization);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        expect(report.into).toEqual(into);
+        expect(report.items).toEqual([]);
+        expect(report.verification).toMatchObject({
+          items: { planned: 0, withResult: 0, failed: 0 },
+          members: { planned: 1, inV2: 1 },
+          passed: true,
+        });
+        expect(report.cutover).toBe(true);
+        expect(yield* movedFlag(organization)).toEqual([
+          { state: "moved", v2_org_id: team, v2_org_slug: teamSlug },
+        ]);
+        expect(yield* mapRows).toEqual([
+          { v1_kind: "organization", v2_kind: "existing_organization" },
+          { v1_kind: "user", v2_kind: "merged_user" },
+        ]);
+        expect(yield* teamMembers).toEqual([{ userId: user, role: "owner" }]);
+        // v1's data stays where it was.
+        expect(yield* v1Data).toEqual(before);
+
+        const rolledBack = yield* operator.rollback(organization);
+        expect(rolledBack.status, JSON.stringify(rolledBack.body)).toBe(200);
+        expect(rolledBack.body).toEqual({
+          organization,
+          state: "rolled_back",
+          removed: { apps: 0, accounts: 0, toolkitCopies: 0, members: 0 },
+        });
+        expect(yield* movedFlag(organization)).toEqual([
+          { state: "rolled_back", v2_org_id: null, v2_org_slug: null },
+        ]);
+        expect(yield* teamMembers).toEqual([{ userId: user, role: "owner" }]);
+        expect(yield* v1Data).toEqual(before);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportIntoCopy.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators,
+          onboarding = yield* Onboarding;
+        const operator = yield* v1ImportOperator;
+        // The owner made a v2 team and set nothing up in it beyond what every team gets.
+        const identity = yield* onboarding.socialSignIn("google");
+        const team = yield* onboarding.confirmTeam(yield* onboarding.prepareTeam);
+        // Their paid v1 workspace has a teammate and the shared seed's integration, connections,
+        // rules and toolkits.
+        const teammate = syntheticEmail("teammate");
+        const workspace = yield* emulators.v1Workspace([identity.email, teammate]);
+        const organization = workspace.organization;
+        const former = yield* emulators.v1Workspace([syntheticEmail("former")]);
+        yield* seedShared(organization, `v1-${randomUUID().slice(0, 8)}`, {
+          first: workspace.user,
+          second: yield* emulators.v1User(teammate),
+          former: former.user,
+        });
+        const subscription = yield* emulators.v1TeamSubscription(organization, {
+          version: 3,
+          seats: 2,
+        });
+        yield* allowV1Import(organization);
+        yield* listV1Into(organization, team.id, "copy_into_empty");
+
+        const Contents = Schema.Struct({
+          name: Schema.String,
+          slug: Schema.String,
+          apps: Schema.Number,
+          accounts: Schema.Number,
+          connections: Schema.Number,
+          members: Schema.Number,
+        });
+        /**
+         * The team's own row and everything in it, its Executor app included; accounts leave out
+         * the Executor keys v2 gives each owner and admin, which a member the import adds also gets.
+         */
+        const contents = cloudRows(
+          Contents,
+          `select o.name, o.slug,
+            (select count(*)::int from executor_apps a where a.owner = 'organization:' || o.id) as apps,
+            (select count(*)::int from executor_accounts a where a.owner = 'organization:' || o.id
+              and not exists (
+                select 1 from jsonb_each_text(coalesce(o.metadata::jsonb -> 'executorKeyAccounts', '{}'::jsonb)) k
+                where k.value = a.id
+              )) as accounts,
+            (select count(*)::int from "mcpConnection" c where c.resource = o.id and not c.revoked) as connections,
+            (select count(*)::int from member m where m."organizationId" = o.id) as members
+          from organization o where o.id = $1`,
+          team.id,
+        ).pipe(Effect.map((rows) => rows[0]));
+        const before = yield* contents;
+        if (before === undefined) return yield* Effect.die("The team has no row");
+        expect(before).toMatchObject({
+          name: team.name,
+          slug: team.slug,
+          accounts: 0,
+          connections: 0,
+          members: 1,
+        });
+        const into = { organization: team.id, mode: "copy_into_empty" };
+
+        const dry = v1RunId("copy-dry");
+        expect(
+          (yield* operator.start({ mode: "dry-run", runId: dry, organizations: [organization] }))
+            .status,
+        ).toBe(200);
+        const planned = yield* operator.waitForReport(dry, organization);
+        expect(planned.status, planned.reason ?? "").toBe("planned");
+        expect(planned.into).toEqual(into);
+        expect(planned.slug?.v2).toBe(team.slug);
+        expect(planned.counts.v2).toMatchObject({ apps: 1, accounts: 3, mcpConnections: 3 });
+        expect(planned.billing).toMatchObject({ subscription: { plan: "team" }, problem: null });
+        expect(yield* contents).toEqual(before);
+
+        const run = v1RunId("copy");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [organization],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, organization);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        expect(report.into).toEqual(into);
+        expect(report.v2Organization).toEqual({ id: team.id, slug: team.slug });
+        expect(report.cutover).toBe(true);
+        expect(report.verification).toMatchObject({ members: { planned: 2, inV2: 2 } });
+        expect(report.billing).toMatchObject({ carried: true });
+        expect(yield* movedFlag(organization)).toEqual([
+          { state: "moved", v2_org_id: team.id, v2_org_slug: team.slug },
+        ]);
+        // The team keeps its name and slug, gains the workspace's app, accounts and toolkit
+        // copies, and the teammate joins it.
+        expect(yield* contents).toEqual({
+          ...before,
+          apps: before.apps + 1,
+          accounts: before.accounts + 3,
+          connections: 3,
+          members: 2,
+        });
+        // The subscription now bills the team, on v1's Stripe subscription.
+        const customerId = yield* emulators.v2BillingCustomer(team.id);
+        expect(yield* emulators.autumnStripeSubscriptions(customerId)).toEqual([
+          subscription.stripeSubscription,
+        ]);
+        expect(yield* emulators.autumnCustomer(organization)).toBeNull();
+
+        // Another workspace of the owner cannot copy into the team now: it is no longer empty.
+        const second = yield* emulators.v1Workspace([identity.email]);
+        yield* writeRows("v1-database.json", [
+          row(
+            "insert into organizations (id, name, slug) values ($1, $2, $3)",
+            second.organization,
+            "Synthetic second workspace",
+            `v1-${randomUUID().slice(0, 8)}`,
+          ),
+          goneRule(second.organization),
+        ]);
+        yield* allowV1Import(second.organization);
+        yield* listV1Into(second.organization, team.id, "copy_into_empty");
+        const secondDry = v1RunId("copy-second");
+        expect(
+          (yield* operator.start({
+            mode: "dry-run",
+            runId: secondDry,
+            organizations: [second.organization],
+          })).status,
+        ).toBe(200);
+        const refused = yield* operator.waitForReport(secondDry, second.organization);
+        expect(refused.status, refused.reason ?? "").toBe("held_back");
+        expect(refused.into?.refused).toMatch(
+          /^The listed v2 organization is not empty \(apps: 1, accounts: 3, connections: 3\)\.$/u,
+        );
+
+        // A rollback keeps the team and removes what the import added, once billing went back.
+        const early = yield* operator.rollback(organization);
+        expect(early.status).toBe(409);
+        expect(JSON.stringify(early.body)).toContain("return-billing");
+        const returned = yield* operator.returnBilling(organization);
+        expect(returned.status, JSON.stringify(returned.body)).toBe(200);
+        const rolledBack = yield* operator.rollback(organization);
+        expect(rolledBack.status, JSON.stringify(rolledBack.body)).toBe(200);
+        expect(rolledBack.body).toEqual({
+          organization,
+          state: "rolled_back",
+          removed: { apps: 1, accounts: 3, toolkitCopies: 3, members: 1 },
+        });
+        expect(yield* contents).toEqual(before);
+        expect(yield* movedFlag(organization)).toEqual([
+          { state: "rolled_back", v2_org_id: null, v2_org_slug: null },
+        ]);
+        // v1 bills the workspace again, and the team's billing is its own once more.
+        expect(yield* emulators.autumnCustomer(organization)).not.toBeNull();
+        expect(
+          yield* cloudRows(
+            IdRow,
+            "select organization_id as id from private_v1_import_billing where organization_id = $1",
+            team.id,
+          ),
+        ).toEqual([]);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportIntoRefused.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        /** A v1 workspace of these members, with no rows of its own, listed to move into `into`. */
+        const listed = (
+          label: string,
+          members: readonly [string, ...string[]],
+          into: string,
+          mode?: string,
+        ) =>
+          Effect.gen(function* () {
+            const created = yield* listedV1Workspace(label, members, into, mode);
+            return { organization: created.organization, into };
+          });
+        /** A one-member workspace listed to move into the team its member owns in v2. */
+        const ownWorkspace = (label: string, mode?: string) =>
+          Effect.gen(function* () {
+            const address = syntheticEmail(label);
+            return yield* listed(label, [address], yield* ownV2Team(address), mode);
+          });
+        const email = syntheticEmail;
+        const ownTeam = ownV2Team;
+
+        const items = yield* ownWorkspace("items");
+        yield* writeRows("v1-database.json", [goneRule(items.organization)]);
+        const sharedOwner = email("shared");
+        const shared = yield* listed(
+          "shared",
+          [sharedOwner, email("teammate")],
+          yield* ownTeam(sharedOwner),
+        );
+        const invited = yield* ownWorkspace("invited");
+        yield* emulators.inviteV1Member(invited.organization, email("invitee"));
+        const paid = yield* ownWorkspace("paid");
+        yield* emulators.v1Plan(paid.organization, "team");
+        // No v2 user has the member's email.
+        const unknown = yield* listed(
+          "unknown",
+          [email("unknown")],
+          yield* ownTeam(email("other")),
+        );
+        // The member is an admin of someone else's team.
+        const adminAddress = email("admin");
+        const adminUser = yield* v2User(adminAddress);
+        const othersTeam = yield* ownTeam(email("teamowner"));
+        yield* writeRows("sso-database.json", [
+          row(
+            `insert into member (id, "organizationId", "userId", role, "createdAt") values ($1, $2, $3, 'admin', now())`,
+            randomUUID(),
+            othersTeam,
+            adminUser,
+          ),
+        ]);
+        // Even a copy needs its owner to own the organization it goes into.
+        const admin = yield* listed("admin", [adminAddress], othersTeam, "copy_into_empty");
+        const missingAddress = email("missing");
+        yield* v2User(missingAddress);
+        const missing = yield* listed("missing", [missingAddress], randomUUID());
+        // Leaving v1's data behind takes only a free workspace of one member too.
+        const leavePaid = yield* ownWorkspace("leave-paid", "leave_v1_data");
+        yield* writeRows("v1-database.json", [goneRule(leavePaid.organization)]);
+        yield* emulators.v1Plan(leavePaid.organization, "team");
+        const leaveOwner = email("leave-shared");
+        const leaveShared = yield* listed(
+          "leave-shared",
+          [leaveOwner, email("teammate")],
+          yield* ownTeam(leaveOwner),
+          "leave_v1_data",
+        );
+        const unlisted = yield* ownWorkspace("mode", "everything");
+        const onlyOne =
+          "only a workspace of one moves into an existing v2 organization without its data.";
+        const refusals = [
+          [items, "nothing_to_copy", "It has items to copy (policies: 1)."],
+          [shared, "nothing_to_copy", `It has 2 active members; ${onlyOne}`],
+          [invited, "nothing_to_copy", "It has 1 pending invitations."],
+          [paid, "nothing_to_copy", "It has a paid v1 plan (team)."],
+          [unknown, "nothing_to_copy", "Its owner has no v2 account."],
+          [admin, "copy_into_empty", "Its owner is not an owner of the listed v2 organization."],
+          [missing, "nothing_to_copy", "The listed v2 organization does not exist."],
+          [leavePaid, "leave_v1_data", "It has a paid v1 plan (team)."],
+          [leaveShared, "leave_v1_data", `It has 2 active members; ${onlyOne}`],
+          [unlisted, null, "The allow table lists a mode the import does not know."],
+        ] as const;
+        const organizations = refusals.map(([workspace]) => workspace.organization);
+        const TeamMember = Schema.Struct({ userId: Schema.String, role: Schema.String });
+        const membersOf = (organization: string) =>
+          cloudRows(
+            TeamMember,
+            `select "userId", role from member where "organizationId" = $1 order by "userId"`,
+            organization,
+          );
+        const before = yield* Effect.forEach(refusals, ([workspace]) => membersOf(workspace.into));
+
+        const dry = v1RunId("refused-dry");
+        expect((yield* operator.start({ mode: "dry-run", runId: dry, organizations })).status).toBe(
+          200,
+        );
+        for (const [workspace, mode, refused] of refusals) {
+          const report = yield* operator.waitForReport(dry, workspace.organization);
+          expect(report.status, report.reason ?? "").toBe("held_back");
+          expect(report.reason).toBe(
+            `It does not move into the listed v2 organization: ${refused}`,
+          );
+          expect(report.into).toEqual({ organization: workspace.into, mode, refused });
+        }
+
+        const run = v1RunId("refused");
+        const started = yield* operator.start({ mode: "import", runId: run, organizations });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        for (const [index, [workspace, mode, refused]] of refusals.entries()) {
+          const report = yield* operator.waitForReport(run, workspace.organization);
+          expect(report.status, report.reason ?? "").toBe("held_back");
+          expect(report.into).toEqual({ organization: workspace.into, mode, refused });
+          expect(report.v2Organization).toBeUndefined();
+          // Nothing was copied, so v1 has it back at once; v2 recorded nothing for it.
+          expect(yield* movedFlag(workspace.organization)).toEqual([
+            { state: "rolled_back", v2_org_id: null, v2_org_slug: null },
+          ]);
+          expect(yield* importState(workspace.organization)).toEqual([{ state: "rolled_back" }]);
+          expect(
+            yield* cloudRows(
+              Schema.Struct({ v1_kind: Schema.String }),
+              "select v1_kind from private_v1_import_map where v1_org_id = $1",
+              workspace.organization,
+            ),
+          ).toEqual([]);
+          expect(yield* membersOf(workspace.into)).toEqual(before[index]);
+        }
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportAllowed.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        const workspace = (label: string) =>
+          Effect.gen(function* () {
+            const created = yield* emulators.v1Workspace([
+              `${label}-${randomUUID().slice(0, 8)}@example.test`,
+            ]);
+            yield* writeRows("v1-database.json", [
+              row(
+                "insert into organizations (id, name, slug) values ($1, $2, $3)",
+                created.organization,
+                `Synthetic ${label} workspace`,
+                `v1-${randomUUID().slice(0, 8)}`,
+              ),
+            ]);
+            return created.organization;
+          });
+        const unlisted = yield* workspace("unlisted");
+        const listed = yield* workspace("listed");
+        yield* allowV1Import(listed);
+        const notAllowed = (organization: string) => ({
+          error: `private_v1_import_allowed has no row for ${organization}, so it is not imported.`,
+        });
+        const nothingWritten = (organization: string) =>
+          Effect.gen(function* () {
+            expect(yield* movedFlag(organization)).toEqual([]);
+            expect(yield* importState(organization)).toEqual([]);
+          });
+
+        // The operator token alone allows nothing: without a row, the import is refused.
+        const refused = yield* operator.start({
+          mode: "import",
+          runId: v1RunId("unlisted"),
+          organizations: [unlisted],
+        });
+        expect(refused.status).toBe(409);
+        expect(refused.body).toEqual(notAllowed(unlisted));
+        yield* nothingWritten(unlisted);
+
+        // One organization without a row refuses the whole start, naming only that one.
+        const mixed = yield* operator.start({
+          mode: "import",
+          runId: v1RunId("mixed"),
+          organizations: [listed, unlisted],
+        });
+        expect(mixed.status).toBe(409);
+        expect(mixed.body).toEqual(notAllowed(unlisted));
+        yield* nothingWritten(listed);
+        yield* nothingWritten(unlisted);
+
+        // An import never pages through v1, whatever the table holds.
+        const paged = yield* operator.start({
+          mode: "import",
+          runId: v1RunId("paged"),
+          after: listed,
+          limit: 1,
+        });
+        expect(paged.status).toBe(409);
+        expect(paged.body).toEqual({
+          error:
+            "An import names its organizations with `organizations`; it never pages through v1 with `after` or `limit`.",
+        });
+
+        // A dry run ignores the table: it runs for the organization without a row.
+        const dry = v1RunId("unlisted-dry");
+        const dryStarted = yield* operator.start({
+          mode: "dry-run",
+          runId: dry,
+          organizations: [unlisted],
+        });
+        expect(dryStarted.status, JSON.stringify(dryStarted.body)).toBe(200);
+        const dryReport = yield* operator.waitForReport(dry, unlisted);
+        expect(dryReport.status, dryReport.reason ?? "").toBe("planned");
+        yield* nothingWritten(unlisted);
+
+        // With its row, the organization imports and is cut over.
+        const run = v1RunId("listed");
+        const started = yield* operator.start({
+          mode: "import",
+          runId: run,
+          organizations: [listed],
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const report = yield* operator.waitForReport(run, listed);
+        expect(report.status, report.reason ?? "").toBe("imported");
+        expect(report.cutover).toBe(true);
+        expect((yield* movedFlag(listed))[0]?.state).toBe("moved");
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
   it.effect(scenarios.v1ImportDryRun.title, (context) =>
     withCase(
       context,
@@ -1103,9 +2585,11 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
             clientId,
             secretItem ?? "",
           );
-        const oauthMcp = (headers: Record<string, string>, host: string) => ({
+        // Reachable, so their sign-ins can be discovered as the import discovers them.
+        const signIn = yield* mcpSignInServers(["pasted", "gated"]);
+        const oauthMcp = (headers: Record<string, string>, name: string) => ({
           transport: "remote",
-          endpoint: `https://${host}/mcp`,
+          endpoint: `http://${signIn}/${name}/mcp`,
           remoteTransport: "auto",
           headers,
           authenticationTemplate: [{ slug: "oauth", kind: "oauth2" }],
@@ -1196,7 +2680,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
                 CLIENT_ID: "synthetic-stale-client-0123456789",
                 CLIENT_SECRET: "synthetic-stale-secret-0123456789",
               },
-              "pasted.example.com",
+              "pasted",
             ),
           ),
           // A self-hosted MCP server behind a gateway that takes its own client ID and secret.
@@ -1209,7 +2693,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import runs", (it) => {
                 "CF-Access-Client-Id": "synthetic0gateway1client2id.access",
                 "CF-Access-Client-Secret": "synthetic-gateway-secret-0123456789",
               },
-              "gated.example.com",
+              "gated",
             ),
           ),
           row(
diff --git a/e2e/tests/cloud-v1-import.spec.ts b/e2e/tests/cloud-v1-import.spec.ts
index 42452f896f..1295dbdcd0 100644
--- a/e2e/tests/cloud-v1-import.spec.ts
+++ b/e2e/tests/cloud-v1-import.spec.ts
@@ -23,8 +23,10 @@ import { TestLive, withCase } from "../support/case.ts";
 import { Browser } from "../support/browser.ts";
 import { AccountLink, connectionsPath } from "../support/app-accounts.ts";
 import { writeRows, type RowStatement } from "../support/cloud-rows.ts";
+import { approvalMcpUpstream } from "../support/approval-mcp-upstream.ts";
 import { credentialUpstream } from "../support/credential-upstream.ts";
 import { largeOpenapiDocument } from "../support/large-openapi.ts";
+import { graphComponents, graphDocument } from "../support/graph-openapi.ts";
 import { Emulators } from "../support/emulators.ts";
 import { McpClient } from "../support/mcp-client.ts";
 import { Execution } from "../support/mcp-connections.ts";
@@ -44,7 +46,7 @@ import {
   v1SlackScopes,
 } from "../support/operator-oauth.ts";
 import { Target } from "../support/platform.ts";
-import { v1ImportOperator, v1RunId, type V1Report } from "../support/v1-import.ts";
+import { allowV1Import, v1ImportOperator, v1RunId, type V1Report } from "../support/v1-import.ts";
 import { scenarios } from "../test-plan.ts";
 
 const services = Layer.mergeAll(Onboarding.layer, Emulators.layer);
@@ -97,9 +99,9 @@ const Health = Schema.Struct({
     }),
   ),
 });
-const Source = Schema.Struct({
-  files: Schema.Array(Schema.Struct({ path: Schema.String, content: Schema.String })),
-});
+const SourceFile = Schema.Struct({ path: Schema.String, content: Schema.String });
+type SourceFile = typeof SourceFile.Type;
+const Source = Schema.Struct({ files: Schema.Array(SourceFile) });
 const Connections = Schema.Array(
   Schema.Struct({
     id: Schema.String,
@@ -152,11 +154,22 @@ const compiledV1Names = [
  * A synthetic API with one safe read, \`GET /v1/me\`, recording each request's path, query and key.
  * The disabled key gets Google's answer for an API that is not enabled in the client's project.
  * The redirected key is sent on to \`/landing\` over plain HTTP, which answers every request as the
- * user and records what reached it.
+ * user and records what reached it. It also serves the specification v1 stored only as its URL,
+ * counting each time it is fetched.
  */
 const checkedApi = Effect.gen(function* () {
   const received = yield* Ref.make<ReadonlyArray<{ path: string; key: string | undefined }>>([]);
   const landed = yield* Ref.make<ReadonlyArray<{ path: string; key: string | undefined }>>([]);
+  const specFetches = yield* Ref.make(0);
+  let origin = "";
+  const linked = HttpRouter.add(
+    "GET",
+    "/openapi.json",
+    Effect.gen(function* () {
+      yield* Ref.update(specFetches, (count) => count + 1);
+      return yield* HttpServerResponse.json(linkedDocument(origin));
+    }),
+  );
   const me = HttpRouter.add(
     "GET",
     "/v1/me",
@@ -199,20 +212,83 @@ const checkedApi = Effect.gen(function* () {
     }),
   );
   const services = yield* Layer.build(
-    HttpRouter.serve(Layer.mergeAll(me, landing), {
+    HttpRouter.serve(Layer.mergeAll(me, landing, linked), {
       disableLogger: true,
       disableListenLog: true,
     }).pipe(Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }))),
   );
   const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
   if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  origin = `http://127.0.0.1:${server.address.port}`;
   return {
-    origin: `http://127.0.0.1:${server.address.port}`,
+    origin,
     received: Ref.get(received),
     landed: Ref.get(landed),
+    specFetches: Ref.get(specFetches),
   };
 });
 
+/** The document behind the specification v1 stored only as its URL. */
+const linkedDocument = (origin: string) => ({
+  openapi: "3.0.3",
+  info: { title: "Linked API", version: "1" },
+  servers: [{ url: `${origin}/v1` }],
+  paths: {
+    "/me": {
+      get: {
+        operationId: "readMe",
+        tags: ["profile"],
+        responses: { "200": { description: "ok" } },
+      },
+    },
+  },
+});
+
+/**
+ * A document whose operations are references, as some generators write them: each names an
+ * Operation Object under `components`, with its own operationId, tags and a security requirement
+ * whose scheme the document declares. v1 named such an operation from its method and path.
+ * One answers with a component whose name holds a space.
+ */
+const referencedText = JSON.stringify({
+  openapi: "3.0.3",
+  info: { title: "Referenced API", version: "1" },
+  servers: [{ url: "https://api.example.com" }],
+  security: [],
+  components: {
+    securitySchemes: { key: { type: "apiKey", in: "header", name: "X-Key" } },
+    pathItems: {
+      listWidgets: {
+        operationId: "listWidgets",
+        tags: ["widgets"],
+        security: [{ key: [] }],
+        responses: { "200": { description: "ok" } },
+      },
+      getWidget: {
+        operationId: "getWidget",
+        tags: ["widgets"],
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          "200": {
+            description: "ok",
+            // A component whose name has a space, referenced with it percent-encoded.
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/Widget%20Page" } },
+            },
+          },
+        },
+      },
+    },
+    schemas: { "Widget Page": { type: "object", properties: { id: { type: "string" } } } },
+  },
+  paths: {
+    "/v1/widgets": { get: { $ref: "#/components/pathItems/listWidgets" } },
+    "/v1/widgets/{id}": { get: { $ref: "#/components/pathItems/getWidget" } },
+  },
+});
+/** v1's names for the Referenced API's operations, by method and path. */
+const referencedV1Names = { "widgets.list": "/v1/widgets", "widgets.read": "/v1/widgets/{id}" };
+
 /**
  * A workspace whose OpenAPI integration declares v1's account check (an identity read with a pinned
  * argument) and an empty base URL, a public MCP server that sends a credential in a fixed header,
@@ -278,6 +354,12 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
     });
     const mergedHash = createHash("sha256").update(mergedText).digest("hex");
     const merged = `merged_${randomUUID().slice(0, 6)}`;
+    const referencedHash = createHash("sha256").update(referencedText).digest("hex");
+    const referenced = `referenced_${randomUUID().slice(0, 6)}`;
+    // v1 kept a specification given as a URL as that text, and fetched the document from it.
+    const linkedText = `${origin}/openapi.json`;
+    const linkedHash = createHash("sha256").update(linkedText).digest("hex");
+    const linked = `linked_${randomUUID().slice(0, 6)}`;
     const document = {
       openapi: "3.0.3",
       info: { title: "Checked API", version: "1" },
@@ -309,6 +391,8 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
       [compiled, "compiled"],
       [unmatched, "unmatched"],
       [merged, "merged"],
+      [referenced, "referenced"],
+      [linked, "linked"],
     ] as const)
       yield* emulators.v1VaultObject(
         vaultName(userScope, tokenItem(integration, connection)),
@@ -433,11 +517,17 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
         organization,
         `${api}.*.*.me.unlisted`,
       ),
-      row(
-        "insert into blob (namespace, key, value) values ($1, $2, $3)",
-        `o:${organization}/openapi`,
-        `spec/${compiledHash}`,
-        compiledText,
+      ...[
+        [compiledHash, compiledText],
+        [referencedHash, referencedText],
+        [linkedHash, linkedText],
+      ].map(([key, text]) =>
+        row(
+          "insert into blob (namespace, key, value) values ($1, $2, $3)",
+          `o:${organization}/openapi`,
+          `spec/${key}`,
+          text ?? "",
+        ),
       ),
       row(
         "insert into blob (namespace, key, value) values ($1, $2, $3)",
@@ -460,13 +550,17 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
           },
         }),
       ),
-      // No operation rows: v1 compiled the document and found each listed tool by its name.
+      // No operation rows for the first two: v1 compiled the document and found each listed tool
+      // by its name. The Merged API's row is above; the others bind each tool to its operation by
+      // method and path.
       ...[
         {
           integration: compiled,
           name: "Compiled API",
           connection: "compiled",
+          specHash: compiledHash,
           tools: compiledV1Names,
+          operations: {},
         },
         // The organization revised it before v1 last listed its tools, so the tool v2 would not
         // provide is one v1 still lists, which blocks.
@@ -474,24 +568,55 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
           integration: unmatched,
           name: "Unmatched API",
           connection: "unmatched",
+          specHash: compiledHash,
           tools: ["items.itemsList", "items.archive"],
           revised: { at: 1_000, listed: 2_000 },
+          operations: {},
         },
         {
           integration: merged,
           name: "Merged API",
           connection: "merged",
-          tools: ["calendar.channels.stop", "drive.channels.stop"],
           specHash: mergedHash,
+          tools: ["calendar.channels.stop", "drive.channels.stop"],
+          operations: {},
+        },
+        {
+          integration: referenced,
+          name: "Referenced API",
+          connection: "referenced",
+          specHash: referencedHash,
+          tools: Object.keys(referencedV1Names),
+          operations: referencedV1Names,
+        },
+        {
+          integration: linked,
+          name: "Linked API",
+          connection: "linked",
+          specHash: linkedHash,
+          tools: ["profile.read"],
+          operations: { "profile.read": "/me" },
         },
-      ].flatMap(({ integration, name, connection, tools, specHash, revised }) => [
+      ].flatMap(({ integration, name, connection, specHash, tools, operations, revised }) => [
+        ...Object.entries(operations).map(([tool, path]) =>
+          row(
+            "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+            organization,
+            `op.${integration}.${tool}`,
+            JSON.stringify({
+              integration,
+              toolName: tool,
+              binding: { method: "get", pathTemplate: path, parameters: [] },
+            }),
+          ),
+        ),
         row(
           "insert into integration (tenant, slug, plugin_id, name, config, config_revised_at) values ($1, $2, 'openapi', $3, $4::json, nullif($5, '')::bigint)",
           organization,
           integration,
           name,
           JSON.stringify({
-            specHash: specHash ?? compiledHash,
+            specHash,
             authenticationTemplate: [
               {
                 slug: "apikey-0",
@@ -527,7 +652,12 @@ const seedChecks = (organization: string, user: string, slug: string, origin: st
   });
 
 /** Call Cloud's API from the signed-in page, as the dashboard does. */
-const call = (step: string, method: "GET" | "POST", path: string, payload?: unknown) =>
+const call = (
+  step: string,
+  method: "GET" | "POST" | "PUT" | "DELETE",
+  path: string,
+  payload?: unknown,
+) =>
   Effect.gen(function* () {
     const browser = yield* Browser;
     return yield* browser
@@ -543,7 +673,14 @@ const call = (step: string, method: "GET" | "POST", path: string, payload?: unkn
                     body: JSON.stringify(payload),
                   }),
             }).then((response) =>
-              response.json().then((body: unknown) => ({ status: response.status, body })),
+              // A body that is not JSON is kept as text, so a failed assertion shows it.
+              response.text().then((text) => {
+                let body: unknown = text;
+                try {
+                  body = JSON.parse(text);
+                } catch {}
+                return { status: response.status, body };
+              }),
             ),
           { method, path, payload },
         ),
@@ -589,6 +726,7 @@ const importOnServer = (
 ) =>
   Effect.gen(function* () {
     const operator = yield* v1ImportOperator;
+    yield* allowV1Import(organization);
     const run = v1RunId("import");
     const started = yield* operator.start({
       mode: "import",
@@ -1069,6 +1207,12 @@ const seedToolkits = (organization: string, user: string, slug: string) =>
         organization,
         `${hosted}.*.*.purge_items`,
       ),
+      // The workspace never asks before listing, but v1 ignored that inside the toolkit.
+      row(
+        "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, 'approve', 'a1')",
+        organization,
+        `${hosted}.*.*.list_items`,
+      ),
       toolkitRow("user", "toolkits", { id: "tk_support", name: "Support", slug: "support" }),
       toolkitRow("user", "toolkitConnections", {
         id: "tkconn_1",
@@ -1249,458 +1393,334 @@ const seedToolkitCalls = (organization: string, user: string, slug: string, orig
   });
 
 /**
- * Two host names of one synthetic service, under one registrable domain, for the loopback
- * service's port. `*.localhost` resolves to loopback.
- */
-const serviceHosts = (port: number) => ({
-  api: `api.synthetic-service.localhost:${port}`,
-  uploads: `uploads.synthetic-service.localhost:${port}`,
-});
-
-/**
- * OpenAPI integrations whose requests depend on how v1 read them, against a loopback service
- * that records what it receives: a YAML specification with a repeated key, operations that name
- * their own server, a webhook, a method without a name, a public API, one whose operations call
- * two hosts of one service, one whose operations call two services with an account, one on two
- * HTTPS hosts of one service whose account check picks a server variable that turns it to plain
- * HTTP, one whose operation names a server that uses the document server's variable without
- * declaring it, one whose two document servers declare that variable differently, and one whose
- * server uses a variable no server declares.
+ * A workspace whose connections of one integration have different rules (decision 32). Ledger, an
+ * API that lists, searches and creates entries on the loopback service, has two workspace
+ * connections and the member's own, each with a key only it holds: its rules block searching
+ * through `bot`, allow only listing and searching through `reader`, and leave `mine` to each
+ * tool's default, and an org toolkit reaches both workspace connections. Notes blocks deleting
+ * through both its workspace connections; its third connection, which blocks everything, signs in
+ * with a method Notes does not declare, so it cannot move. Signals, a public MCP server, stamped
+ * `erase` as destructive only when one of its two connections listed it. Integrations are named
+ * after `names`, so two workspaces seeded with it have the same rules.
  */
-const seedRequests = (organization: string, user: string, slug: string, origin: string) =>
+const splitKeys = {
+  bot: "synthetic-split-bot-key",
+  reader: "synthetic-split-reader-key",
+  mine: "synthetic-split-member-key",
+  alpha: "synthetic-split-alpha-key",
+  beta: "synthetic-split-beta-key",
+};
+const seedSplitConnections = (
+  organization: string,
+  user: string,
+  slug: string,
+  origin: string,
+  names: string,
+) =>
   Effect.gen(function* () {
     const emulators = yield* Emulators;
-    const suffix = randomUUID().slice(0, 6);
-    const keyItem = `connection:user:requests_${suffix}:main:token`;
-    const uploadsKeyItem = `connection:user:uploads_${suffix}:main:token`;
-    const mixedKeyItem = `connection:user:mixed_${suffix}:main:token`;
-    const splitKeyItem = `connection:user:split_${suffix}:main:token`;
-    const downgradedKeyItem = `connection:user:downgraded_${suffix}:main:token`;
-    const regionalKeyItem = `connection:user:regional_${suffix}:main:token`;
-    const layeredKeyItem = `connection:user:layered_${suffix}:main:token`;
+    const ledger = `ledger_${names}`;
+    const notes = `notes_${names}`;
+    const signals = `signals_${names}`;
+    const orgScope = `executor/org/${encodeURIComponent(organization)}`;
     const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
-    yield* emulators.v1VaultObject(vaultName(userScope, keyItem), "synthetic-requests-key");
-    yield* emulators.v1VaultObject(vaultName(userScope, uploadsKeyItem), "synthetic-uploads-key");
-    yield* emulators.v1VaultObject(vaultName(userScope, mixedKeyItem), "synthetic-mixed-key");
-    yield* emulators.v1VaultObject(vaultName(userScope, splitKeyItem), "synthetic-split-key");
-    yield* emulators.v1VaultObject(
-      vaultName(userScope, downgradedKeyItem),
-      "synthetic-downgraded-key",
-    );
-    yield* emulators.v1VaultObject(vaultName(userScope, regionalKeyItem), "synthetic-regional-key");
-    yield* emulators.v1VaultObject(vaultName(userScope, layeredKeyItem), "synthetic-layered-key");
-    const hosts = serviceHosts(Number(new URL(origin).port));
-    // js-yaml, which v1 parsed with, keeps the last of a repeated key.
-    const requests = [
-      "openapi: 3.1.0",
-      "info:",
-      "  title: Synthetic requests",
-      "  version: '1'",
-      "  description: first",
-      "  description: second",
-      "servers:",
-      `  - url: ${origin}/root`,
-      "paths:",
-      "  /items:",
-      "    get:",
-      "      operationId: listItems",
-      "      tags: [items]",
-      "      servers:",
-      `        - url: ${origin}/v2`,
-      "      responses:",
-      "        '200':",
-      "          description: ok",
-      "  /ping:",
-      "    get:",
-      "      operationId: ping",
-      "      tags: [items]",
-      "      responses:",
-      "        '200':",
-      "          description: ok",
-      "webhooks:",
-      "  itemCreated:",
-      "    post:",
-      "      requestBody:",
-      "        content:",
-      "          application/json:",
-      "            schema:",
-      "              $ref: '#/components/schemas/Event'",
-      "      responses:",
-      "        '200':",
-      "          description: ok",
-      "components:",
-      "  schemas:",
-      "    Event:",
-      "      type: object",
-      "",
-    ].join("\n");
-    const document = (title: string, paths: Record<string, unknown>) =>
-      JSON.stringify({
+    const ok = { "200": { description: "ok" } };
+    const document = (title: string, base: string, paths: Record<string, unknown>) => {
+      const text = JSON.stringify({
         openapi: "3.0.3",
         info: { title, version: "1" },
-        servers: [{ url: `${origin}/public` }],
+        servers: [{ url: `${origin}/${base}` }],
         paths,
       });
-    const ok = { "200": { description: "ok" } };
-    const status = document("Synthetic status", {
-      "/health": { get: { operationId: "health", tags: ["status"], responses: ok } },
-    });
-    const split = document("Synthetic split", {
-      "/a": { get: { operationId: "a", tags: ["split"], responses: ok } },
-      "/b": {
-        get: {
-          operationId: "b",
-          tags: ["split"],
-          servers: [{ url: "https://other.example.com" }],
-          responses: ok,
-        },
-      },
-    });
-    // Google's APIs, each on its own host under `googleapis.com`, which the public suffix list
-    // keeps apart.
-    const google = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic Google", version: "1" },
-      servers: [{ url: "https://gmail.googleapis.com" }],
-      paths: {
-        "/gmail/v1/users/me/messages": {
-          get: { operationId: "list", tags: ["messages"], responses: ok },
-        },
-        "/v4/spreadsheets": {
-          get: {
-            operationId: "get",
-            tags: ["sheets"],
-            servers: [{ url: "https://sheets.googleapis.com" }],
-            responses: ok,
-          },
-        },
+      return { text, hash: createHash("sha256").update(text).digest("hex") };
+    };
+    const ledgerSpec = document("Synthetic split ledger", "ledger", {
+      "/entries": {
+        get: { operationId: "listEntries", tags: ["entries"], responses: ok },
+        post: { operationId: "createEntry", tags: ["entries"], responses: ok },
       },
-    });
-    // Like GitHub's API and upload hosts: v1 sent the account's key to both.
-    const uploads = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic uploads", version: "1" },
-      servers: [{ url: `http://${hosts.api}/api` }],
-      paths: {
-        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
-        "/assets": {
-          get: {
-            operationId: "upload",
-            tags: ["assets"],
-            servers: [{ url: `http://${hosts.uploads}/uploads` }],
-            responses: ok,
-          },
-        },
+      "/entries/search": {
+        get: { operationId: "searchEntries", tags: ["entries"], responses: ok },
       },
     });
-    // One service's hosts, one of them on plain HTTP: v1 sent the key to both, but the account's
-    // credentials would cross the network unencrypted.
-    const mixed = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic mixed", version: "1" },
-      servers: [{ url: "https://api.mixed.example.com/api" }],
-      paths: {
-        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
-        "/assets": {
-          get: {
-            operationId: "upload",
-            tags: ["assets"],
-            servers: [{ url: "http://uploads.mixed.example.com/uploads" }],
-            responses: ok,
-          },
-        },
+    const notesSpec = document("Synthetic notes", "notes", {
+      "/notes": {
+        get: { operationId: "listNotes", tags: ["notes"], responses: ok },
+        delete: { operationId: "deleteNotes", tags: ["notes"], responses: ok },
       },
     });
-    // One service's two HTTPS hosts, whose account check picks the upload server with its scheme
-    // variable set to plain HTTP.
-    const downgraded = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic downgraded", version: "1" },
-      servers: [{ url: "https://api.downgraded.example.com/api" }],
-      paths: {
-        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
-        "/assets": {
-          get: {
-            operationId: "upload",
-            tags: ["assets"],
-            servers: [
-              {
-                url: "{scheme}://uploads.downgraded.example.com/uploads",
-                variables: { scheme: { default: "https", enum: ["https", "http"] } },
-              },
-            ],
-            responses: ok,
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    const apiKeyConfig = (hash: string) =>
+      JSON.stringify({
+        specHash: hash,
+        authenticationTemplate: [
+          {
+            slug: "apikey-0",
+            kind: "apikey",
+            placements: [{ carrier: "header", name: "X-Api-Key" }],
           },
-        },
-      },
-    });
-    // Like Sentry's API: the document's server declares a region variable, and one operation names
-    // the same server URL without declaring it, so the operation uses the document's default.
-    const regionalServer = `http://{region}.synthetic-service.localhost:${new URL(origin).port}/regional`;
-    const regional = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic regional", version: "1" },
-      servers: [
-        {
-          url: regionalServer,
-          variables: { region: { default: "api", enum: ["api", "uploads"] } },
-        },
-      ],
-      paths: {
-        "/items": { get: { operationId: "list", tags: ["items"], responses: ok } },
-        "/models": {
-          get: {
-            operationId: "models",
-            tags: ["items"],
-            servers: [{ url: regionalServer }],
-            responses: ok,
-          },
-        },
-      },
-    });
-    // Two document servers declare the region with different defaults, and the first has no URL.
-    // An operation's server that omits the declaration takes the first document server's, as the
-    // app's router does, even though that server's empty URL is never called.
-    const layeredServer = `http://{region}.synthetic-service.localhost:${new URL(origin).port}/layered`;
-    const layered = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic layered", version: "1" },
-      servers: [
-        { url: "", variables: { region: { default: "api" } } },
-        { url: layeredServer, variables: { region: { default: "uploads" } } },
-      ],
-      paths: {
-        "/items": {
-          get: {
-            operationId: "list",
-            tags: ["items"],
-            servers: [{ url: layeredServer }],
-            responses: ok,
-          },
-        },
-      },
-    });
-    // No server declares the variable, so no host can be named.
-    const unresolved = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic unresolved", version: "1" },
-      servers: [{ url: "https://{tenant}.unresolved.example.com/api" }],
-      paths: { "/items": { get: { operationId: "list", tags: ["items"], responses: ok } } },
-    });
-    // Like a vendor specification fetched from its schema URL: no server at any level, and the
-    // integration names no base URL, so v1 sent the bare path and reached no API.
-    const serverless = JSON.stringify({
-      openapi: "3.1.0",
-      info: { title: "Synthetic serverless", version: "1" },
-      paths: { "/api/items/": { get: { operationId: "list", tags: ["items"], responses: ok } } },
-    });
-    // A relative server names no host either.
-    const relative = JSON.stringify({
-      openapi: "3.0.3",
-      info: { title: "Synthetic relative", version: "1" },
-      servers: [{ url: "/" }],
-      paths: { "/api/items/": { get: { operationId: "list", tags: ["items"], responses: ok } } },
-    });
-    const downgradedServer = {
-      url: "{scheme}://uploads.downgraded.example.com/uploads",
-      variables: { scheme: { default: "https" } },
-    };
-    const integrations: ReadonlyArray<{
-      readonly slug: string;
-      readonly name: string;
-      readonly text: string;
-      readonly template: ReadonlyArray<unknown>;
-      readonly operations: Record<string, readonly [string, string]>;
-      readonly servers?: Record<string, ReadonlyArray<unknown>>;
-      readonly healthCheck?: unknown;
-      readonly specUrl?: string;
-    }> = [
-      {
-        slug: `requests_${suffix}`,
-        name: "Requests",
-        text: requests,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "items.list": ["get", "/items"], "items.ping": ["get", "/ping"] },
-      },
-      {
-        slug: `status_${suffix}`,
-        name: "Status",
-        text: status,
-        template: [],
-        operations: { "status.health": ["get", "/health"] },
-      },
-      {
-        slug: `split_${suffix}`,
-        name: "Split",
-        text: split,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "split.a": ["get", "/a"], "split.b": ["get", "/b"] },
-      },
-      {
-        slug: `google_${suffix}`,
-        name: "Google APIs",
-        text: google,
-        template: [],
-        operations: {
-          "messages.list": ["get", "/gmail/v1/users/me/messages"],
-          "sheets.get": ["get", "/v4/spreadsheets"],
-        },
-      },
-      {
-        slug: `uploads_${suffix}`,
-        name: "Uploads",
-        text: uploads,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
-      },
-      {
-        slug: `mixed_${suffix}`,
-        name: "Mixed",
-        text: mixed,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
-      },
-      {
-        slug: `downgraded_${suffix}`,
-        name: "Downgraded",
-        text: downgraded,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
-        servers: { "assets.upload": [downgradedServer] },
-        healthCheck: {
-          operation: "assets.upload",
-          args: { server: { url: downgradedServer.url, variables: { scheme: "http" } } },
-        },
-      },
-      {
-        slug: `regional_${suffix}`,
-        name: "Regional",
-        text: regional,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "items.list": ["get", "/items"], "items.models": ["get", "/models"] },
-      },
-      {
-        slug: `layered_${suffix}`,
-        name: "Layered",
-        text: layered,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
-        ],
-        operations: { "items.list": ["get", "/items"] },
-      },
-      {
-        slug: `unresolved_${suffix}`,
-        name: "Unresolved",
-        text: unresolved,
-        template: [],
-        operations: { "items.list": ["get", "/items"] },
-      },
-      {
-        slug: `serverless_${suffix}`,
-        name: "Serverless",
-        text: serverless,
-        template: [
-          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
         ],
-        operations: { "items.list": ["get", "/api/items/"] },
-        // A schema URL can carry a key in its host, path or query, so the reason never names it.
-        specUrl:
-          "https://synthetic-host-secret.app.serverless.example.com/api/synthetic-path-secret/schema/?token=synthetic-schema-token",
-      },
-      {
-        slug: `relative_${suffix}`,
-        name: "Relative",
-        text: relative,
-        template: [],
-        operations: { "items.list": ["get", "/api/items/"] },
-        specUrl: "https://app.relative.example.com/api/schema/",
-      },
+      });
+    const operation = (integration: string, tool: string, method: string, path: string) =>
+      row(
+        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+        organization,
+        `op.${integration}.${tool}`,
+        JSON.stringify({
+          integration,
+          toolName: tool,
+          binding: { method, pathTemplate: path },
+        }),
+      );
+    /** A connection's row, and the Vault object of its key when it holds one. */
+    const connection = (
+      integration: string,
+      owner: "org" | "user",
+      name: string,
+      template: string,
+      key?: string,
+    ) => {
+      const item = `connection:${owner}:${integration}:${name}:token`;
+      return {
+        vault:
+          key === undefined
+            ? undefined
+            : { name: vaultName(owner === "org" ? orgScope : userScope, item), key },
+        row: row(
+          "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, $2, $3, $4, $5, $6, $7::json)",
+          organization,
+          owner,
+          owner === "user" ? user : "",
+          integration,
+          name,
+          template,
+          JSON.stringify(key === undefined ? {} : { token: item }),
+        ),
+      };
+    };
+    const tool = (
+      integration: string,
+      plugin: "openapi" | "mcp",
+      owner: "org" | "user",
+      name: string,
+      toolName: string,
+      annotations: Record<string, unknown> = {},
+    ) =>
+      row(
+        "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, $2, $3, $4, $5, $6, $7, $8::json)",
+        organization,
+        owner,
+        owner === "user" ? user : "",
+        integration,
+        name,
+        plugin,
+        toolName,
+        JSON.stringify(annotations),
+      );
+    const rule = (pattern: string, action: string, position: string) =>
+      row(
+        "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, $3, $4)",
+        organization,
+        pattern,
+        action,
+        position,
+      );
+    const toolkitRow = (collection: string, data: Record<string, string>) =>
+      row(
+        "insert into plugin_storage (tenant, owner, subject, plugin_id, collection, key, data) values ($1, 'org', '', 'toolkits', $2, $3, $4::json)",
+        organization,
+        collection,
+        data.id ?? "",
+        JSON.stringify(data),
+      );
+    const ledgerConnections = [
+      connection(ledger, "org", "bot", "apikey-0", splitKeys.bot),
+      connection(ledger, "org", "reader", "apikey-0", splitKeys.reader),
+      connection(ledger, "user", "mine", "apikey-0", splitKeys.mine),
     ];
-    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    const notesConnections = [
+      connection(notes, "org", "alpha", "apikey-0", splitKeys.alpha),
+      connection(notes, "org", "beta", "apikey-0", splitKeys.beta),
+    ];
+    for (const { vault } of [...ledgerConnections, ...notesConnections])
+      if (vault !== undefined) yield* emulators.v1VaultObject(vault.name, vault.key);
+    const ledgerTools = ["entries.list", "entries.search", "entries.create"];
     yield* writeRows("v1-database.json", [
       row(
         "insert into organizations (id, name, slug) values ($1, $2, $3)",
         organization,
-        "Synthetic requests workspace",
+        "Synthetic split connections workspace",
         slug,
       ),
-      ...integrations.flatMap((integration) => {
-        const hash = createHash("sha256").update(integration.text).digest("hex");
-        return [
-          row(
-            "insert into integration (tenant, slug, plugin_id, name, config, health_check) values ($1, $2, 'openapi', $3, $4::json, nullif($5, '')::json)",
-            organization,
-            integration.slug,
-            integration.name,
-            JSON.stringify({
-              specHash: hash,
-              ...(integration.specUrl === undefined ? {} : { specUrl: integration.specUrl }),
-              authenticationTemplate: integration.template,
-            }),
-            integration.healthCheck === undefined ? "" : JSON.stringify(integration.healthCheck),
-          ),
-          row(
-            "insert into blob (namespace, key, value) values ($1, $2, $3)",
-            `o:${organization}/openapi`,
-            `spec/${hash}`,
-            integration.text,
-          ),
-          ...Object.entries(integration.operations).map(([tool, [method, path]]) =>
-            row(
-              "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
-              organization,
-              `op.${integration.slug}.${tool}`,
-              JSON.stringify({
-                integration: integration.slug,
-                toolName: tool,
-                binding: {
-                  method,
-                  pathTemplate: path,
-                  ...(integration.servers?.[tool] === undefined
-                    ? {}
-                    : { servers: integration.servers[tool], parameters: [] }),
-                },
-              }),
-            ),
-          ),
-        ];
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Ledger', $3::json)",
+        organization,
+        ledger,
+        apiKeyConfig(ledgerSpec.hash),
+      ),
+      row(
+        "insert into blob (namespace, key, value) values ($1, $2, $3)",
+        `o:${organization}/openapi`,
+        `spec/${ledgerSpec.hash}`,
+        ledgerSpec.text,
+      ),
+      operation(ledger, "entries.list", "get", "/entries"),
+      operation(ledger, "entries.search", "get", "/entries/search"),
+      operation(ledger, "entries.create", "post", "/entries"),
+      ...ledgerConnections.map((entry) => entry.row),
+      // What v1 last listed through each connection: every operation.
+      ...(
+        [
+          ["org", "bot"],
+          ["org", "reader"],
+          ["user", "mine"],
+        ] as const
+      ).flatMap(([owner, name]) =>
+        ledgerTools.map((toolName) => tool(ledger, "openapi", owner, name, toolName)),
+      ),
+      rule(`${ledger}.org.bot.entries.search`, "block", "a0"),
+      rule(`${ledger}.org.reader.entries.list`, "approve", "a1"),
+      rule(`${ledger}.org.reader.entries.search`, "approve", "a2"),
+      rule(`${ledger}.org.reader.*`, "block", "a3"),
+      toolkitRow("toolkits", { id: "tk_split", name: "Ledger team", slug: "ledger-team" }),
+      toolkitRow("toolkitConnections", {
+        id: "tkconn_split",
+        toolkitId: "tk_split",
+        pattern: `${ledger}.org.*.*`,
+        position: "a0",
       }),
-      // v1 accepted a method without a slug.
-      ...[
-        [`requests_${suffix}`, keyItem],
-        [`uploads_${suffix}`, uploadsKeyItem],
-        [`mixed_${suffix}`, mixedKeyItem],
-        [`split_${suffix}`, splitKeyItem],
-        [`downgraded_${suffix}`, downgradedKeyItem],
-        [`regional_${suffix}`, regionalKeyItem],
-        [`layered_${suffix}`, layeredKeyItem],
-      ].map(([integration, item]) =>
-        row(
-          "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'main', '', $4::json)",
-          organization,
-          user,
-          integration ?? "",
-          JSON.stringify({ token: item }),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Notes', $3::json)",
+        organization,
+        notes,
+        apiKeyConfig(notesSpec.hash),
+      ),
+      row(
+        "insert into blob (namespace, key, value) values ($1, $2, $3)",
+        `o:${organization}/openapi`,
+        `spec/${notesSpec.hash}`,
+        notesSpec.text,
+      ),
+      operation(notes, "notes.list", "get", "/notes"),
+      operation(notes, "notes.delete", "delete", "/notes"),
+      ...notesConnections.map((entry) => entry.row),
+      // A connection that signs in with a method Notes does not declare and never listed tools.
+      connection(notes, "org", "gamma", "apikey-9").row,
+      ...["alpha", "beta"].flatMap((name) =>
+        ["notes.list", "notes.delete"].map((toolName) =>
+          tool(notes, "openapi", "org", name, toolName),
         ),
       ),
+      rule(`${notes}.org.*.notes.delete`, "block", "b0"),
+      rule(`${notes}.org.gamma.*`, "block", "b1"),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Signals', $3::json)",
+        organization,
+        signals,
+        JSON.stringify({
+          transport: "remote",
+          endpoint: `${origin}/mcp`,
+          authenticationTemplate: [{ slug: "none", kind: "none" }],
+        }),
+      ),
+      ...["east", "west"].flatMap((name) => [
+        connection(signals, "org", name, "none").row,
+        tool(signals, "mcp", "org", name, "read", { mcp: { toolName: "read" } }),
+        // Only `east` listed `erase` after the server marked it destructive.
+        tool(signals, "mcp", "org", name, "erase", {
+          ...(name === "east" ? { requiresApproval: true } : {}),
+          mcp: { toolName: "erase" },
+        }),
+      ]),
     ]);
   });
 
-/** A workspace with only a public API, which imports completely. */
-const seedPublic = (organization: string, slug: string, origin: string) =>
+/**
+ * A workspace whose public MCP server dropped a tool's destructive hint after v1 last listed it:
+ * v1 stamped `unhinted` as needing approval and asks from that stamp, while the server lists it
+ * without a hint now. v1 allowed `safe`, which it never stamped, and `read`, which it stamped but a
+ * workspace policy approves. A toolkit grants the first two.
+ */
+const seedStampedApprovals = (organization: string, slug: string, origin: string) =>
+  Effect.gen(function* () {
+    const server = `approvals_${randomUUID().slice(0, 6)}`;
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    const tool = (name: string, stamped: boolean) =>
+      row(
+        "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'org', '', $2, 'open', 'mcp', $3, $4::json)",
+        organization,
+        server,
+        name,
+        JSON.stringify({ ...(stamped ? { requiresApproval: true } : {}), mcp: { toolName: name } }),
+      );
+    const toolkitRow = (collection: string, data: Record<string, string>) =>
+      row(
+        "insert into plugin_storage (tenant, owner, subject, plugin_id, collection, key, data) values ($1, 'org', '', 'toolkits', $2, $3, $4::json)",
+        organization,
+        collection,
+        data.id ?? "",
+        JSON.stringify(data),
+      );
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        organization,
+        "Synthetic approvals workspace",
+        slug,
+      ),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Approvals', $3::json)",
+        organization,
+        server,
+        JSON.stringify({
+          transport: "remote",
+          endpoint: `${origin}/mcp`,
+          authenticationTemplate: [{ slug: "none", kind: "none" }],
+        }),
+      ),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template) values ($1, 'org', '', $2, 'open', 'none')",
+        organization,
+        server,
+      ),
+      tool("unhinted", true),
+      tool("safe", false),
+      tool("read", true),
+      row(
+        "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, 'approve', 'a0')",
+        organization,
+        `${server}.*.*.read`,
+      ),
+      toolkitRow("toolkits", { id: "tk_ops", name: "Ops", slug: "ops" }),
+      toolkitRow("toolkitConnections", {
+        id: "tkconn_ops",
+        toolkitId: "tk_ops",
+        pattern: `${server}.org.open.*`,
+        position: "a0",
+      }),
+      // The toolkit leaves `read` out. Had it served `read`, v1 would have asked there from the
+      // stamp, ignoring the workspace's approve, and the app would ask for every caller.
+      toolkitRow("toolkitPolicies", {
+        id: "tkpol_ops",
+        toolkitId: "tk_ops",
+        pattern: `${server}.*.*.read`,
+        action: "block",
+        position: "a1",
+      }),
+    ]);
+  });
+
+/**
+ * A workspace whose public MCP server lists tools v1 never listed: v1 last listed only `read`,
+ * which a rule approves. A rule blocks `unhinted` by name and a catch-all rule asks before every
+ * other tool, so once the server listed them v1 would have blocked `unhinted` and asked before
+ * `safe`, which the server does not mark destructive. A public API's one read operation, which v1
+ * compiled but never listed, is under a catch-all rule that asks before every tool.
+ */
+const seedUnlistedRules = (organization: string, slug: string, origin: string) =>
   Effect.gen(function* () {
+    const server = `unlisted_${randomUUID().slice(0, 6)}`;
+    const api = `status_${randomUUID().slice(0, 6)}`;
     const text = JSON.stringify({
       openapi: "3.0.3",
       info: { title: "Synthetic status", version: "1" },
@@ -1716,19 +1736,50 @@ const seedPublic = (organization: string, slug: string, origin: string) =>
       },
     });
     const hash = createHash("sha256").update(text).digest("hex");
-    const integration = `status_${randomUUID().slice(0, 6)}`;
     const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    const rule = (pattern: string, action: string, position: string) =>
+      row(
+        "insert into tool_policy (tenant, owner, subject, pattern, action, position) values ($1, 'org', '', $2, $3, $4)",
+        organization,
+        pattern,
+        action,
+        position,
+      );
     yield* writeRows("v1-database.json", [
       row(
         "insert into organizations (id, name, slug) values ($1, $2, $3)",
         organization,
-        "Synthetic complete workspace",
+        "Synthetic unlisted tools workspace",
         slug,
       ),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Unlisted', $3::json)",
+        organization,
+        server,
+        JSON.stringify({
+          transport: "remote",
+          endpoint: `${origin}/mcp`,
+          authenticationTemplate: [{ slug: "none", kind: "none" }],
+        }),
+      ),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template) values ($1, 'org', '', $2, 'open', 'none')",
+        organization,
+        server,
+      ),
+      row(
+        "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'org', '', $2, 'open', 'mcp', 'read', $3::json)",
+        organization,
+        server,
+        JSON.stringify({ mcp: { toolName: "read" } }),
+      ),
+      rule(`${server}.*.*.read`, "approve", "a0"),
+      rule(`${server}.org.open.unhinted`, "block", "a1"),
+      rule(`${server}.*`, "require_approval", "a2"),
       row(
         "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Status', $3::json)",
         organization,
-        integration,
+        api,
         JSON.stringify({ specHash: hash, authenticationTemplate: [] }),
       ),
       row(
@@ -1740,1902 +1791,3577 @@ const seedPublic = (organization: string, slug: string, origin: string) =>
       row(
         "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
         organization,
-        `op.${integration}.status.health`,
+        `op.${api}.status.health`,
         JSON.stringify({
-          integration,
+          integration: api,
           toolName: "status.health",
           binding: { method: "get", pathTemplate: "/health" },
         }),
       ),
+      rule(`${api}.*`, "require_approval", "a3"),
     ]);
   });
 
 /**
- * A synthetic OAuth service: two token endpoints, as two v1 clients named, that renew any refresh
- * token, and an API (`GET /api/me`) that answers only the renewed access token. It records each
- * token request's path, client authentication and form, and each API request's authorization.
- * Behind a gateway (`GET /gated/me`), it records the token and the gateway's and client's
- * credential headers each request brought.
+ * Two host names of one synthetic service, under one registrable domain, for the loopback
+ * service's port. `*.localhost` resolves to loopback.
  */
-const oauthService = Effect.gen(function* () {
-  const renewedToken = "synthetic-renewed-access-token";
-  const tokens = yield* Ref.make<
-    ReadonlyArray<{ path: string; authorization: string | undefined; form: URLSearchParams }>
-  >([]);
-  const calls = yield* Ref.make<ReadonlyArray<string | undefined>>([]);
-  const gated = yield* Ref.make<ReadonlyArray<Readonly<Record<string, string | undefined>>>>([]);
-  const token = Effect.gen(function* () {
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
-    yield* Ref.update(tokens, (all) => [
-      ...all,
-      {
-        path: new URL(request.url, "http://service").pathname,
-        authorization: request.headers.authorization,
-        form,
-      },
-    ]);
-    return yield* HttpServerResponse.json({
-      access_token: renewedToken,
-      token_type: "Bearer",
-      expires_in: 3600,
-    });
-  });
-  const routes = Layer.mergeAll(
-    HttpRouter.add("POST", "/token", token),
-    HttpRouter.add("POST", "/other/token", token),
-    HttpRouter.add(
-      "GET",
-      "/api/me",
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        yield* Ref.update(calls, (all) => [...all, request.headers.authorization]);
-        return request.headers.authorization === `Bearer ${renewedToken}`
-          ? yield* HttpServerResponse.json({ email: "mail-member@example.test" })
-          : yield* HttpServerResponse.json({ error: "unauthenticated" }, { status: 401 });
-      }),
-    ),
-    HttpRouter.add(
-      "GET",
-      "/gated/me",
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        yield* Ref.update(gated, (all) => [
-          ...all,
-          Object.fromEntries(
-            [
-              "authorization",
-              "cf-access-client-id",
-              "cf-access-client-secret",
-              "client_id",
-              "client_secret",
-            ].map((name) => [name, request.headers[name]] as const),
-          ),
-        ]);
-        return yield* HttpServerResponse.json({ email: "gated-member@example.test" });
-      }),
-    ),
-  );
-  const services = yield* Layer.build(
-    HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
-      Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
-    ),
-  );
-  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
-  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
-  return {
-    origin: `http://127.0.0.1:${server.address.port}`,
-    renewedToken,
-    tokens: Ref.get(tokens),
-    calls: Ref.get(calls),
-    gated: Ref.get(gated),
-  };
+const serviceHosts = (port: number) => ({
+  api: `api.synthetic-service.localhost:${port}`,
+  uploads: `uploads.synthetic-service.localhost:${port}`,
 });
 
-/** A request's query or form, as the ordered parameters a server reads. */
-type Parameters = ReadonlyArray<readonly [string, string]>;
-
 /**
- * A synthetic authorization server at any path. `GET …/authorize` records the parameters the
- * browser brought and returns to their `redirect_uri` with a code; `POST …/token` records the form
- * and issues a token.
+ * OpenAPI integrations whose requests depend on how v1 read them, against a loopback service
+ * that records what it receives: a YAML specification with a repeated key, operations that name
+ * their own server, a webhook, a method without a name, a public API, one whose operations call
+ * two hosts of one service, one whose operations call two services with an account, one on two
+ * HTTPS hosts of one service whose account check picks a server variable that turns it to plain
+ * HTTP, one whose operation names a server that uses the document server's variable without
+ * declaring it, one whose two document servers declare that variable differently, and one whose
+ * server uses a variable no server declares.
  */
-const signInService = Effect.gen(function* () {
-  const authorizations = yield* Ref.make<ReadonlyArray<{ path: string; query: Parameters }>>([]);
-  const tokens = yield* Ref.make<ReadonlyArray<{ path: string; form: Parameters }>>([]);
-  const routes = HttpRouter.add(
-    "*",
-    "/*",
-    Effect.gen(function* () {
-      const request = yield* HttpServerRequest.HttpServerRequest;
-      const url = new URL(request.url, "http://sign-in");
-      if (request.method === "GET" && url.pathname.endsWith("/authorize")) {
-        yield* Ref.update(authorizations, (all) => [
-          ...all,
-          { path: url.pathname, query: [...url.searchParams] },
-        ]);
-        const callback = URL.parse(url.searchParams.get("redirect_uri") ?? "");
-        if (callback === null) return HttpServerResponse.empty({ status: 400 });
-        callback.searchParams.set("code", "synthetic-code");
-        callback.searchParams.set("state", url.searchParams.get("state") ?? "");
-        return HttpServerResponse.redirect(callback.href, { status: 302 });
-      }
-      if (request.method === "POST" && url.pathname.endsWith("/token")) {
-        const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
-        yield* Ref.update(tokens, (all) => [...all, { path: url.pathname, form: [...form] }]);
-        return yield* HttpServerResponse.json({
-          access_token: "synthetic-reconnected-access",
-          refresh_token: "synthetic-reconnected-refresh",
-          token_type: "Bearer",
-          expires_in: 3600,
-        });
-      }
-      return HttpServerResponse.empty({ status: 404 });
-    }),
-  );
-  const services = yield* Layer.build(
-    HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
-      Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
-    ),
-  );
-  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
-  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
-  return {
-    origin: `http://127.0.0.1:${server.address.port}`,
-    authorizations: Ref.get(authorizations),
-    tokens: Ref.get(tokens),
-  };
-});
-
-/** Each parameter by name, and how many times the request named each one. */
-const parameterRecord = (parameters: Parameters) => ({
-  values: Object.fromEntries(parameters),
-  names: parameters.map(([name]) => name).toSorted(),
-});
-
-/**
- * An OpenAPI integration whose OAuth method, like v1's Outlook preset, declares no authorization
- * URL, endpoints and scopes no client uses, and a second method under the same slug. Each connection signed in through its own v1 client:
- * `renewed` through a confidential client with a resource, with granted scopes and an expired
- * token; `second` through a public client at other endpoints; `untrusted` recorded a token
- * endpoint v1 no longer trusted.
- *
- * Two more OAuth APIs send fixed credentials beside the token. `Gated mail` sits behind a
- * gateway that takes its own client ID and secret, which v2 keeps in a second account. `Pasted
- * mail` sends its OAuth client's own ID and secret as headers, which its sign-in already sends.
- */
-const seedRenewal = (organization: string, user: string, slug: string, origin: string) =>
+const seedRequests = (organization: string, user: string, slug: string, origin: string) =>
   Effect.gen(function* () {
     const emulators = yield* Emulators;
-    const mail = `mail_${randomUUID().slice(0, 6)}`;
+    const suffix = randomUUID().slice(0, 6);
+    const keyItem = `connection:user:requests_${suffix}:main:token`;
+    const uploadsKeyItem = `connection:user:uploads_${suffix}:main:token`;
+    const mixedKeyItem = `connection:user:mixed_${suffix}:main:token`;
+    const splitKeyItem = `connection:user:split_${suffix}:main:token`;
+    const downgradedKeyItem = `connection:user:downgraded_${suffix}:main:token`;
+    const regionalKeyItem = `connection:user:regional_${suffix}:main:token`;
+    const layeredKeyItem = `connection:user:layered_${suffix}:main:token`;
     const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
-    const orgScope = `executor/org/${encodeURIComponent(organization)}`;
-    const access = (name: string) => `oauth:user:${mail}:${name}`;
-    const refresh = (name: string) => `${access(name)}:refresh`;
-    const secret = `oauth-client:org:${mail}-confidential:secret`;
-    for (const name of ["renewed", "second", "untrusted"]) {
-      yield* emulators.v1VaultObject(
-        vaultName(userScope, access(name)),
-        `synthetic-${name}-access`,
-      );
-      yield* emulators.v1VaultObject(
-        vaultName(userScope, refresh(name)),
-        `synthetic-${name}-refresh`,
-      );
-    }
-    yield* emulators.v1VaultObject(vaultName(orgScope, secret), "synthetic-confidential-secret");
-    const gated = `gated_${randomUUID().slice(0, 6)}`;
-    const pasted = `pasted_${randomUUID().slice(0, 6)}`;
-    const pastedSecret = `oauth-client:org:${pasted}:secret`;
-    yield* emulators.v1VaultObject(vaultName(userScope, access("gated")), "synthetic-gated-access");
-    yield* emulators.v1VaultObject(
-      vaultName(userScope, access("pasted")),
-      "synthetic-pasted-access",
-    );
+    yield* emulators.v1VaultObject(vaultName(userScope, keyItem), "synthetic-requests-key");
+    yield* emulators.v1VaultObject(vaultName(userScope, uploadsKeyItem), "synthetic-uploads-key");
+    yield* emulators.v1VaultObject(vaultName(userScope, mixedKeyItem), "synthetic-mixed-key");
+    yield* emulators.v1VaultObject(vaultName(userScope, splitKeyItem), "synthetic-split-key");
     yield* emulators.v1VaultObject(
-      vaultName(orgScope, pastedSecret),
-      "synthetic-pasted-secret-0123456789",
+      vaultName(userScope, downgradedKeyItem),
+      "synthetic-downgraded-key",
     );
-    const document = JSON.stringify({
+    yield* emulators.v1VaultObject(vaultName(userScope, regionalKeyItem), "synthetic-regional-key");
+    yield* emulators.v1VaultObject(vaultName(userScope, layeredKeyItem), "synthetic-layered-key");
+    const hosts = serviceHosts(Number(new URL(origin).port));
+    // js-yaml, which v1 parsed with, keeps the last of a repeated key.
+    const requests = [
+      "openapi: 3.1.0",
+      "info:",
+      "  title: Synthetic requests",
+      "  version: '1'",
+      "  description: first",
+      "  description: second",
+      "servers:",
+      `  - url: ${origin}/root`,
+      "paths:",
+      "  /items:",
+      "    get:",
+      "      operationId: listItems",
+      "      tags: [items]",
+      "      servers:",
+      `        - url: ${origin}/v2`,
+      "      responses:",
+      "        '200':",
+      "          description: ok",
+      "  /ping:",
+      "    get:",
+      "      operationId: ping",
+      "      tags: [items]",
+      "      responses:",
+      "        '200':",
+      "          description: ok",
+      "webhooks:",
+      "  itemCreated:",
+      "    post:",
+      "      requestBody:",
+      "        content:",
+      "          application/json:",
+      "            schema:",
+      "              $ref: '#/components/schemas/Event'",
+      "      responses:",
+      "        '200':",
+      "          description: ok",
+      "components:",
+      "  schemas:",
+      "    Event:",
+      "      type: object",
+      "",
+    ].join("\n");
+    const document = (title: string, paths: Record<string, unknown>) =>
+      JSON.stringify({
+        openapi: "3.0.3",
+        info: { title, version: "1" },
+        servers: [{ url: `${origin}/public` }],
+        paths,
+      });
+    const ok = { "200": { description: "ok" } };
+    const status = document("Synthetic status", {
+      "/health": { get: { operationId: "health", tags: ["status"], responses: ok } },
+    });
+    const split = document("Synthetic split", {
+      "/a": { get: { operationId: "a", tags: ["split"], responses: ok } },
+      "/b": {
+        get: {
+          operationId: "b",
+          tags: ["split"],
+          servers: [{ url: "https://other.example.com" }],
+          responses: ok,
+        },
+      },
+    });
+    // Google's APIs, each on its own host under `googleapis.com`, which the public suffix list
+    // keeps apart.
+    const google = JSON.stringify({
       openapi: "3.0.3",
-      info: { title: "Synthetic mail", version: "1" },
-      servers: [{ url: `${origin}/api` }],
+      info: { title: "Synthetic Google", version: "1" },
+      servers: [{ url: "https://gmail.googleapis.com" }],
       paths: {
-        "/me": {
-          get: { operationId: "me", tags: ["mail"], responses: { "200": { description: "ok" } } },
+        "/gmail/v1/users/me/messages": {
+          get: { operationId: "list", tags: ["messages"], responses: ok },
+        },
+        "/v4/spreadsheets": {
+          get: {
+            operationId: "get",
+            tags: ["sheets"],
+            servers: [{ url: "https://sheets.googleapis.com" }],
+            responses: ok,
+          },
         },
       },
     });
-    const hash = createHash("sha256").update(document).digest("hex");
-    const gatedDocument = JSON.stringify({
+    // Like GitHub's API and upload hosts: v1 sent the account's key to both.
+    const uploads = JSON.stringify({
       openapi: "3.0.3",
-      info: { title: "Synthetic gated mail", version: "1" },
-      servers: [{ url: `${origin}/gated` }],
+      info: { title: "Synthetic uploads", version: "1" },
+      servers: [{ url: `http://${hosts.api}/api` }],
       paths: {
-        "/me": {
-          get: { operationId: "me", tags: ["mail"], responses: { "200": { description: "ok" } } },
+        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
+        "/assets": {
+          get: {
+            operationId: "upload",
+            tags: ["assets"],
+            servers: [{ url: `http://${hosts.uploads}/uploads` }],
+            responses: ok,
+          },
         },
       },
     });
-    const gatedHash = createHash("sha256").update(gatedDocument).digest("hex");
-    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
-    /** An OAuth API behind the gated document, whose configuration sends fixed headers. */
-    const fixedApi = (slug: string, name: string, headers: Record<string, string>) => [
-      row(
-        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
-        organization,
-        slug,
-        name,
-        JSON.stringify({
-          specHash: gatedHash,
-          headers,
-          authenticationTemplate: [
-            { slug: "oauth2", kind: "oauth2", authorizationUrl: "", tokenUrl: "", scopes: [] },
-          ],
-        }),
-      ),
-      row(
-        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
-        organization,
-        `op.${slug}.mail.me`,
-        JSON.stringify({
-          integration: slug,
-          toolName: "mail.me",
-          binding: { method: "get", pathTemplate: "/me" },
-        }),
-      ),
-    ];
-    const client = (
-      name: string,
-      authorize: string,
-      token: string,
-      resource: string | null,
-      secretItem: string | null,
-    ) =>
-      row(
-        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, client_secret_item_id, token_endpoint_auth_method, resource, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', $5, nullif($6, ''), 'basic', nullif($7, ''), 'manual')",
-        organization,
-        `${mail}-${name}`,
-        authorize,
-        token,
-        `synthetic-${name}-client`,
-        secretItem ?? "",
-        resource ?? "",
-      );
-    const connection = (
-      name: string,
-      clientName: string,
-      expiresAt: number,
-      scope: string | null,
-      tokenUrl: string | null,
-    ) =>
-      row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope, oauth_token_url) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'org', $7, $8::bigint, nullif($9, ''), nullif($10, ''))",
-        organization,
-        user,
-        mail,
-        name,
-        JSON.stringify({ token: access(name) }),
-        `${mail}-${clientName}`,
-        refresh(name),
-        String(expiresAt),
-        scope ?? "",
-        tokenUrl ?? "",
-      );
-    yield* writeRows("v1-database.json", [
-      row(
-        "insert into organizations (id, name, slug) values ($1, $2, $3)",
-        organization,
-        "Synthetic mail workspace",
-        slug,
-      ),
-      row(
-        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Mail', $3::json)",
-        organization,
-        mail,
-        JSON.stringify({
-          specHash: hash,
-          authenticationTemplate: [
-            {
-              slug: "oauth2",
-              kind: "oauth2",
-              authorizationUrl: "",
-              tokenUrl: "https://method.example.com/token",
-              scopes: ["method.scope"],
-            },
-            // A specification with both OAuth flows gave v1 two methods under one slug; v1 used
-            // the first.
-            { slug: "oauth2", kind: "oauth2", authorizationUrl: "", tokenUrl: "", scopes: [] },
-          ],
-        }),
-      ),
-      row(
-        "insert into blob (namespace, key, value) values ($1, $2, $3)",
-        `o:${organization}/openapi`,
-        `spec/${hash}`,
-        document,
-      ),
-      row(
-        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
-        organization,
-        `op.${mail}.mail.me`,
-        JSON.stringify({
-          integration: mail,
-          toolName: "mail.me",
-          binding: { method: "get", pathTemplate: "/me" },
-        }),
-      ),
-      client("confidential", `${origin}/authorize`, `${origin}/token`, `${origin}/api`, secret),
-      client("public", `${origin}/other/authorize`, `${origin}/other/token`, null, null),
-      // Expired, so the first call renews it.
-      connection(
-        "renewed",
-        "confidential",
-        Date.now() - 60_000,
-        "mail.read  offline_access",
-        `${origin}/token`,
-      ),
-      connection("second", "public", Date.now() + 3_600_000, null, null),
-      row(
-        "insert into blob (namespace, key, value) values ($1, $2, $3)",
-        `o:${organization}/openapi`,
-        `spec/${gatedHash}`,
-        gatedDocument,
-      ),
-      ...fixedApi(gated, "Gated mail", {
-        "CF-Access-Client-Id": "synthetic0gateway1client2id.access",
-        "CF-Access-Client-Secret": "synthetic-gateway-secret-0123456789",
-      }),
-      ...fixedApi(pasted, "Pasted mail", {
-        CLIENT_ID: "synthetic-pasted-client-0123456789",
-        CLIENT_SECRET: "synthetic-pasted-secret-0123456789",
-      }),
-      row(
-        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, client_secret_item_id, token_endpoint_auth_method, resource, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', $5, $6, 'body', null, 'manual')",
-        organization,
-        pasted,
-        `${origin}/authorize`,
-        `${origin}/token`,
-        "synthetic-pasted-client-0123456789",
-        pastedSecret,
-      ),
-      ...[
-        [gated, "gated", `${mail}-public`],
-        [pasted, "pasted", pasted],
-      ].map(([integration, name, oauthClient]) =>
-        row(
-          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, expires_at) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'org', $7::bigint)",
-          organization,
-          user,
-          integration ?? "",
-          name ?? "",
-          JSON.stringify({ token: access(name ?? "") }),
-          oauthClient ?? "",
-          String(Date.now() + 3_600_000),
-        ),
-      ),
-      connection(
-        "untrusted",
-        "confidential",
-        Date.now() + 3_600_000,
-        null,
-        "https://elsewhere.example.com/token",
-      ),
-    ]);
-  });
-
-/**
- * The loopback service behind the clients v1's first-party connections move to
- * (`v1FirstPartyClients`), on the port this Cloud's operator settings name. Each client's token
- * endpoint renews any refresh token, Slack's under `authed_user` with its scopes comma-separated.
- * Each API answers only its client's renewed access token: Google's and GitHub's OpenAPI
- * operations, Slack's MCP server, and an MCP server shaped as GitHub's, which names the GitHub
- * client's endpoints under its own issuer path and advertises scopes the client does not allow.
- * Each MCP server challenges any other request with its resource metadata, on whichever host the
- * request named. The two GitHub-shaped clients that send tokens to `v1GitHubHosts` each have an
- * API and an upload path. It records each token request's client, path and form, and each API
- * request's host, path and authorization.
- */
-const firstPartyService = (port: number) =>
-  Effect.gen(function* () {
-    const origin = `http://127.0.0.1:${port}`;
-    const renewed = (client: string) => `synthetic-renewed-${client}-token`;
-    const tokens = yield* Ref.make<ReadonlyArray<{ path: string; form: URLSearchParams }>>([]);
-    const calls = yield* Ref.make<
-      ReadonlyArray<{ host?: string; path: string; authorization?: string }>
-    >([]);
-    const recordCall = Effect.gen(function* () {
-      const request = yield* HttpServerRequest.HttpServerRequest;
-      const path = new URL(request.url, origin).pathname;
-      const { authorization, host } = request.headers;
-      yield* Ref.update(calls, (all) => [
-        ...all,
+    // One service's hosts, one of them on plain HTTP: v1 sent the key to both, but the account's
+    // credentials would cross the network unencrypted.
+    const mixed = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic mixed", version: "1" },
+      servers: [{ url: "https://api.mixed.example.com/api" }],
+      paths: {
+        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
+        "/assets": {
+          get: {
+            operationId: "upload",
+            tags: ["assets"],
+            servers: [{ url: "http://uploads.mixed.example.com/uploads" }],
+            responses: ok,
+          },
+        },
+      },
+    });
+    // One service's two HTTPS hosts, whose account check picks the upload server with its scheme
+    // variable set to plain HTTP.
+    const downgraded = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic downgraded", version: "1" },
+      servers: [{ url: "https://api.downgraded.example.com/api" }],
+      paths: {
+        "/repos": { get: { operationId: "get", tags: ["repos"], responses: ok } },
+        "/assets": {
+          get: {
+            operationId: "upload",
+            tags: ["assets"],
+            servers: [
+              {
+                url: "{scheme}://uploads.downgraded.example.com/uploads",
+                variables: { scheme: { default: "https", enum: ["https", "http"] } },
+              },
+            ],
+            responses: ok,
+          },
+        },
+      },
+    });
+    // Like Sentry's API: the document's server declares a region variable, and one operation names
+    // the same server URL without declaring it, so the operation uses the document's default.
+    const regionalServer = `http://{region}.synthetic-service.localhost:${new URL(origin).port}/regional`;
+    const regional = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic regional", version: "1" },
+      servers: [
         {
-          ...(host === undefined ? {} : { host }),
-          path,
-          ...(authorization === undefined ? {} : { authorization }),
+          url: regionalServer,
+          variables: { region: { default: "api", enum: ["api", "uploads"] } },
         },
-      ]);
-      return authorization;
+      ],
+      paths: {
+        "/items": { get: { operationId: "list", tags: ["items"], responses: ok } },
+        "/models": {
+          get: {
+            operationId: "models",
+            tags: ["items"],
+            servers: [{ url: regionalServer }],
+            responses: ok,
+          },
+        },
+      },
     });
-    type Client = "google" | "github" | "slack" | "github-both" | "github-api";
-    const token = (client: Client) =>
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
-        yield* Ref.update(tokens, (all) => [...all, { path: `/${client}/token`, form }]);
-        const issued = { access_token: renewed(client), token_type: "Bearer", expires_in: 3600 };
-        return yield* HttpServerResponse.json(
-          client === "slack"
-            ? {
-                ok: true,
-                authed_user: {
-                  ...issued,
-                  refresh_token: "synthetic-rotated-slack-refresh",
-                  scope: v1SlackScopes.join(","),
-                },
-              }
-            : client === "google"
-              ? { ...issued, scope: form.get("scope") ?? "" }
-              : issued,
-        );
-      });
-    /** An API that answers `accepted`, by default its client's renewed access token. */
-    const api = (client: Exclude<Client, "slack">, body: object, accepted = renewed(client)) =>
-      Effect.gen(function* () {
-        const authorization = yield* recordCall;
-        return authorization === `Bearer ${accepted}`
-          ? yield* HttpServerResponse.json(body)
-          : yield* HttpServerResponse.json({ error: "unauthenticated" }, { status: 401 });
-      });
-    /** This service's origin under the host the request named. */
-    const requested = Effect.map(
-      HttpServerRequest.HttpServerRequest,
-      (request) => `http://${request.headers.host ?? new URL(origin).host}`,
-    );
-    const challenge = (client: "slack" | "github") =>
-      Effect.map(requested, (at) =>
-        HttpServerResponse.empty({
-          status: 401,
-          headers: {
-            "www-authenticate": `Bearer resource_metadata="${at}/.well-known/oauth-protected-resource/${client}/mcp"`,
+    // Two document servers declare the region with different defaults, and the first has no URL.
+    // An operation's server that omits the declaration takes the first document server's, as the
+    // app's router does, even though that server's empty URL is never called.
+    const layeredServer = `http://{region}.synthetic-service.localhost:${new URL(origin).port}/layered`;
+    const layered = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic layered", version: "1" },
+      servers: [
+        { url: "", variables: { region: { default: "api" } } },
+        { url: layeredServer, variables: { region: { default: "uploads" } } },
+      ],
+      paths: {
+        "/items": {
+          get: {
+            operationId: "list",
+            tags: ["items"],
+            servers: [{ url: layeredServer }],
+            responses: ok,
           },
-        }),
-      );
-    const mcp = (client: "slack" | "github") =>
-      Effect.gen(function* () {
-        const authorization = yield* recordCall;
-        if (authorization !== `Bearer ${renewed(client)}`) return yield* challenge(client);
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        const message = yield* request.json.pipe(
-          Effect.flatMap(
-            Schema.decodeUnknownEffect(
-              Schema.Struct({
-                id: Schema.optional(Schema.Union([Schema.Number, Schema.String])),
-                method: Schema.String,
-              }),
-            ),
-          ),
-          Effect.orDie,
-        );
-        if (message.id === undefined) return HttpServerResponse.empty({ status: 202 });
-        const result =
-          message.method === "initialize"
-            ? {
-                protocolVersion: "2025-03-26",
-                capabilities: { tools: {} },
-                serverInfo: { name: `synthetic-${client}-mcp`, version: "1" },
-              }
-            : message.method === "tools/list"
-              ? {
-                  tools: [
-                    {
-                      name: "whoami",
-                      description: "The signed-in user.",
-                      inputSchema: { type: "object", properties: {} },
-                      annotations: { readOnlyHint: true },
-                    },
-                  ],
-                }
-              : message.method === "tools/call"
-                ? { content: [{ type: "text", text: `synthetic-${client}-member` }] }
-                : undefined;
-        return yield* HttpServerResponse.json({
-          jsonrpc: "2.0",
-          id: message.id,
-          ...(result === undefined
-            ? { error: { code: -32601, message: "Method not found" } }
-            : { result }),
-        });
-      });
-    const mcpGet = (client: "slack" | "github") =>
-      Effect.gen(function* () {
-        const authorization = yield* recordCall;
-        return authorization === `Bearer ${renewed(client)}`
-          ? HttpServerResponse.empty({ status: 405 })
-          : yield* challenge(client);
-      });
-    const routes = Layer.mergeAll(
-      HttpRouter.add("POST", "/google/token", token("google")),
-      HttpRouter.add("POST", "/github/token", token("github")),
-      HttpRouter.add("POST", "/slack/token", token("slack")),
-      // These accounts have not expired, so their APIs answer the access token v1 stored.
-      ...(
-        [
-          ["github-both", "synthetic-both-access"],
-          ["github-api", "synthetic-apionly-access"],
-        ] as const
-      ).flatMap(([client, accepted]) => [
-        HttpRouter.add("POST", `/${client}/token`, token(client)),
-        HttpRouter.add(
-          "GET",
-          `/${client}/api/user`,
-          api(client, { login: "synthetic-member" }, accepted),
-        ),
-        HttpRouter.add(
-          "GET",
-          `/${client}/uploads/asset`,
-          api(client, { uploaded: true }, accepted),
-        ),
-      ]),
-      HttpRouter.add(
-        "GET",
-        "/google/api/me",
-        api("google", { email: "google-member@example.test" }),
-      ),
-      HttpRouter.add("GET", "/github/api/user", api("github", { login: "synthetic-member" })),
-      HttpRouter.add("POST", "/slack/mcp", mcp("slack")),
-      HttpRouter.add("GET", "/slack/mcp", mcpGet("slack")),
-      HttpRouter.add("POST", "/github/mcp", mcp("github")),
-      HttpRouter.add("GET", "/github/mcp", mcpGet("github")),
-      // As GitHub's MCP server: its authorization server is the GitHub client's, under an issuer
-      // path (GitHub's is `https://github.com/login/oauth`), and it advertises scopes a GitHub App,
-      // which has none, never asks for.
-      HttpRouter.add(
-        "GET",
-        "/.well-known/oauth-protected-resource/github/mcp",
-        Effect.map(requested, (at) =>
-          HttpServerResponse.jsonUnsafe({
-            resource: `${at}/github/mcp`,
-            authorization_servers: [`${origin}/github/login/oauth`],
-            scopes_supported: ["repo", "read:org", "gist"],
-            bearer_methods_supported: ["header"],
-          }),
-        ),
-      ),
-      HttpRouter.add(
-        "GET",
-        "/.well-known/oauth-authorization-server/github/login/oauth",
-        HttpServerResponse.json({
-          issuer: `${origin}/github/login/oauth`,
-          authorization_endpoint: `${origin}/github/authorize`,
-          token_endpoint: `${origin}/github/token`,
-          response_types_supported: ["code"],
-          grant_types_supported: ["authorization_code", "refresh_token"],
-          code_challenge_methods_supported: ["S256"],
-          scopes_supported: ["offline_access"],
-        }),
-      ),
-      HttpRouter.add(
-        "GET",
-        "/.well-known/oauth-protected-resource/slack/mcp",
-        HttpServerResponse.json({
-          resource: `${origin}/slack/mcp`,
-          authorization_servers: [origin],
-          scopes_supported: [...v1SlackScopes, "admin"],
-        }),
-      ),
-      HttpRouter.add(
-        "GET",
-        "/.well-known/oauth-authorization-server",
-        HttpServerResponse.json({
-          issuer: origin,
-          authorization_endpoint: `${origin}/slack/authorize`,
-          token_endpoint: `${origin}/slack/token`,
-          code_challenge_methods_supported: ["S256"],
-          token_endpoint_auth_methods_supported: ["client_secret_post"],
-          scopes_supported: [...v1SlackScopes, "admin"],
-        }),
-      ),
-    );
-    yield* Layer.build(
-      HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
-        Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port })),
-      ),
-    );
-    return { origin, renewed, tokens: Ref.get(tokens), calls: Ref.get(calls) };
-  });
-
-/**
- * A workspace whose connections signed in through Executor's own apps, as v1 stored them: no
- * `oauth_client` row, `first-party:<name>` in their `oauth_client`. Google's and GitHub's are
- * OpenAPI integrations whose methods declare endpoints and scopes the apps never used; Slack's and
- * `github-mcp`'s are MCP servers, the latter shaped as GitHub's, which v1 signed in with its GitHub
- * App. `google`, `github`, `slack` and `github-mcp` have expired, so they renew by their first
- * calls; the rest have not.
- * `beyond` was granted a scope the Google client does not allow, `elsewhere` and `mcp-elsewhere`
- * call a host the GitHub client's tokens never reach, and `notion` signed in through an app v2
- * does not offer.
- * `both` and `apionly` use APIs on two hosts of one service, like GitHub's API and upload hosts:
- * `both`'s client sends its tokens to both, and `apionly`'s to the API host only.
- */
-const seedFirstParty = (organization: string, user: string, slug: string, origin: string) =>
-  Effect.gen(function* () {
-    const emulators = yield* Emulators;
-    const suffix = randomUUID().slice(0, 6);
-    const slugs = {
-      google: `google_${suffix}`,
-      github: `github_${suffix}`,
-      elsewhere: `elsewhere_${suffix}`,
-      slack: `slack_${suffix}`,
-      both: `both_${suffix}`,
-      apiOnly: `apionly_${suffix}`,
-      githubMcp: `github_mcp_${suffix}`,
-      mcpElsewhere: `mcp_elsewhere_${suffix}`,
+        },
+      },
+    });
+    // No server declares the variable, so no host can be named.
+    const unresolved = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic unresolved", version: "1" },
+      servers: [{ url: "https://{tenant}.unresolved.example.com/api" }],
+      paths: { "/items": { get: { operationId: "list", tags: ["items"], responses: ok } } },
+    });
+    // Like a vendor specification fetched from its schema URL: no server at any level, and the
+    // integration names no base URL, so v1 sent the bare path and reached no API.
+    const serverless = JSON.stringify({
+      openapi: "3.1.0",
+      info: { title: "Synthetic serverless", version: "1" },
+      paths: { "/api/items/": { get: { operationId: "list", tags: ["items"], responses: ok } } },
+    });
+    // A relative server names no host either.
+    const relative = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic relative", version: "1" },
+      servers: [{ url: "/" }],
+      paths: { "/api/items/": { get: { operationId: "list", tags: ["items"], responses: ok } } },
+    });
+    const downgradedServer = {
+      url: "{scheme}://uploads.downgraded.example.com/uploads",
+      variables: { scheme: { default: "https" } },
     };
-    const githubHosts = v1GitHubHosts(origin);
-    const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
-    const access = (integration: string, name: string) => `oauth:user:${integration}:${name}`;
-    const connections = [
+    const integrations: ReadonlyArray<{
+      readonly slug: string;
+      readonly name: string;
+      readonly text: string;
+      readonly template: ReadonlyArray<unknown>;
+      readonly operations: Record<string, readonly [string, string]>;
+      readonly servers?: Record<string, ReadonlyArray<unknown>>;
+      readonly healthCheck?: unknown;
+      readonly specUrl?: string;
+    }> = [
       {
-        name: "google",
-        integration: slugs.google,
-        client: "v1-google",
-        scope: "openid synthetic.read",
+        slug: `requests_${suffix}`,
+        name: "Requests",
+        text: requests,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "items.list": ["get", "/items"], "items.ping": ["get", "/ping"] },
       },
       {
-        name: "beyond",
-        integration: slugs.google,
-        client: "v1-google",
-        scope: "openid synthetic.admin",
+        slug: `status_${suffix}`,
+        name: "Status",
+        text: status,
+        template: [],
+        operations: { "status.health": ["get", "/health"] },
       },
-      { name: "notion", integration: slugs.google, client: "notion", scope: "" },
-      { name: "github", integration: slugs.github, client: "v1-github", scope: "" },
-      { name: "elsewhere", integration: slugs.elsewhere, client: "v1-github", scope: "" },
-      // Not expired, so no renewal of theirs, which a background job may also start, can
-      // interleave with the others' renewals.
-      { name: "both", integration: slugs.both, client: "v1-github-both", scope: "", live: true },
       {
-        name: "apionly",
-        integration: slugs.apiOnly,
-        client: "v1-github-api",
-        scope: "",
-        live: true,
+        slug: `split_${suffix}`,
+        name: "Split",
+        text: split,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "split.a": ["get", "/a"], "split.b": ["get", "/b"] },
       },
       {
-        name: "slack",
-        integration: slugs.slack,
-        client: "v1-slack",
-        scope: v1SlackScopes.join(" "),
+        slug: `google_${suffix}`,
+        name: "Google APIs",
+        text: google,
+        template: [],
+        operations: {
+          "messages.list": ["get", "/gmail/v1/users/me/messages"],
+          "sheets.get": ["get", "/v4/spreadsheets"],
+        },
       },
-      { name: "github-mcp", integration: slugs.githubMcp, client: "v1-github", scope: "" },
-      { name: "mcp-elsewhere", integration: slugs.mcpElsewhere, client: "v1-github", scope: "" },
-    ];
-    for (const connection of connections) {
-      const item = access(connection.integration, connection.name);
-      yield* emulators.v1VaultObject(
-        vaultName(userScope, item),
-        `synthetic-${connection.name}-access`,
-      );
-      yield* emulators.v1VaultObject(
-        vaultName(userScope, `${item}:refresh`),
-        `synthetic-${connection.name}-refresh`,
-      );
-    }
-    const document = (
-      title: string,
-      server: string,
-      tag: string,
-      path: string,
-      id: string,
-      upload?: string,
-    ) =>
-      JSON.stringify({
-        openapi: "3.0.3",
-        info: { title, version: "1" },
-        servers: [{ url: server }],
-        paths: {
-          [path]: {
-            get: { operationId: id, tags: [tag], responses: { "200": { description: "ok" } } },
-          },
-          // An operation on the service's upload host, as GitHub's release asset upload is.
-          ...(upload === undefined
-            ? {}
-            : {
-                "/asset": {
-                  get: {
-                    operationId: "asset",
-                    tags: [tag],
-                    servers: [{ url: upload }],
-                    responses: { "200": { description: "ok" } },
-                  },
-                },
-              }),
-        },
-      });
-    // v1 asked GitHub's app for no scopes, whatever the method declared.
-    const githubMethod = {
-      authorizationUrl: "https://github.example.com/login/oauth/authorize",
-      tokenUrl: "https://github.example.com/login/oauth/access_token",
-      scopes: ["repo", "user"],
-    };
-    const apis = [
       {
-        slug: slugs.google,
-        name: "Synthetic Google",
-        text: document("Synthetic Google", `${origin}/google/api`, "google", "/me", "me"),
-        operations: [{ tool: "google.me", path: "/me" }],
-        // The endpoints and scopes of v1's catalog method, which its own app replaced.
-        method: {
-          authorizationUrl: "https://accounts.example.com/o/oauth2/v2/auth",
-          tokenUrl: "https://accounts.example.com/token",
-          scopes: ["openid", "synthetic.read"],
-        },
+        slug: `uploads_${suffix}`,
+        name: "Uploads",
+        text: uploads,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
       },
-      ...[
-        { slug: slugs.github, name: "Synthetic GitHub", server: `${origin}/github/api` },
-        {
-          slug: slugs.elsewhere,
-          name: "GitHub elsewhere",
-          // The same service under another host name, which the client does not pin.
-          server: `${origin.replace("127.0.0.1", "localhost")}/github/api`,
+      {
+        slug: `mixed_${suffix}`,
+        name: "Mixed",
+        text: mixed,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
+      },
+      {
+        slug: `downgraded_${suffix}`,
+        name: "Downgraded",
+        text: downgraded,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "repos.get": ["get", "/repos"], "assets.upload": ["get", "/assets"] },
+        servers: { "assets.upload": [downgradedServer] },
+        healthCheck: {
+          operation: "assets.upload",
+          args: { server: { url: downgradedServer.url, variables: { scheme: "http" } } },
         },
-      ].map((api) => ({
-        slug: api.slug,
-        name: api.name,
-        text: document(api.name, api.server, "github", "/user", "user"),
-        operations: [{ tool: "github.user", path: "/user" }],
-        method: githubMethod,
-      })),
-      ...[
-        { slug: slugs.both, name: "GitHub two hosts", client: "github-both" },
-        { slug: slugs.apiOnly, name: "GitHub one host", client: "github-api" },
-      ].map((api) => ({
-        slug: api.slug,
-        name: api.name,
-        text: document(
-          api.name,
-          `http://${githubHosts.api}/${api.client}/api`,
-          "github",
-          "/user",
-          "user",
-          `http://${githubHosts.uploads}/${api.client}/uploads`,
-        ),
-        operations: [
-          { tool: "github.user", path: "/user" },
-          { tool: "github.asset", path: "/asset" },
+      },
+      {
+        slug: `regional_${suffix}`,
+        name: "Regional",
+        text: regional,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
         ],
-        method: githubMethod,
-      })),
+        operations: { "items.list": ["get", "/items"], "items.models": ["get", "/models"] },
+      },
+      {
+        slug: `layered_${suffix}`,
+        name: "Layered",
+        text: layered,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "items.list": ["get", "/items"] },
+      },
+      {
+        slug: `unresolved_${suffix}`,
+        name: "Unresolved",
+        text: unresolved,
+        template: [],
+        operations: { "items.list": ["get", "/items"] },
+      },
+      {
+        slug: `serverless_${suffix}`,
+        name: "Serverless",
+        text: serverless,
+        template: [
+          { slug: "", kind: "apikey", placements: [{ carrier: "header", name: "X-Api-Key" }] },
+        ],
+        operations: { "items.list": ["get", "/api/items/"] },
+        // A schema URL can carry a key in its host, path or query, so the reason never names it.
+        specUrl:
+          "https://synthetic-host-secret.app.serverless.example.com/api/synthetic-path-secret/schema/?token=synthetic-schema-token",
+      },
+      {
+        slug: `relative_${suffix}`,
+        name: "Relative",
+        text: relative,
+        template: [],
+        operations: { "items.list": ["get", "/api/items/"] },
+        specUrl: "https://app.relative.example.com/api/schema/",
+      },
     ];
     const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
     yield* writeRows("v1-database.json", [
       row(
         "insert into organizations (id, name, slug) values ($1, $2, $3)",
         organization,
-        "Synthetic first-party workspace",
+        "Synthetic requests workspace",
         slug,
       ),
-      ...apis.flatMap((api) => {
-        const hash = createHash("sha256").update(api.text).digest("hex");
+      ...integrations.flatMap((integration) => {
+        const hash = createHash("sha256").update(integration.text).digest("hex");
         return [
           row(
-            "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
+            "insert into integration (tenant, slug, plugin_id, name, config, health_check) values ($1, $2, 'openapi', $3, $4::json, nullif($5, '')::json)",
             organization,
-            api.slug,
-            api.name,
+            integration.slug,
+            integration.name,
             JSON.stringify({
               specHash: hash,
-              authenticationTemplate: [{ slug: "oauth2", kind: "oauth2", ...api.method }],
+              ...(integration.specUrl === undefined ? {} : { specUrl: integration.specUrl }),
+              authenticationTemplate: integration.template,
             }),
+            integration.healthCheck === undefined ? "" : JSON.stringify(integration.healthCheck),
           ),
           row(
             "insert into blob (namespace, key, value) values ($1, $2, $3)",
             `o:${organization}/openapi`,
             `spec/${hash}`,
-            api.text,
+            integration.text,
           ),
-          ...api.operations.map((operation) =>
+          ...Object.entries(integration.operations).map(([tool, [method, path]]) =>
             row(
               "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
               organization,
-              `op.${api.slug}.${operation.tool}`,
+              `op.${integration.slug}.${tool}`,
               JSON.stringify({
-                integration: api.slug,
-                toolName: operation.tool,
-                binding: { method: "get", pathTemplate: operation.path },
+                integration: integration.slug,
+                toolName: tool,
+                binding: {
+                  method,
+                  pathTemplate: path,
+                  ...(integration.servers?.[tool] === undefined
+                    ? {}
+                    : { servers: integration.servers[tool], parameters: [] }),
+                },
               }),
             ),
           ),
         ];
       }),
+      // v1 accepted a method without a slug.
+      ...[
+        [`requests_${suffix}`, keyItem],
+        [`uploads_${suffix}`, uploadsKeyItem],
+        [`mixed_${suffix}`, mixedKeyItem],
+        [`split_${suffix}`, splitKeyItem],
+        [`downgraded_${suffix}`, downgradedKeyItem],
+        [`regional_${suffix}`, regionalKeyItem],
+        [`layered_${suffix}`, layeredKeyItem],
+      ].map(([integration, item]) =>
+        row(
+          "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'main', '', $4::json)",
+          organization,
+          user,
+          integration ?? "",
+          JSON.stringify({ token: item }),
+        ),
+      ),
+    ]);
+  });
+
+/** A workspace with only a public API, which imports completely. */
+const seedPublic = (organization: string, slug: string, origin: string) =>
+  Effect.gen(function* () {
+    const text = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic status", version: "1" },
+      servers: [{ url: `${origin}/public` }],
+      paths: {
+        "/health": {
+          get: {
+            operationId: "health",
+            tags: ["status"],
+            responses: { "200": { description: "ok" } },
+          },
+        },
+      },
+    });
+    const hash = createHash("sha256").update(text).digest("hex");
+    const integration = `status_${randomUUID().slice(0, 6)}`;
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    yield* writeRows("v1-database.json", [
       row(
-        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Synthetic Slack', $3::json)",
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
         organization,
-        slugs.slack,
-        JSON.stringify({
-          transport: "remote",
-          endpoint: `${origin}/slack/mcp`,
-          remoteTransport: "auto",
-          authenticationTemplate: [{ slug: "oauth2", kind: "oauth2" }],
-        }),
+        "Synthetic complete workspace",
+        slug,
       ),
       row(
-        "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'user', $2, $3, 'slack', 'mcp', 'whoami', $4::json)",
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Status', $3::json)",
         organization,
-        user,
-        slugs.slack,
-        JSON.stringify({ mcp: { toolName: "whoami" } }),
+        integration,
+        JSON.stringify({ specHash: hash, authenticationTemplate: [] }),
+      ),
+      row(
+        "insert into blob (namespace, key, value) values ($1, $2, $3)",
+        `o:${organization}/openapi`,
+        `spec/${hash}`,
+        text,
+      ),
+      row(
+        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+        organization,
+        `op.${integration}.status.health`,
+        JSON.stringify({
+          integration,
+          toolName: "status.health",
+          binding: { method: "get", pathTemplate: "/health" },
+        }),
       ),
-      // GitHub's MCP server, and the same server under another host name, which the GitHub
-      // client does not pin.
-      ...[
-        {
-          slug: slugs.githubMcp,
-          name: "Synthetic GitHub MCP",
-          connection: "github-mcp",
-          endpoint: `${origin}/github/mcp`,
-        },
-        {
-          slug: slugs.mcpElsewhere,
-          name: "GitHub MCP elsewhere",
-          connection: "mcp-elsewhere",
-          endpoint: `${origin.replace("127.0.0.1", "localhost")}/github/mcp`,
-        },
-      ].flatMap((server) => [
-        row(
-          "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', $3, $4::json)",
-          organization,
-          server.slug,
-          server.name,
-          JSON.stringify({
-            transport: "remote",
-            endpoint: server.endpoint,
-            remoteTransport: "auto",
-            authenticationTemplate: [{ slug: "oauth2", kind: "oauth2" }],
-          }),
-        ),
-        row(
-          "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'user', $2, $3, $4, 'mcp', 'whoami', $5::json)",
-          organization,
-          user,
-          server.slug,
-          server.connection,
-          JSON.stringify({ mcp: { toolName: "whoami" } }),
-        ),
-      ]),
-      ...connections.map((connection) => {
-        const item = access(connection.integration, connection.name);
-        return row(
-          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, refresh_item_id, expires_at, oauth_scope) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, $7, $8::bigint, nullif($9, ''))",
-          organization,
-          user,
-          connection.integration,
-          connection.name,
-          JSON.stringify({ token: item }),
-          `first-party:${connection.client}`,
-          `${item}:refresh`,
-          // Expired, so the first call renews it, unless it is live for another day.
-          String("live" in connection ? Date.now() + 86_400_000 : Date.now() - 60_000),
-          connection.scope,
-        );
-      }),
     ]);
   });
 
-/** Text with Latin-1, punctuation, symbols and an emoji: everything an API's prose uses. */
-const wideText = "Returns the service’s “health” — café → ✅ or 🔴.";
+/**
+ * A synthetic OAuth service: two token endpoints, as two v1 clients named, that renew any refresh
+ * token, and an API (`GET /api/me`) that answers only the renewed access token. It records each
+ * token request's path, client authentication and form, and each API request's authorization.
+ * Behind a gateway (`GET /gated/me`), it records the token and the gateway's and client's
+ * credential headers each request brought.
+ */
+const oauthService = Effect.gen(function* () {
+  const renewedToken = "synthetic-renewed-access-token";
+  const tokens = yield* Ref.make<
+    ReadonlyArray<{ path: string; authorization: string | undefined; form: URLSearchParams }>
+  >([]);
+  const calls = yield* Ref.make<ReadonlyArray<string | undefined>>([]);
+  const gated = yield* Ref.make<ReadonlyArray<Readonly<Record<string, string | undefined>>>>([]);
+  const token = Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
+    yield* Ref.update(tokens, (all) => [
+      ...all,
+      {
+        path: new URL(request.url, "http://service").pathname,
+        authorization: request.headers.authorization,
+        form,
+      },
+    ]);
+    return yield* HttpServerResponse.json({
+      access_token: renewedToken,
+      token_type: "Bearer",
+      expires_in: 3600,
+    });
+  });
+  const routes = Layer.mergeAll(
+    HttpRouter.add("POST", "/token", token),
+    HttpRouter.add("POST", "/other/token", token),
+    HttpRouter.add(
+      "GET",
+      "/api/me",
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        yield* Ref.update(calls, (all) => [...all, request.headers.authorization]);
+        return request.headers.authorization === `Bearer ${renewedToken}`
+          ? yield* HttpServerResponse.json({ email: "mail-member@example.test" })
+          : yield* HttpServerResponse.json({ error: "unauthenticated" }, { status: 401 });
+      }),
+    ),
+    HttpRouter.add(
+      "GET",
+      "/gated/me",
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        yield* Ref.update(gated, (all) => [
+          ...all,
+          Object.fromEntries(
+            [
+              "authorization",
+              "cf-access-client-id",
+              "cf-access-client-secret",
+              "client_id",
+              "client_secret",
+            ].map((name) => [name, request.headers[name]] as const),
+          ),
+        ]);
+        return yield* HttpServerResponse.json({ email: "gated-member@example.test" });
+      }),
+    ),
+  );
+  const services = yield* Layer.build(
+    HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+      Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
+    ),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return {
+    origin: `http://127.0.0.1:${server.address.port}`,
+    renewedToken,
+    tokens: Ref.get(tokens),
+    calls: Ref.get(calls),
+    gated: Ref.get(gated),
+  };
+});
 
-/** A display name and base URL path beyond Latin-1, which a JavaScript string stores two bytes wide. */
-const wideName = "Kanji 日本 API";
-const widePath = "/public/日本";
+/** A request's query or form, as the ordered parameters a server reads. */
+type Parameters = ReadonlyArray<readonly [string, string]>;
 
 /**
- * An 81-byte YAML specification whose `version` is indented deeper than its sibling `title`. Its
- * title holds a literal U+FFFD, which is valid UTF-8.
+ * A synthetic authorization server at any path. `GET …/authorize` records the parameters the
+ * browser brought and returns to their `redirect_uri` with a code; `POST …/token` records the form
+ * and issues a token.
  */
-const unreadableYaml = `openapi: 3.0.3
-info:
-  title: Synthetic \uFFFD unreadable
-   version: "1"
-paths: {}
-`;
+const signInService = Effect.gen(function* () {
+  const authorizations = yield* Ref.make<ReadonlyArray<{ path: string; query: Parameters }>>([]);
+  const tokens = yield* Ref.make<ReadonlyArray<{ path: string; form: Parameters }>>([]);
+  const routes = HttpRouter.add(
+    "*",
+    "/*",
+    Effect.gen(function* () {
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const url = new URL(request.url, "http://sign-in");
+      if (request.method === "GET" && url.pathname.endsWith("/authorize")) {
+        yield* Ref.update(authorizations, (all) => [
+          ...all,
+          { path: url.pathname, query: [...url.searchParams] },
+        ]);
+        const callback = URL.parse(url.searchParams.get("redirect_uri") ?? "");
+        if (callback === null) return HttpServerResponse.empty({ status: 400 });
+        callback.searchParams.set("code", "synthetic-code");
+        callback.searchParams.set("state", url.searchParams.get("state") ?? "");
+        return HttpServerResponse.redirect(callback.href, { status: 302 });
+      }
+      if (request.method === "POST" && url.pathname.endsWith("/token")) {
+        const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
+        yield* Ref.update(tokens, (all) => [...all, { path: url.pathname, form: [...form] }]);
+        return yield* HttpServerResponse.json({
+          access_token: "synthetic-reconnected-access",
+          refresh_token: "synthetic-reconnected-refresh",
+          token_type: "Bearer",
+          expires_in: 3600,
+        });
+      }
+      return HttpServerResponse.empty({ status: 404 });
+    }),
+  );
+  const services = yield* Layer.build(
+    HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+      Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
+    ),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return {
+    origin: `http://127.0.0.1:${server.address.port}`,
+    authorizations: Ref.get(authorizations),
+    tokens: Ref.get(tokens),
+  };
+});
+
+/** Each parameter by name, and how many times the request named each one. */
+const parameterRecord = (parameters: Parameters) => ({
+  values: Object.fromEntries(parameters),
+  names: parameters.map(([name]) => name).toSorted(),
+});
 
 /**
- * Four OpenAPI integrations and a GraphQL one. `Typography`'s document describes its one public
- * operation in `wideText`. `Kanji 日本 API` has a document as large as the largest imported vendor
- * API's, a base URL whose path goes beyond Latin-1 and an API key the user saved in v1. `Scoped`
- * signs in through a v1 client whose authorization URL sets `scope` itself, which v2's OAuth
- * declarations keep to the host. `Unreadable`'s stored specification is YAML no parser reads.
- * `Synthetic GraphQL` is shaped like a Linear GraphQL integration: an OAuth method that names no
- * endpoints and no scopes, so each connection signs in at its own client with the scopes that
- * client's authorization URL sets, and an API key sent bare in `Authorization`. `main`'s client asks
- * for comma-separated scopes, `tabbed`'s for a scope holding a tab, `blank`'s for an empty scope,
- * `doubled`'s for two scopes two spaces apart, `nonced`'s also sets `nonce`, `repeated`'s sets
- * `scope` twice and `targeted`'s sets a `resource` its client does not name; `key` holds the API
- * key. Every client signs in at `signIn`.
+ * An OpenAPI integration whose OAuth method, like v1's Outlook preset, declares no authorization
+ * URL, endpoints and scopes no client uses, and a second method under the same slug. Each connection signed in through its own v1 client:
+ * `renewed` through a confidential client with a resource, with granted scopes and an expired
+ * token; `second` through a public client at other endpoints; `untrusted` recorded a token
+ * endpoint v1 no longer trusted.
+ *
+ * Two more OAuth APIs send fixed credentials beside the token. `Gated mail` sits behind a
+ * gateway that takes its own client ID and secret, which v2 keeps in a second account. `Pasted
+ * mail` sends its OAuth client's own ID and secret as headers, which its sign-in already sends.
  */
-const seedBuilds = (
+const seedRenewal = (
   organization: string,
   user: string,
   slug: string,
   origin: string,
-  signIn: string,
+  // Another organization's seed gives the same integrations and OAuth clients the same names.
+  suffix = randomUUID().slice(0, 6),
 ) =>
   Effect.gen(function* () {
     const emulators = yield* Emulators;
-    const suffix = randomUUID().slice(0, 6);
-    const typography = `typography_${suffix}`;
-    const kanji = `kanji_${suffix}`;
-    const scoped = `scoped_${suffix}`;
-    const unreadable = `unreadable_${suffix}`;
-    const graphql = `graphql_${suffix}`;
+    const mail = `mail_${suffix}`;
     const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
-    const key = `connection:user:${kanji}:main:token`;
-    yield* emulators.v1VaultObject(vaultName(userScope, key), "synthetic-kanji-key");
-    const access = `oauth:user:${scoped}:main`;
-    yield* emulators.v1VaultObject(vaultName(userScope, access), "synthetic-scoped-access");
+    const orgScope = `executor/org/${encodeURIComponent(organization)}`;
+    const access = (name: string) => `oauth:user:${mail}:${name}`;
+    const refresh = (name: string) => `${access(name)}:refresh`;
+    const secret = `oauth-client:org:${mail}-confidential:secret`;
+    for (const name of ["renewed", "second", "untrusted"]) {
+      yield* emulators.v1VaultObject(
+        vaultName(userScope, access(name)),
+        `synthetic-${name}-access`,
+      );
+      yield* emulators.v1VaultObject(
+        vaultName(userScope, refresh(name)),
+        `synthetic-${name}-refresh`,
+      );
+    }
+    yield* emulators.v1VaultObject(vaultName(orgScope, secret), "synthetic-confidential-secret");
+    const gated = `gated_${suffix}`;
+    const pasted = `pasted_${suffix}`;
+    const pastedSecret = `oauth-client:org:${pasted}:secret`;
+    yield* emulators.v1VaultObject(vaultName(userScope, access("gated")), "synthetic-gated-access");
     yield* emulators.v1VaultObject(
-      vaultName(userScope, `${access}:refresh`),
-      "synthetic-scoped-refresh",
-    );
-    const graphqlAccess = `oauth:user:${graphql}:main`;
-    const graphqlNonced = `oauth:user:${graphql}:nonced`;
-    const graphqlKey = `connection:user:${graphql}:key:token`;
-    for (const [item, value] of [
-      [graphqlAccess, "synthetic-graphql-access"],
-      [`${graphqlAccess}:refresh`, "synthetic-graphql-refresh"],
-      [graphqlNonced, "synthetic-graphql-nonced-access"],
-      [graphqlKey, "synthetic-graphql-key"],
-      ...["tabbed", "repeated", "blank", "doubled", "targeted"].map(
-        (name) => [`oauth:user:${graphql}:${name}`, `synthetic-graphql-${name}-access`] as const,
-      ),
-    ] as const)
-      yield* emulators.v1VaultObject(vaultName(userScope, item), value);
-    const document = (title: string, tag: string, path: string, description: string) =>
-      JSON.stringify({
-        openapi: "3.0.3",
-        info: { title, version: "1" },
-        servers: [{ url: `${origin}/public` }],
-        paths: {
-          [path]: {
-            get: {
-              operationId: "health",
-              tags: [tag],
-              description,
-              responses: { "200": { description: "ok" } },
-            },
-          },
+      vaultName(userScope, access("pasted")),
+      "synthetic-pasted-access",
+    );
+    yield* emulators.v1VaultObject(
+      vaultName(orgScope, pastedSecret),
+      "synthetic-pasted-secret-0123456789",
+    );
+    const document = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic mail", version: "1" },
+      servers: [{ url: `${origin}/api` }],
+      paths: {
+        "/me": {
+          get: { operationId: "me", tags: ["mail"], responses: { "200": { description: "ok" } } },
         },
-      });
-    const large = largeOpenapiDocument(origin, 1000, wideText);
-    const integrations: ReadonlyArray<{
-      readonly slug: string;
-      readonly name: string;
-      readonly text: string;
-      readonly config: Readonly<Record<string, string>>;
-      readonly template: ReadonlyArray<unknown>;
-      /** Each v1 tool: its name, method and path. */
-      readonly operations: ReadonlyArray<readonly [string, string, string]>;
-    }> = [
-      {
-        slug: typography,
-        name: "Typography",
-        text: document("Synthetic typography", "typography", "/health", wideText),
-        config: {},
-        template: [],
-        operations: [["typography.health", "get", "/health"]],
-      },
-      {
-        slug: kanji,
-        name: wideName,
-        text: JSON.stringify(large),
-        config: { baseUrl: `${origin}${widePath}` },
-        template: [
-          {
-            slug: "apikey-0",
-            kind: "apikey",
-            placements: [{ carrier: "header", name: "X-Api-Key" }],
-          },
-        ],
-        // v1 listed every operation, so the app keeps the whole document.
-        operations: Object.entries(large.paths).flatMap(([path, item]) =>
-          Object.entries(item).map(([method, operation]) => [
-            path === "/health" ? "service.health" : `large.${String(operation.operationId)}`,
-            method,
-            path,
-          ]),
-        ),
-      },
-      {
-        slug: scoped,
-        name: "Scoped",
-        text: document("Synthetic scoped", "scoped", "/me", "ok"),
-        config: {},
-        template: [
-          {
-            slug: "oauth2",
-            kind: "oauth2",
-            authorizationUrl: `${signIn}/authorize?scope=everything%20profile`,
-            tokenUrl: `${signIn}/token`,
-            scopes: [],
-          },
-        ],
-        operations: [["scoped.health", "get", "/me"]],
       },
-      {
-        slug: unreadable,
-        name: "Unreadable",
-        text: unreadableYaml,
-        config: {},
-        template: [],
-        operations: [["unreadable.health", "get", "/health"]],
+    });
+    const hash = createHash("sha256").update(document).digest("hex");
+    const gatedDocument = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Synthetic gated mail", version: "1" },
+      servers: [{ url: `${origin}/gated` }],
+      paths: {
+        "/me": {
+          get: { operationId: "me", tags: ["mail"], responses: { "200": { description: "ok" } } },
+        },
       },
-    ];
+    });
+    const gatedHash = createHash("sha256").update(gatedDocument).digest("hex");
     const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
-    yield* writeRows("v1-database.json", [
+    /** An OAuth API behind the gated document, whose configuration sends fixed headers. */
+    const fixedApi = (slug: string, name: string, headers: Record<string, string>) => [
       row(
-        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
         organization,
-        "Synthetic builds workspace",
         slug,
+        name,
+        JSON.stringify({
+          specHash: gatedHash,
+          headers,
+          authenticationTemplate: [
+            { slug: "oauth2", kind: "oauth2", authorizationUrl: "", tokenUrl: "", scopes: [] },
+          ],
+        }),
       ),
-      ...integrations.flatMap((integration) => {
-        const hash = createHash("sha256").update(integration.text).digest("hex");
-        return [
-          row(
-            "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
-            organization,
-            integration.slug,
-            integration.name,
-            JSON.stringify({
-              specHash: hash,
-              ...integration.config,
-              authenticationTemplate: integration.template,
-            }),
-          ),
-          row(
-            "insert into blob (namespace, key, value) values ($1, $2, $3)",
-            `o:${organization}/openapi`,
-            `spec/${hash}`,
-            integration.text,
-          ),
-          ...integration.operations.map(([tool, method, path]) =>
-            row(
-              "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
-              organization,
-              `op.${integration.slug}.${tool}`,
-              JSON.stringify({
-                integration: integration.slug,
-                toolName: tool,
-                binding: { method, pathTemplate: path },
-              }),
-            ),
-          ),
-        ];
-      }),
       row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'main', 'apikey-0', $4::json)",
+        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
         organization,
-        user,
-        kanji,
-        JSON.stringify({ token: key }),
+        `op.${slug}.mail.me`,
+        JSON.stringify({
+          integration: slug,
+          toolName: "mail.me",
+          binding: { method: "get", pathTemplate: "/me" },
+        }),
       ),
+    ];
+    const client = (
+      name: string,
+      authorize: string,
+      token: string,
+      resource: string | null,
+      secretItem: string | null,
+    ) =>
       row(
-        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, token_endpoint_auth_method, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', 'synthetic-scoped-client', 'basic', 'manual')",
+        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, client_secret_item_id, token_endpoint_auth_method, resource, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', $5, nullif($6, ''), 'basic', nullif($7, ''), 'manual')",
         organization,
-        `${scoped}-client`,
-        `${signIn}/authorize?scope=everything%20profile`,
-        `${signIn}/token`,
-      ),
+        `${mail}-${name}`,
+        authorize,
+        token,
+        `synthetic-${name}-client`,
+        secretItem ?? "",
+        resource ?? "",
+      );
+    const connection = (
+      name: string,
+      clientName: string,
+      expiresAt: number,
+      scope: string | null,
+      tokenUrl: string | null,
+    ) =>
       row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at) values ($1, 'user', $2, $3, 'main', 'oauth2', $4::json, $5, 'org', $6, $7::bigint)",
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope, oauth_token_url) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'org', $7, $8::bigint, nullif($9, ''), nullif($10, ''))",
         organization,
         user,
-        scoped,
-        JSON.stringify({ token: access }),
-        `${scoped}-client`,
-        `${access}:refresh`,
-        String(Date.now() + 3_600_000),
+        mail,
+        name,
+        JSON.stringify({ token: access(name) }),
+        `${mail}-${clientName}`,
+        refresh(name),
+        String(expiresAt),
+        scope ?? "",
+        tokenUrl ?? "",
+      );
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        organization,
+        "Synthetic mail workspace",
+        slug,
       ),
       row(
-        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'graphql', $3, $4::json)",
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', 'Mail', $3::json)",
         organization,
-        graphql,
-        "Synthetic GraphQL",
+        mail,
         JSON.stringify({
-          endpoint: `${origin}/graphql`,
-          name: "Synthetic GraphQL",
+          specHash: hash,
           authenticationTemplate: [
-            { kind: "oauth2", slug: "oauth2" },
             {
-              slug: "apiKey",
-              kind: "apikey",
-              label: "Synthetic API key",
-              placements: [{ carrier: "header", name: "Authorization" }],
+              slug: "oauth2",
+              kind: "oauth2",
+              authorizationUrl: "",
+              tokenUrl: "https://method.example.com/token",
+              scopes: ["method.scope"],
             },
+            // A specification with both OAuth flows gave v1 two methods under one slug; v1 used
+            // the first.
+            { slug: "oauth2", kind: "oauth2", authorizationUrl: "", tokenUrl: "", scopes: [] },
           ],
         }),
       ),
       row(
-        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'org', '', 'graphql-oauth', $2, $3, 'authorization_code', 'synthetic-graphql-client', 'manual')",
-        organization,
-        `${signIn}/oauth/authorize?scope=read,write`,
-        `${signIn}/oauth/token`,
+        "insert into blob (namespace, key, value) values ($1, $2, $3)",
+        `o:${organization}/openapi`,
+        `spec/${hash}`,
+        document,
       ),
       row(
-        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'user', $2, 'graphql-oauth', $3, $4, 'authorization_code', 'synthetic-graphql-nonced-client', 'manual')",
+        "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
         organization,
-        user,
-        `${signIn}/oauth/authorize?scope=read&nonce=synthetic`,
-        `${signIn}/oauth/token`,
+        `op.${mail}.mail.me`,
+        JSON.stringify({
+          integration: mail,
+          toolName: "mail.me",
+          binding: { method: "get", pathTemplate: "/me" },
+        }),
       ),
-      ...(
-        [
-          ["tabbed", "scope=read%09write"],
-          ["repeated", "scope=read&scope=write"],
-          ["blank", "scope="],
-          ["doubled", "scope=read%20%20write"],
-          ["targeted", `scope=read&resource=${encodeURIComponent(`${signIn}/graphql`)}`],
-        ] as const
-      ).flatMap(([name, query]) => [
-        row(
-          "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'user', $2, $3, $4, $5, 'authorization_code', $6, 'manual')",
-          organization,
-          user,
-          `graphql-${name}`,
-          `${signIn}/oauth/authorize?${query}`,
-          `${signIn}/oauth/token`,
-          `synthetic-graphql-${name}-client`,
-        ),
-        row(
-          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'user')",
-          organization,
-          user,
-          graphql,
-          name,
-          JSON.stringify({ token: `oauth:user:${graphql}:${name}` }),
-          `graphql-${name}`,
-        ),
-      ]),
-      row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope) values ($1, 'user', $2, $3, 'main', 'oauth2', $4::json, 'graphql-oauth', 'org', $5, $6::bigint, 'read,write')",
-        organization,
-        user,
-        graphql,
-        JSON.stringify({ token: graphqlAccess }),
-        `${graphqlAccess}:refresh`,
-        String(Date.now() + 3_600_000),
+      client("confidential", `${origin}/authorize`, `${origin}/token`, `${origin}/api`, secret),
+      client("public", `${origin}/other/authorize`, `${origin}/other/token`, null, null),
+      // Expired, so the first call renews it.
+      connection(
+        "renewed",
+        "confidential",
+        Date.now() - 60_000,
+        "mail.read  offline_access",
+        `${origin}/token`,
       ),
+      connection("second", "public", Date.now() + 3_600_000, null, null),
       row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner) values ($1, 'user', $2, $3, 'nonced', 'oauth2', $4::json, 'graphql-oauth', 'user')",
-        organization,
-        user,
-        graphql,
-        JSON.stringify({ token: graphqlNonced }),
+        "insert into blob (namespace, key, value) values ($1, $2, $3)",
+        `o:${organization}/openapi`,
+        `spec/${gatedHash}`,
+        gatedDocument,
       ),
+      ...fixedApi(gated, "Gated mail", {
+        "CF-Access-Client-Id": "synthetic0gateway1client2id.access",
+        "CF-Access-Client-Secret": "synthetic-gateway-secret-0123456789",
+      }),
+      ...fixedApi(pasted, "Pasted mail", {
+        CLIENT_ID: "synthetic-pasted-client-0123456789",
+        CLIENT_SECRET: "synthetic-pasted-secret-0123456789",
+      }),
       row(
-        "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'key', 'apiKey', $4::json)",
+        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, client_secret_item_id, token_endpoint_auth_method, resource, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', $5, $6, 'body', null, 'manual')",
         organization,
-        user,
-        graphql,
-        JSON.stringify({ token: graphqlKey }),
+        pasted,
+        `${origin}/authorize`,
+        `${origin}/token`,
+        "synthetic-pasted-client-0123456789",
+        pastedSecret,
+      ),
+      ...[
+        [gated, "gated", `${mail}-public`],
+        [pasted, "pasted", pasted],
+      ].map(([integration, name, oauthClient]) =>
+        row(
+          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, expires_at) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'org', $7::bigint)",
+          organization,
+          user,
+          integration ?? "",
+          name ?? "",
+          JSON.stringify({ token: access(name ?? "") }),
+          oauthClient ?? "",
+          String(Date.now() + 3_600_000),
+        ),
+      ),
+      connection(
+        "untrusted",
+        "confidential",
+        Date.now() + 3_600_000,
+        null,
+        "https://elsewhere.example.com/token",
       ),
     ]);
   });
 
-/** A workspace with one rule for a removed integration and one toolkit that grants nothing. */
-const seedPlainWorkspace = (organization: string, slug: string) =>
-  writeRows("v1-database.json", [
-    {
-      sql: "insert into organizations (id, name, slug) values ($1, $2, $3)",
-      params: [organization, "Synthetic plain workspace", slug],
-    },
-    {
-      sql: "insert into tool_policy (tenant, owner, subject, pattern, action) values ($1, 'org', '', 'removed_service.*', 'block')",
-      params: [organization],
-    },
-    {
-      sql: "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'toolkits', 'toolkits', 'tk_1', $2::json)",
-      params: [organization, JSON.stringify({ id: "tk_1", name: "Support", slug: "support" })],
-    },
-  ]);
+/**
+ * The loopback service behind the clients v1's first-party connections move to
+ * (`v1FirstPartyClients`), on the port this Cloud's operator settings name. Each client's token
+ * endpoint renews any refresh token, Slack's under `authed_user` with its scopes comma-separated.
+ * Each API answers only its client's renewed access token: Google's and GitHub's OpenAPI
+ * operations, Slack's MCP server, and an MCP server shaped as GitHub's, which names the GitHub
+ * client's endpoints under its own issuer path and advertises scopes the client does not allow.
+ * Each MCP server challenges any other request with its resource metadata, on whichever host the
+ * request named. The two GitHub-shaped clients that send tokens to `v1GitHubHosts` each have an
+ * API and an upload path. It records each token request's client, path and form, and each API
+ * request's host, path and authorization.
+ */
+const firstPartyService = (port: number) =>
+  Effect.gen(function* () {
+    const origin = `http://127.0.0.1:${port}`;
+    const renewed = (client: string) => `synthetic-renewed-${client}-token`;
+    const tokens = yield* Ref.make<ReadonlyArray<{ path: string; form: URLSearchParams }>>([]);
+    const calls = yield* Ref.make<
+      ReadonlyArray<{ host?: string; path: string; authorization?: string }>
+    >([]);
+    const recordCall = Effect.gen(function* () {
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const path = new URL(request.url, origin).pathname;
+      const { authorization, host } = request.headers;
+      yield* Ref.update(calls, (all) => [
+        ...all,
+        {
+          ...(host === undefined ? {} : { host }),
+          path,
+          ...(authorization === undefined ? {} : { authorization }),
+        },
+      ]);
+      return authorization;
+    });
+    type Client = "google" | "github" | "slack" | "github-both" | "github-api";
+    const token = (client: Client) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const form = new URLSearchParams(yield* request.text.pipe(Effect.orElseSucceed(() => "")));
+        yield* Ref.update(tokens, (all) => [...all, { path: `/${client}/token`, form }]);
+        const issued = { access_token: renewed(client), token_type: "Bearer", expires_in: 3600 };
+        return yield* HttpServerResponse.json(
+          client === "slack"
+            ? {
+                ok: true,
+                authed_user: {
+                  ...issued,
+                  refresh_token: "synthetic-rotated-slack-refresh",
+                  scope: v1SlackScopes.join(","),
+                },
+              }
+            : client === "google"
+              ? { ...issued, scope: form.get("scope") ?? "" }
+              : issued,
+        );
+      });
+    /** An API that answers `accepted`, by default its client's renewed access token. */
+    const api = (client: Exclude<Client, "slack">, body: object, accepted = renewed(client)) =>
+      Effect.gen(function* () {
+        const authorization = yield* recordCall;
+        return authorization === `Bearer ${accepted}`
+          ? yield* HttpServerResponse.json(body)
+          : yield* HttpServerResponse.json({ error: "unauthenticated" }, { status: 401 });
+      });
+    /** This service's origin under the host the request named. */
+    const requested = Effect.map(
+      HttpServerRequest.HttpServerRequest,
+      (request) => `http://${request.headers.host ?? new URL(origin).host}`,
+    );
+    const challenge = (client: "slack" | "github") =>
+      Effect.map(requested, (at) =>
+        HttpServerResponse.empty({
+          status: 401,
+          headers: {
+            "www-authenticate": `Bearer resource_metadata="${at}/.well-known/oauth-protected-resource/${client}/mcp"`,
+          },
+        }),
+      );
+    const mcp = (client: "slack" | "github") =>
+      Effect.gen(function* () {
+        const authorization = yield* recordCall;
+        if (authorization !== `Bearer ${renewed(client)}`) return yield* challenge(client);
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const message = yield* request.json.pipe(
+          Effect.flatMap(
+            Schema.decodeUnknownEffect(
+              Schema.Struct({
+                id: Schema.optional(Schema.Union([Schema.Number, Schema.String])),
+                method: Schema.String,
+              }),
+            ),
+          ),
+          Effect.orDie,
+        );
+        if (message.id === undefined) return HttpServerResponse.empty({ status: 202 });
+        const result =
+          message.method === "initialize"
+            ? {
+                protocolVersion: "2025-03-26",
+                capabilities: { tools: {} },
+                serverInfo: { name: `synthetic-${client}-mcp`, version: "1" },
+              }
+            : message.method === "tools/list"
+              ? {
+                  tools: [
+                    {
+                      name: "whoami",
+                      description: "The signed-in user.",
+                      inputSchema: { type: "object", properties: {} },
+                      annotations: { readOnlyHint: true },
+                    },
+                  ],
+                }
+              : message.method === "tools/call"
+                ? { content: [{ type: "text", text: `synthetic-${client}-member` }] }
+                : undefined;
+        return yield* HttpServerResponse.json({
+          jsonrpc: "2.0",
+          id: message.id,
+          ...(result === undefined
+            ? { error: { code: -32601, message: "Method not found" } }
+            : { result }),
+        });
+      });
+    const mcpGet = (client: "slack" | "github") =>
+      Effect.gen(function* () {
+        const authorization = yield* recordCall;
+        return authorization === `Bearer ${renewed(client)}`
+          ? HttpServerResponse.empty({ status: 405 })
+          : yield* challenge(client);
+      });
+    const routes = Layer.mergeAll(
+      HttpRouter.add("POST", "/google/token", token("google")),
+      HttpRouter.add("POST", "/github/token", token("github")),
+      HttpRouter.add("POST", "/slack/token", token("slack")),
+      // These accounts have not expired, so their APIs answer the access token v1 stored.
+      ...(
+        [
+          ["github-both", "synthetic-both-access"],
+          ["github-api", "synthetic-apionly-access"],
+        ] as const
+      ).flatMap(([client, accepted]) => [
+        HttpRouter.add("POST", `/${client}/token`, token(client)),
+        HttpRouter.add(
+          "GET",
+          `/${client}/api/user`,
+          api(client, { login: "synthetic-member" }, accepted),
+        ),
+        HttpRouter.add(
+          "GET",
+          `/${client}/uploads/asset`,
+          api(client, { uploaded: true }, accepted),
+        ),
+      ]),
+      HttpRouter.add(
+        "GET",
+        "/google/api/me",
+        api("google", { email: "google-member@example.test" }),
+      ),
+      HttpRouter.add("GET", "/github/api/user", api("github", { login: "synthetic-member" })),
+      HttpRouter.add("POST", "/slack/mcp", mcp("slack")),
+      HttpRouter.add("GET", "/slack/mcp", mcpGet("slack")),
+      HttpRouter.add("POST", "/github/mcp", mcp("github")),
+      HttpRouter.add("GET", "/github/mcp", mcpGet("github")),
+      // GitHub's MCP server at a sibling path, whose challenge still names the metadata of the
+      // resource at `/github/mcp`, which a sign-in here cannot use.
+      HttpRouter.add("POST", "/github/mcp-moved", mcp("github")),
+      HttpRouter.add("GET", "/github/mcp-moved", mcpGet("github")),
+      // As GitHub's MCP server: its authorization server is the GitHub client's, under an issuer
+      // path (GitHub's is `https://github.com/login/oauth`), and it advertises scopes a GitHub App,
+      // which has none, never asks for.
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-protected-resource/github/mcp",
+        Effect.map(requested, (at) =>
+          HttpServerResponse.jsonUnsafe({
+            resource: `${at}/github/mcp`,
+            authorization_servers: [`${origin}/github/login/oauth`],
+            scopes_supported: ["repo", "read:org", "gist"],
+            bearer_methods_supported: ["header"],
+          }),
+        ),
+      ),
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-authorization-server/github/login/oauth",
+        HttpServerResponse.json({
+          issuer: `${origin}/github/login/oauth`,
+          authorization_endpoint: `${origin}/github/authorize`,
+          token_endpoint: `${origin}/github/token`,
+          response_types_supported: ["code"],
+          grant_types_supported: ["authorization_code", "refresh_token"],
+          code_challenge_methods_supported: ["S256"],
+          scopes_supported: ["offline_access"],
+        }),
+      ),
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-protected-resource/slack/mcp",
+        HttpServerResponse.json({
+          resource: `${origin}/slack/mcp`,
+          authorization_servers: [origin],
+          scopes_supported: [...v1SlackScopes, "admin"],
+        }),
+      ),
+      HttpRouter.add(
+        "GET",
+        "/.well-known/oauth-authorization-server",
+        HttpServerResponse.json({
+          issuer: origin,
+          authorization_endpoint: `${origin}/slack/authorize`,
+          token_endpoint: `${origin}/slack/token`,
+          code_challenge_methods_supported: ["S256"],
+          token_endpoint_auth_methods_supported: ["client_secret_post"],
+          scopes_supported: [...v1SlackScopes, "admin"],
+        }),
+      ),
+    );
+    yield* Layer.build(
+      HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+        Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port })),
+      ),
+    );
+    return { origin, renewed, tokens: Ref.get(tokens), calls: Ref.get(calls) };
+  });
+
+/**
+ * A workspace whose connections signed in through Executor's own apps, as v1 stored them: no
+ * `oauth_client` row, `first-party:<name>` in their `oauth_client`. Google's and GitHub's are
+ * OpenAPI integrations whose methods declare endpoints and scopes the apps never used; Slack's and
+ * `github-mcp`'s are MCP servers, the latter shaped as GitHub's, which v1 signed in with its GitHub
+ * App. `google`, `github`, `slack` and `github-mcp` have expired, so they renew by their first
+ * calls; the rest have not.
+ * `beyond` was granted a scope the Google client does not allow, `elsewhere` and `mcp-elsewhere`
+ * call a host the GitHub client's tokens never reach, and `notion` signed in through an app v2
+ * does not offer. `wrong-server` signed in with the GitHub App to Slack's MCP server, whose
+ * authorization server is not GitHub's, and `moved` to an MCP server whose resource metadata names
+ * another resource, so neither sign-in can be carried over.
+ * `both` and `apionly` use APIs on two hosts of one service, like GitHub's API and upload hosts:
+ * `both`'s client sends its tokens to both, and `apionly`'s to the API host only.
+ */
+const seedFirstParty = (organization: string, user: string, slug: string, origin: string) =>
+  Effect.gen(function* () {
+    const emulators = yield* Emulators;
+    const suffix = randomUUID().slice(0, 6);
+    const slugs = {
+      google: `google_${suffix}`,
+      github: `github_${suffix}`,
+      elsewhere: `elsewhere_${suffix}`,
+      slack: `slack_${suffix}`,
+      both: `both_${suffix}`,
+      apiOnly: `apionly_${suffix}`,
+      githubMcp: `github_mcp_${suffix}`,
+      mcpElsewhere: `mcp_elsewhere_${suffix}`,
+      wrongServer: `wrong_server_${suffix}`,
+      moved: `moved_${suffix}`,
+    };
+    const githubHosts = v1GitHubHosts(origin);
+    const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
+    const access = (integration: string, name: string) => `oauth:user:${integration}:${name}`;
+    const connections = [
+      {
+        name: "google",
+        integration: slugs.google,
+        client: "v1-google",
+        scope: "openid synthetic.read",
+      },
+      {
+        name: "beyond",
+        integration: slugs.google,
+        client: "v1-google",
+        scope: "openid synthetic.admin",
+      },
+      { name: "notion", integration: slugs.google, client: "notion", scope: "" },
+      { name: "github", integration: slugs.github, client: "v1-github", scope: "" },
+      { name: "elsewhere", integration: slugs.elsewhere, client: "v1-github", scope: "" },
+      // Not expired, so no renewal of theirs, which a background job may also start, can
+      // interleave with the others' renewals.
+      { name: "both", integration: slugs.both, client: "v1-github-both", scope: "", live: true },
+      {
+        name: "apionly",
+        integration: slugs.apiOnly,
+        client: "v1-github-api",
+        scope: "",
+        live: true,
+      },
+      {
+        name: "slack",
+        integration: slugs.slack,
+        client: "v1-slack",
+        scope: v1SlackScopes.join(" "),
+      },
+      { name: "github-mcp", integration: slugs.githubMcp, client: "v1-github", scope: "" },
+      { name: "mcp-elsewhere", integration: slugs.mcpElsewhere, client: "v1-github", scope: "" },
+      { name: "wrong-server", integration: slugs.wrongServer, client: "v1-github", scope: "" },
+      { name: "moved", integration: slugs.moved, client: "v1-github", scope: "" },
+    ];
+    for (const connection of connections) {
+      const item = access(connection.integration, connection.name);
+      yield* emulators.v1VaultObject(
+        vaultName(userScope, item),
+        `synthetic-${connection.name}-access`,
+      );
+      yield* emulators.v1VaultObject(
+        vaultName(userScope, `${item}:refresh`),
+        `synthetic-${connection.name}-refresh`,
+      );
+    }
+    const document = (
+      title: string,
+      server: string,
+      tag: string,
+      path: string,
+      id: string,
+      upload?: string,
+    ) =>
+      JSON.stringify({
+        openapi: "3.0.3",
+        info: { title, version: "1" },
+        servers: [{ url: server }],
+        paths: {
+          [path]: {
+            get: { operationId: id, tags: [tag], responses: { "200": { description: "ok" } } },
+          },
+          // An operation on the service's upload host, as GitHub's release asset upload is.
+          ...(upload === undefined
+            ? {}
+            : {
+                "/asset": {
+                  get: {
+                    operationId: "asset",
+                    tags: [tag],
+                    servers: [{ url: upload }],
+                    responses: { "200": { description: "ok" } },
+                  },
+                },
+              }),
+        },
+      });
+    // v1 asked GitHub's app for no scopes, whatever the method declared.
+    const githubMethod = {
+      authorizationUrl: "https://github.example.com/login/oauth/authorize",
+      tokenUrl: "https://github.example.com/login/oauth/access_token",
+      scopes: ["repo", "user"],
+    };
+    const apis = [
+      {
+        slug: slugs.google,
+        name: "Synthetic Google",
+        text: document("Synthetic Google", `${origin}/google/api`, "google", "/me", "me"),
+        operations: [{ tool: "google.me", path: "/me" }],
+        // The endpoints and scopes of v1's catalog method, which its own app replaced.
+        method: {
+          authorizationUrl: "https://accounts.example.com/o/oauth2/v2/auth",
+          tokenUrl: "https://accounts.example.com/token",
+          scopes: ["openid", "synthetic.read"],
+        },
+      },
+      ...[
+        { slug: slugs.github, name: "Synthetic GitHub", server: `${origin}/github/api` },
+        {
+          slug: slugs.elsewhere,
+          name: "GitHub elsewhere",
+          // The same service under another host name, which the client does not pin.
+          server: `${origin.replace("127.0.0.1", "localhost")}/github/api`,
+        },
+      ].map((api) => ({
+        slug: api.slug,
+        name: api.name,
+        text: document(api.name, api.server, "github", "/user", "user"),
+        operations: [{ tool: "github.user", path: "/user" }],
+        method: githubMethod,
+      })),
+      ...[
+        { slug: slugs.both, name: "GitHub two hosts", client: "github-both" },
+        { slug: slugs.apiOnly, name: "GitHub one host", client: "github-api" },
+      ].map((api) => ({
+        slug: api.slug,
+        name: api.name,
+        text: document(
+          api.name,
+          `http://${githubHosts.api}/${api.client}/api`,
+          "github",
+          "/user",
+          "user",
+          `http://${githubHosts.uploads}/${api.client}/uploads`,
+        ),
+        operations: [
+          { tool: "github.user", path: "/user" },
+          { tool: "github.asset", path: "/asset" },
+        ],
+        method: githubMethod,
+      })),
+    ];
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        organization,
+        "Synthetic first-party workspace",
+        slug,
+      ),
+      ...apis.flatMap((api) => {
+        const hash = createHash("sha256").update(api.text).digest("hex");
+        return [
+          row(
+            "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
+            organization,
+            api.slug,
+            api.name,
+            JSON.stringify({
+              specHash: hash,
+              authenticationTemplate: [{ slug: "oauth2", kind: "oauth2", ...api.method }],
+            }),
+          ),
+          row(
+            "insert into blob (namespace, key, value) values ($1, $2, $3)",
+            `o:${organization}/openapi`,
+            `spec/${hash}`,
+            api.text,
+          ),
+          ...api.operations.map((operation) =>
+            row(
+              "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+              organization,
+              `op.${api.slug}.${operation.tool}`,
+              JSON.stringify({
+                integration: api.slug,
+                toolName: operation.tool,
+                binding: { method: "get", pathTemplate: operation.path },
+              }),
+            ),
+          ),
+        ];
+      }),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', 'Synthetic Slack', $3::json)",
+        organization,
+        slugs.slack,
+        JSON.stringify({
+          transport: "remote",
+          endpoint: `${origin}/slack/mcp`,
+          remoteTransport: "auto",
+          authenticationTemplate: [{ slug: "oauth2", kind: "oauth2" }],
+        }),
+      ),
+      row(
+        "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'user', $2, $3, 'slack', 'mcp', 'whoami', $4::json)",
+        organization,
+        user,
+        slugs.slack,
+        JSON.stringify({ mcp: { toolName: "whoami" } }),
+      ),
+      // GitHub's MCP server, and the same server under another host name, which the GitHub
+      // client does not pin.
+      ...[
+        {
+          slug: slugs.githubMcp,
+          name: "Synthetic GitHub MCP",
+          connection: "github-mcp",
+          endpoint: `${origin}/github/mcp`,
+        },
+        {
+          slug: slugs.mcpElsewhere,
+          name: "GitHub MCP elsewhere",
+          connection: "mcp-elsewhere",
+          endpoint: `${origin.replace("127.0.0.1", "localhost")}/github/mcp`,
+        },
+        {
+          slug: slugs.wrongServer,
+          name: "GitHub MCP on Slack's server",
+          connection: "wrong-server",
+          endpoint: `${origin}/slack/mcp`,
+        },
+        {
+          slug: slugs.moved,
+          name: "GitHub MCP moved",
+          connection: "moved",
+          endpoint: `${origin}/github/mcp-moved`,
+        },
+      ].flatMap((server) => [
+        row(
+          "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'mcp', $3, $4::json)",
+          organization,
+          server.slug,
+          server.name,
+          JSON.stringify({
+            transport: "remote",
+            endpoint: server.endpoint,
+            remoteTransport: "auto",
+            authenticationTemplate: [{ slug: "oauth2", kind: "oauth2" }],
+          }),
+        ),
+        row(
+          "insert into tool (tenant, owner, subject, integration, connection, plugin_id, name, annotations) values ($1, 'user', $2, $3, $4, 'mcp', 'whoami', $5::json)",
+          organization,
+          user,
+          server.slug,
+          server.connection,
+          JSON.stringify({ mcp: { toolName: "whoami" } }),
+        ),
+      ]),
+      ...connections.map((connection) => {
+        const item = access(connection.integration, connection.name);
+        return row(
+          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, refresh_item_id, expires_at, oauth_scope) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, $7, $8::bigint, nullif($9, ''))",
+          organization,
+          user,
+          connection.integration,
+          connection.name,
+          JSON.stringify({ token: item }),
+          `first-party:${connection.client}`,
+          `${item}:refresh`,
+          // Expired, so the first call renews it, unless it is live for another day.
+          String("live" in connection ? Date.now() + 86_400_000 : Date.now() - 60_000),
+          connection.scope,
+        );
+      }),
+    ]);
+  });
+
+/** Text with Latin-1, punctuation, symbols and an emoji: everything an API's prose uses. */
+const wideText = "Returns the service’s “health” — café → ✅ or 🔴.";
+
+/** A display name and base URL path beyond Latin-1, which a JavaScript string stores two bytes wide. */
+const wideName = "Kanji 日本 API";
+const widePath = "/public/日本";
+
+/**
+ * An 81-byte YAML specification whose `version` is indented deeper than its sibling `title`. Its
+ * title holds a literal U+FFFD, which is valid UTF-8.
+ */
+const unreadableYaml = `openapi: 3.0.3
+info:
+  title: Synthetic \uFFFD unreadable
+   version: "1"
+paths: {}
+`;
+
+/** The API every synthetic Graph operation calls. */
+const graphOrigin = "https://graph.example.invalid";
+
+/**
+ * Four Microsoft Graph presets as v1 added them, each with v1's rows for the operations it kept.
+ * `Graph Mail` and `Graph Calendar` keep areas of one Graph-shaped document of about 15 MB, which
+ * v1 stored once for both. `Graph Tasks` keeps an area of a small one whose first area's detail
+ * schema, which that area's operations reach, is indented deeper than its sibling title. v1 never
+ * stored a Graph preset's document as JSON, as `Graph Files`'s is.
+ */
+const seedGraph = (organization: string, slug: string) =>
+  Effect.gen(function* () {
+    const shared = graphDocument(graphOrigin, 2500);
+    const small = graphDocument(graphOrigin, 2);
+    const misindented = "       type: object";
+    const broken = small.text.replace(
+      "    synthetic.area0.detail:\n      title: detail\n",
+      `    synthetic.area0.detail:\n      title: detail\n${misindented}\n`,
+    );
+    const presets = [
+      {
+        slug: "microsoft_mail",
+        name: "Graph Mail",
+        text: shared.text,
+        areas: shared.areas.slice(0, 10),
+      },
+      {
+        slug: "microsoft_calendar",
+        name: "Graph Calendar",
+        text: shared.text,
+        areas: shared.areas.slice(10, 15),
+      },
+      {
+        slug: "microsoft_tasks",
+        name: "Graph Tasks",
+        text: broken,
+        areas: small.areas.slice(0, 1),
+      },
+      {
+        slug: "microsoft_files",
+        name: "Graph Files",
+        text: JSON.stringify({
+          openapi: "3.0.4",
+          info: { title: "Graph", version: "1" },
+          paths: {},
+        }),
+        areas: small.areas.slice(1),
+      },
+    ];
+    const hash = (text: string) => createHash("sha256").update(text).digest("hex");
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        organization,
+        "Synthetic Graph workspace",
+        slug,
+      ),
+      ...[...new Set(presets.map((preset) => preset.text))].map((text) =>
+        row(
+          "insert into blob (namespace, key, value) values ($1, $2, $3)",
+          `o:${organization}/openapi`,
+          `spec/${hash(text)}`,
+          text,
+        ),
+      ),
+      ...presets.flatMap((preset) => [
+        row(
+          "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
+          organization,
+          preset.slug,
+          preset.name,
+          JSON.stringify({
+            specHash: hash(preset.text),
+            specFormat: "microsoft-graph",
+            family: "microsoft",
+            sourceUrl: `${graphOrigin}/openapi.yaml#preset=${preset.slug}`,
+            authenticationTemplate: [],
+          }),
+        ),
+        ...preset.areas.flatMap((area) =>
+          area.operations.map(([tool, method, path]) =>
+            row(
+              "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+              organization,
+              `op.${preset.slug}.${tool}`,
+              JSON.stringify({
+                integration: preset.slug,
+                toolName: tool,
+                binding: { method, pathTemplate: path },
+              }),
+            ),
+          ),
+        ),
+      ]),
+    ]);
+    return {
+      presets,
+      broken: {
+        line: broken.split("\n").indexOf(misindented) + 1,
+        bytes: new TextEncoder().encode(broken).length,
+      },
+    };
+  });
+
+/**
+ * Four OpenAPI integrations and a GraphQL one. `Typography`'s document describes its one public
+ * operation in `wideText`. `Kanji 日本 API` has a document as large as the largest imported vendor
+ * API's, a base URL whose path goes beyond Latin-1 and an API key the user saved in v1. `Scoped`
+ * signs in through a v1 client whose authorization URL sets `scope` itself, which v2's OAuth
+ * declarations keep to the host. `Unreadable`'s stored specification is YAML no parser reads.
+ * `Synthetic GraphQL` is shaped like a Linear GraphQL integration: an OAuth method that names no
+ * endpoints and no scopes, so each connection signs in at its own client with the scopes that
+ * client's authorization URL sets, and an API key sent bare in `Authorization`. `main`'s client asks
+ * for comma-separated scopes, `tabbed`'s for a scope holding a tab, `blank`'s for an empty scope,
+ * `doubled`'s for two scopes two spaces apart, `nonced`'s also sets `nonce`, `repeated`'s sets
+ * `scope` twice and `targeted`'s sets a `resource` its client does not name; `key` holds the API
+ * key. Every client signs in at `signIn`.
+ */
+const seedBuilds = (
+  organization: string,
+  user: string,
+  slug: string,
+  origin: string,
+  signIn: string,
+) =>
+  Effect.gen(function* () {
+    const emulators = yield* Emulators;
+    const suffix = randomUUID().slice(0, 6);
+    const typography = `typography_${suffix}`;
+    const kanji = `kanji_${suffix}`;
+    const scoped = `scoped_${suffix}`;
+    const unreadable = `unreadable_${suffix}`;
+    const graphql = `graphql_${suffix}`;
+    const userScope = `executor/user/${encodeURIComponent(organization)}/${encodeURIComponent(user)}`;
+    const key = `connection:user:${kanji}:main:token`;
+    yield* emulators.v1VaultObject(vaultName(userScope, key), "synthetic-kanji-key");
+    const access = `oauth:user:${scoped}:main`;
+    yield* emulators.v1VaultObject(vaultName(userScope, access), "synthetic-scoped-access");
+    yield* emulators.v1VaultObject(
+      vaultName(userScope, `${access}:refresh`),
+      "synthetic-scoped-refresh",
+    );
+    const graphqlAccess = `oauth:user:${graphql}:main`;
+    const graphqlNonced = `oauth:user:${graphql}:nonced`;
+    const graphqlKey = `connection:user:${graphql}:key:token`;
+    for (const [item, value] of [
+      [graphqlAccess, "synthetic-graphql-access"],
+      [`${graphqlAccess}:refresh`, "synthetic-graphql-refresh"],
+      [graphqlNonced, "synthetic-graphql-nonced-access"],
+      [graphqlKey, "synthetic-graphql-key"],
+      ...["tabbed", "repeated", "blank", "doubled", "targeted"].map(
+        (name) => [`oauth:user:${graphql}:${name}`, `synthetic-graphql-${name}-access`] as const,
+      ),
+    ] as const)
+      yield* emulators.v1VaultObject(vaultName(userScope, item), value);
+    const document = (title: string, tag: string, path: string, description: string) =>
+      JSON.stringify({
+        openapi: "3.0.3",
+        info: { title, version: "1" },
+        servers: [{ url: `${origin}/public` }],
+        paths: {
+          [path]: {
+            get: {
+              operationId: "health",
+              tags: [tag],
+              description,
+              responses: { "200": { description: "ok" } },
+            },
+          },
+        },
+      });
+    const large = largeOpenapiDocument(origin, 1000, wideText);
+    const integrations: ReadonlyArray<{
+      readonly slug: string;
+      readonly name: string;
+      readonly text: string;
+      readonly config: Readonly<Record<string, string>>;
+      readonly template: ReadonlyArray<unknown>;
+      /** Each v1 tool: its name, method and path. */
+      readonly operations: ReadonlyArray<readonly [string, string, string]>;
+    }> = [
+      {
+        slug: typography,
+        name: "Typography",
+        text: document("Synthetic typography", "typography", "/health", wideText),
+        config: {},
+        template: [],
+        operations: [["typography.health", "get", "/health"]],
+      },
+      {
+        slug: kanji,
+        name: wideName,
+        text: JSON.stringify(large),
+        config: { baseUrl: `${origin}${widePath}` },
+        template: [
+          {
+            slug: "apikey-0",
+            kind: "apikey",
+            placements: [{ carrier: "header", name: "X-Api-Key" }],
+          },
+        ],
+        // v1 listed every operation, so the app keeps the whole document.
+        operations: Object.entries(large.paths).flatMap(([path, item]) =>
+          Object.entries(item).map(([method, operation]) => [
+            path === "/health" ? "service.health" : `large.${String(operation.operationId)}`,
+            method,
+            path,
+          ]),
+        ),
+      },
+      {
+        slug: scoped,
+        name: "Scoped",
+        text: document("Synthetic scoped", "scoped", "/me", "ok"),
+        config: {},
+        template: [
+          {
+            slug: "oauth2",
+            kind: "oauth2",
+            authorizationUrl: `${signIn}/authorize?scope=everything%20profile`,
+            tokenUrl: `${signIn}/token`,
+            scopes: [],
+          },
+        ],
+        operations: [["scoped.health", "get", "/me"]],
+      },
+      {
+        slug: unreadable,
+        name: "Unreadable",
+        text: unreadableYaml,
+        config: {},
+        template: [],
+        operations: [["unreadable.health", "get", "/health"]],
+      },
+    ];
+    const row = (sql: string, ...params: string[]): RowStatement => ({ sql, params });
+    yield* writeRows("v1-database.json", [
+      row(
+        "insert into organizations (id, name, slug) values ($1, $2, $3)",
+        organization,
+        "Synthetic builds workspace",
+        slug,
+      ),
+      ...integrations.flatMap((integration) => {
+        const hash = createHash("sha256").update(integration.text).digest("hex");
+        return [
+          row(
+            "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'openapi', $3, $4::json)",
+            organization,
+            integration.slug,
+            integration.name,
+            JSON.stringify({
+              specHash: hash,
+              ...integration.config,
+              authenticationTemplate: integration.template,
+            }),
+          ),
+          row(
+            "insert into blob (namespace, key, value) values ($1, $2, $3)",
+            `o:${organization}/openapi`,
+            `spec/${hash}`,
+            integration.text,
+          ),
+          ...integration.operations.map(([tool, method, path]) =>
+            row(
+              "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'openapi', 'operation', $2, $3::json)",
+              organization,
+              `op.${integration.slug}.${tool}`,
+              JSON.stringify({
+                integration: integration.slug,
+                toolName: tool,
+                binding: { method, pathTemplate: path },
+              }),
+            ),
+          ),
+        ];
+      }),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'main', 'apikey-0', $4::json)",
+        organization,
+        user,
+        kanji,
+        JSON.stringify({ token: key }),
+      ),
+      row(
+        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, token_endpoint_auth_method, origin_kind) values ($1, 'org', '', $2, $3, $4, 'authorization_code', 'synthetic-scoped-client', 'basic', 'manual')",
+        organization,
+        `${scoped}-client`,
+        `${signIn}/authorize?scope=everything%20profile`,
+        `${signIn}/token`,
+      ),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at) values ($1, 'user', $2, $3, 'main', 'oauth2', $4::json, $5, 'org', $6, $7::bigint)",
+        organization,
+        user,
+        scoped,
+        JSON.stringify({ token: access }),
+        `${scoped}-client`,
+        `${access}:refresh`,
+        String(Date.now() + 3_600_000),
+      ),
+      row(
+        "insert into integration (tenant, slug, plugin_id, name, config) values ($1, $2, 'graphql', $3, $4::json)",
+        organization,
+        graphql,
+        "Synthetic GraphQL",
+        JSON.stringify({
+          endpoint: `${origin}/graphql`,
+          name: "Synthetic GraphQL",
+          authenticationTemplate: [
+            { kind: "oauth2", slug: "oauth2" },
+            {
+              slug: "apiKey",
+              kind: "apikey",
+              label: "Synthetic API key",
+              placements: [{ carrier: "header", name: "Authorization" }],
+            },
+          ],
+        }),
+      ),
+      row(
+        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'org', '', 'graphql-oauth', $2, $3, 'authorization_code', 'synthetic-graphql-client', 'manual')",
+        organization,
+        `${signIn}/oauth/authorize?scope=read,write`,
+        `${signIn}/oauth/token`,
+      ),
+      row(
+        "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'user', $2, 'graphql-oauth', $3, $4, 'authorization_code', 'synthetic-graphql-nonced-client', 'manual')",
+        organization,
+        user,
+        `${signIn}/oauth/authorize?scope=read&nonce=synthetic`,
+        `${signIn}/oauth/token`,
+      ),
+      ...(
+        [
+          ["tabbed", "scope=read%09write"],
+          ["repeated", "scope=read&scope=write"],
+          ["blank", "scope="],
+          ["doubled", "scope=read%20%20write"],
+          ["targeted", `scope=read&resource=${encodeURIComponent(`${signIn}/graphql`)}`],
+        ] as const
+      ).flatMap(([name, query]) => [
+        row(
+          "insert into oauth_client (tenant, owner, subject, slug, authorization_url, token_url, \"grant\", client_id, origin_kind) values ($1, 'user', $2, $3, $4, $5, 'authorization_code', $6, 'manual')",
+          organization,
+          user,
+          `graphql-${name}`,
+          `${signIn}/oauth/authorize?${query}`,
+          `${signIn}/oauth/token`,
+          `synthetic-graphql-${name}-client`,
+        ),
+        row(
+          "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner) values ($1, 'user', $2, $3, $4, 'oauth2', $5::json, $6, 'user')",
+          organization,
+          user,
+          graphql,
+          name,
+          JSON.stringify({ token: `oauth:user:${graphql}:${name}` }),
+          `graphql-${name}`,
+        ),
+      ]),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope) values ($1, 'user', $2, $3, 'main', 'oauth2', $4::json, 'graphql-oauth', 'org', $5, $6::bigint, 'read,write')",
+        organization,
+        user,
+        graphql,
+        JSON.stringify({ token: graphqlAccess }),
+        `${graphqlAccess}:refresh`,
+        String(Date.now() + 3_600_000),
+      ),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner) values ($1, 'user', $2, $3, 'nonced', 'oauth2', $4::json, 'graphql-oauth', 'user')",
+        organization,
+        user,
+        graphql,
+        JSON.stringify({ token: graphqlNonced }),
+      ),
+      row(
+        "insert into connection (tenant, owner, subject, integration, name, template, item_ids) values ($1, 'user', $2, $3, 'key', 'apiKey', $4::json)",
+        organization,
+        user,
+        graphql,
+        JSON.stringify({ token: graphqlKey }),
+      ),
+    ]);
+  });
+
+/** A workspace with one rule for a removed integration and one toolkit that grants nothing. */
+const seedPlainWorkspace = (organization: string, slug: string) =>
+  writeRows("v1-database.json", [
+    {
+      sql: "insert into organizations (id, name, slug) values ($1, $2, $3)",
+      params: [organization, "Synthetic plain workspace", slug],
+    },
+    {
+      sql: "insert into tool_policy (tenant, owner, subject, pattern, action) values ($1, 'org', '', 'removed_service.*', 'block')",
+      params: [organization],
+    },
+    {
+      sql: "insert into plugin_storage (tenant, plugin_id, collection, key, data) values ($1, 'toolkits', 'toolkits', 'tk_1', $2::json)",
+      params: [organization, JSON.stringify({ id: "tk_1", name: "Support", slug: "support" })],
+    },
+  ]);
+
+layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
+  it.effect(scenarios.v1ImportRun.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const identity = yield* emulators.identity("google");
+        const own = yield* emulators.v1Workspace([identity.email]);
+        const slug = `v1-${randomUUID().slice(0, 8)}`;
+        const seeded = yield* seedWorkspace(own.organization, own.user, slug);
+        // v1 keeps its own metadata on the organization; an import does not change v1.
+        yield* emulators.setV1OrganizationMetadata(own.organization, { v1_setting: "synthetic" });
+        yield* googleSignIn(identity.email);
+
+        const { report, target, items } = yield* importOnServer(own.organization);
+        expect(target.slug).toBe(slug);
+        // A sign-in v2 does not offer cannot move, so the organization does not convert;
+        // everything else moved. v1 Cloud never ran a local MCP server, so it is skipped.
+        expect(report.status).toBe("failed");
+        expect(statuses(items, "integration", "Widgets")).toEqual(["imported"]);
+        expect(statuses(items, "integration", "Tracker")).toEqual(["imported"]);
+        expect(items.find((item) => item.label === "Local files")).toMatchObject({
+          status: "skipped",
+          reason: "Local (stdio) MCP servers do not run in Executor Cloud.",
+        });
+        expect(statuses(items, "connection", "main")).toEqual(["imported", "imported", "imported"]);
+        expect(statuses(items, "connection", "signin")).toEqual(["imported"]);
+        expect(statuses(items, "connection", "linear")).toEqual(["failed"]);
+        expect(items.find((item) => item.label === "linear")?.reason).toContain("Executor's own");
+        expect(statuses(items, "tool_policy", `${seeded.widgets}.*.*.widgets.remove`)).toEqual([
+          "imported",
+        ]);
+        // A rule for a removed integration never applied in v1: nothing to import, not a failure.
+        expect(items.find((item) => item.label === "removed_service.*")).toMatchObject({
+          status: "skipped",
+          reason: "Its integration no longer exists in v1.",
+        });
+        expect(items.find((item) => item.label === "Support")).toMatchObject({
+          status: "imported",
+          note: grantsNoConnection,
+        });
+        expect(items.find((item) => item.label === "Dashboard")).toMatchObject({
+          status: "imported",
+          needsRepair: true,
+        });
+        // The report holds no secret.
+        for (const value of [
+          "synthetic-user-key",
+          "synthetic-workspace-key",
+          "synthetic-access-token",
+          "synthetic-refresh-token",
+          "synthetic-client-secret",
+          "synthetic-tracker-key",
+        ])
+          expect(JSON.stringify(report)).not.toContain(value);
+        // Nothing is written to v1: no freeze, no moved notice.
+        expect(yield* emulators.v1OrganizationMetadata(own.organization)).toEqual({
+          v1_setting: "synthetic",
+        });
+
+        const inventory = yield* call(
+          "Read the new organization",
+          "GET",
+          `/api/organizations/${target.id}/inventory`,
+        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
+        // The member approved creating through their own `main` connection only, so each Widgets
+        // connection is its own app (decision 33): the workspace's `main` says so beside the
+        // member's.
+        const appOf = (name: string) => inventory.apps.find((app) => app.name === name);
+        expect(inventory.apps.map((app) => app.name)).toEqual(
+          expect.arrayContaining([
+            "Widgets (main)",
+            "Widgets (main, workspace)",
+            "Widgets (signin)",
+            "Tracker",
+          ]),
+        );
+        expect(appOf("Widgets")).toBeUndefined();
+        // The personal connection keeps its name; the workspace's is suffixed. Team setup adds
+        // the Executor app's own account beside them.
+        expect(
+          inventory.accounts
+            .map((account) => account.label)
+            .filter((label) => label !== "Your Executor access")
+            .sort(),
+        ).toEqual(["main", "main", "main (workspace)", "signin"]);
+        // The member's own Widgets connections are linked for them to their app's many()
+        // `service` requirement; the workspace's is linked for everyone to its app's `workspace`
+        // requirement.
+        for (const [name, scope, links] of [
+          ["Widgets (main)", "user", [["service", "main"]]],
+          ["Widgets (main)", "app", []],
+          ["Widgets (signin)", "user", [["service", "signin"]]],
+          ["Widgets (signin)", "app", []],
+          ["Widgets (main, workspace)", "user", []],
+          ["Widgets (main, workspace)", "app", [["workspace", "main (workspace)"]]],
+        ] as const) {
+          const listed = yield* call(
+            `List ${name}'s ${scope} links`,
+            "GET",
+            `/api/organizations/${target.id}/apps/${appOf(name)?.id}/accounts/${scope}`,
+          );
+          expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+          expect(
+            (yield* decode(Schema.Array(AccountLink), listed)).map((link) => [
+              link.requirement,
+              link.account.label,
+            ]),
+            `${name} ${scope}`,
+          ).toEqual(links);
+        }
+
+        // Tools keep v1's names; the blocked one is left out of every app, and only the member's
+        // `main` app creates without asking.
+        for (const name of ["Widgets (main)", "Widgets (main, workspace)", "Widgets (signin)"]) {
+          const widgetTools = yield* call(
+            `List ${name}'s tools`,
+            "GET",
+            `/api/organizations/${target.id}/apps/${appOf(name)?.id}/tools`,
+          );
+          expect(widgetTools.status, JSON.stringify(widgetTools.body)).toBe(200);
+          const tools = yield* decode(Tools, widgetTools);
+          expect(tools.items.map((tool) => tool.name).sort(), name).toEqual([
+            "widgets.create",
+            "widgets.list",
+          ]);
+          const rules = (yield* appSource(target.id, appOf(name)?.id)).find(
+            (file) => file.path === "tools.ts",
+          )?.content;
+          if (name === "Widgets (main)") expect(rules).toContain('"widgets.create": "never"');
+          else expect(rules, name).not.toContain('"widgets.create": "never"');
+        }
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+  it.effect(scenarios.v1ImportChecks.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const upstream = yield* checkedApi;
+        const identity = yield* emulators.identity("google");
+        const own = yield* emulators.v1Workspace([identity.email]);
+        const seeded = yield* seedChecks(
+          own.organization,
+          own.user,
+          `v1-${randomUUID().slice(0, 8)}`,
+          upstream.origin,
+        );
+        yield* googleSignIn(identity.email);
+
+        const { target, results } = yield* importOnServer(own.organization);
+        // Rules v1 never applied have nothing to import; they are not failures.
+        expect(results.get("executor.code.*")).toEqual({
+          status: "skipped",
+          reason: "It applies to v1's built-in tools, which v2 does not have.",
+        });
+        expect(results.get("Checked API")?.status, results.get("Checked API")?.reason).toBe(
+          "imported",
+        );
+        expect(results.get("Fixed MCP")?.status, results.get("Fixed MCP")?.reason).toBe("imported");
+        expect(results.get("Compiled API")?.status, results.get("Compiled API")?.reason).toBe(
+          "imported",
+        );
+        // Two operations that share a template keep their own tools: the stored row is the first
+        // one's, and the second keeps the tool v1 compiled for it.
+        expect(results.get("Merged API")?.status, results.get("Merged API")?.reason).toBe(
+          "imported",
+        );
+        for (const name of ["Referenced API", "Linked API"])
+          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
+        // v1 stored the Linked API's specification as its URL; the import fetched it once.
+        expect(yield* upstream.specFetches).toBe(1);
+        // A tool v1 listed that the document does not name fails the integration by name.
+        expect(results.get("Unmatched API")).toMatchObject({
+          status: "failed",
+          reason: "v2 would not provide 1 of its v1 tools: items.archive.",
+        });
+        for (const name of [...Object.keys(keys), "fixed", "anonymous"])
+          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
+        // The tool v1 listed twice is imported once, under its lower snake case name.
+        expect(results.get("Fixed MCP")?.note).toBe(
+          "v1 listed a tool under two names; search_issues is now searchissues.",
+        );
+        expect(results.get("removed_service.*")).toEqual({
+          status: "skipped",
+          reason: "Its integration no longer exists in v1.",
+        });
+        expect(results.get("executor.code.*")?.status).toBe("skipped");
+        // A rule that matches no tool v1 listed still moves, and says so.
+        expect(results.get(`${seeded.api}.*.*.me.unlisted`)).toMatchObject({
+          status: "imported",
+          note: "It matches no tool v1 last listed for its integration.",
+        });
+
+        const inventory = yield* call(
+          "Read the new organization",
+          "GET",
+          `/api/organizations/${target.id}/inventory`,
+        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
+        const appId = (name: string) => inventory.apps.find((app) => app.name === name)?.id;
+        const accountId = (label: string) =>
+          inventory.accounts.find((account) => account.label === label)?.id;
+
+        // The fixed credential is the MCP account's field; only the non-credential header stays in
+        // the app's source.
+        expect(accountId("fixed")).toBeDefined();
+        // The connection without credentials is an account of the app's "No credentials" method.
+        expect(accountId("anonymous")).toBeDefined();
+
+        // Without stored operations, the tools v1 listed keep the names v1 compiled for them.
+        const compiledApp = appId("Compiled API");
+        expect(inventory.links.some((link) => link.app === compiledApp)).toBe(true);
+        const compiledTools = yield* call(
+          "List the compiled API's tools",
+          "GET",
+          `/api/organizations/${target.id}/apps/${compiledApp}/tools`,
+        );
+        expect(compiledTools.status, JSON.stringify(compiledTools.body)).toBe(200);
+        expect((yield* decode(Tools, compiledTools)).items.map((tool) => tool.name).sort()).toEqual(
+          compiledV1Names,
+        );
+        // Operations that are references, and the operations of a specification v1 stored as its
+        // URL, keep v1's names.
+        for (const [name, expected] of [
+          ["Referenced API", Object.keys(referencedV1Names)],
+          ["Linked API", ["profile.read"]],
+        ] as const) {
+          const listed = yield* call(
+            `List the ${name}'s tools`,
+            "GET",
+            `/api/organizations/${target.id}/apps/${appId(name)}/tools`,
+          );
+          expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+          expect((yield* decode(Tools, listed)).items.map((tool) => tool.name).sort()).toEqual(
+            expected,
+          );
+        }
+        const source = yield* call(
+          "Read the MCP app's deployed source",
+          "GET",
+          `/api/organizations/${target.id}/apps/${appId("Fixed MCP")}/source`,
+        );
+        expect(source.status, JSON.stringify(source.body)).toBe(200);
+        const files = (yield* decode(Source, source)).files;
+        const written = JSON.stringify(files);
+        expect(written).not.toContain(fixedSecret);
+        expect(written).toContain("X-Client");
+        expect(files.find((file) => file.path === "provider.ts")?.content).toContain(
+          '"fixed header Authorization"',
+        );
+
+        // v1's check: its request and identity field for a working key, Google's disabled-API 403
+        // as a missing permission rather than a refused sign-in, a refused key, and a redirect, which
+        // fails the check without sending the key on to the plain HTTP page it names.
+        const check = (label: string) =>
+          call(
+            `Check the ${label} account`,
+            "POST",
+            `/api/organizations/${target.id}/accounts/${accountId(label)}/health`,
+          ).pipe(
+            Effect.tap((response) =>
+              Effect.sync(() => expect(response.status, JSON.stringify(response.body)).toBe(200)),
+            ),
+            Effect.flatMap((response) => decode(Health, response)),
+          );
+        const checked = appId("Checked API");
+        const verdict = (health: typeof Health.Type) =>
+          health.apps.find((app) => app.app === checked);
+        const good = yield* check("good");
+        expect(verdict(good)).toMatchObject({ checkable: true, check: { status: "healthy" } });
+        expect(good.info?.email).toBe(checkedEmail);
+        expect(verdict(yield* check("disabled"))?.check?.status).toBe("forbidden");
+        expect(verdict(yield* check("revoked"))?.check?.status).toBe("credentials_rejected");
+        expect(verdict(yield* check("redirected"))?.check).toMatchObject({
+          status: "check_failed",
+          message:
+            "The service redirected the check (HTTP 302); an account's credentials never follow a redirect.",
+        });
+        expect(yield* upstream.received).toEqual(
+          [keys.good, keys.disabled, keys.revoked, keys.redirected].map((key) => ({
+            path: "/v1/me?fields=email",
+            key,
+          })),
+        );
+        expect(yield* upstream.landed).toEqual([]);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportToolkits.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const identity = yield* emulators.identity("google");
+        const own = yield* emulators.v1Workspace([identity.email]);
+        const seeded = yield* seedToolkits(
+          own.organization,
+          own.user,
+          `v1-${randomUUID().slice(0, 8)}`,
+        );
+        yield* googleSignIn(identity.email);
+
+        const { target, results } = yield* importOnServer(own.organization);
+        for (const name of ["Hosted", "Open", "main", "first", "second"])
+          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
+
+        // The personal toolkit: its granted tools and accounts, without the tool it blocked; the
+        // tool the workspace blocks is not in the app, so the toolkit cannot select it.
+        const support = results.get("Support");
+        expect(support).toMatchObject({
+          status: "imported",
+          note: "1 tool v1 allowed only through this toolkit is blocked in the workspace, so it is left out: Hosted purge_items.",
+        });
+        expect(results.get("Shared")).toMatchObject({
+          status: "imported",
+          note: grantsNoConnection,
+        });
+        const inventory = yield* call(
+          "Read the new organization",
+          "GET",
+          `/api/organizations/${target.id}/inventory`,
+        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
+        const appId = (name: string) => inventory.apps.find((app) => app.name === name)?.id;
+        const connections = yield* call(
+          "List the scoped MCP connections",
+          "GET",
+          `/api/organizations/${target.id}/mcp-connections`,
+        ).pipe(Effect.flatMap((response) => decode(Connections, response)));
+        const scoped = connections.find((connection) => connection.id === support?.v2Id);
+        expect(scoped?.name).toBe("Support");
+        expect(scoped?.url).toContain(`connection=${support?.v2Id}`);
+        expect([...(scoped?.policy.apps ?? [])].sort((a, b) => (a.app < b.app ? -1 : 1))).toEqual(
+          [
+            {
+              app: appId("Hosted"),
+              // The connection's result is the account it linked, which the grant targets.
+              runsAs: [{ kind: "account", id: results.get("main")?.v2Id }],
+              tools: { kind: "selected", names: ["create_item", "list_items"] },
+            },
+            {
+              app: appId("Open"),
+              runsAs: [{ kind: "app" }],
+              tools: { kind: "selected", names: ["search"] },
+            },
+          ].sort((a, b) => ((a.app ?? "") < (b.app ?? "") ? -1 : 1)),
+        );
+        expect(
+          connections.find((connection) => connection.id === results.get("Shared")?.v2Id)?.policy
+            .apps,
+        ).toEqual([]);
+
+        // The toolkit asked before creating, so the app asks every caller.
+        const source = yield* call(
+          "Read the MCP app's deployed source",
+          "GET",
+          `/api/organizations/${target.id}/apps/${appId("Hosted")}/source`,
+        ).pipe(Effect.flatMap((response) => decode(Source, response)));
+        const rules = source.files.find((file) => file.path === "tools.ts")?.content ?? "";
+        expect(rules).toContain('"create_item": "always"');
+        expect(rules).not.toContain('"delete_item"');
+        // The toolkit granted listing without a rule of its own, so v1 used the tool's default there;
+        // the workspace's approval does not become `never`, and the app keeps the default.
+        expect(rules).not.toContain('"list_items"');
 
-layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
-  it.effect(scenarios.v1ImportRun.title, (context) =>
+        // Artifacts become apps with source and no version, and say what needs repair.
+        const dashboard = results.get("Dashboard");
+        expect(dashboard).toEqual({
+          status: "imported",
+          v2Id: expect.any(String),
+          needsRepair: true,
+          note: `${repairNote} Its calls map to ${seeded.hosted} → Hosted (main). other: Its integration no longer exists in v1.`,
+        });
+        expect(results.get("Legacy view")).toMatchObject({
+          status: "imported",
+          needsRepair: true,
+          note: `${repairNote} Its calls map to ${seeded.open}.user.first → Open (first).`,
+        });
+        const apps = yield* call(
+          "List the apps",
+          "GET",
+          `/api/organizations/${target.id}/apps`,
+        ).pipe(Effect.flatMap((response) => decode(Apps, response)));
+        expect(apps.find((app) => app.id === dashboard?.v2Id)).toMatchObject({
+          name: "Dashboard",
+          activeVersion: null,
+        });
+        // Its package files are not read here: managed local Cloud has no Git storage for app
+        // source, and the v1 import runs only there.
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1ImportMcpForward.title, (context) =>
     withCase(
       context,
       Effect.gen(function* () {
-        const emulators = yield* Emulators;
+        const emulators = yield* Emulators,
+          fs = yield* FileSystem.FileSystem,
+          target = yield* Target,
+          mcp = yield* McpClient;
+        const { secret } = yield* fs
+          .readFileString(`${target.directory}/${v1McpForwardFile}`)
+          .pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
+          );
         const identity = yield* emulators.identity("google");
         const own = yield* emulators.v1Workspace([identity.email]);
-        const slug = `v1-${randomUUID().slice(0, 8)}`;
-        const seeded = yield* seedWorkspace(own.organization, own.user, slug);
-        // v1 keeps its own metadata on the organization; an import does not change v1.
-        yield* emulators.setV1OrganizationMetadata(own.organization, { v1_setting: "synthetic" });
+        const stranger = yield* emulators.v1Workspace([
+          (yield* emulators.identity("google")).email,
+        ]);
+        const seeded = yield* seedWorkspace(
+          own.organization,
+          own.user,
+          `v1-${randomUUID().slice(0, 8)}`,
+        );
+        // A toolkit over the user's Widgets account that blocks creating.
+        const toolkitRow = (collection: string, data: Record<string, string>) =>
+          ({
+            sql: `insert into plugin_storage (tenant, owner, subject, plugin_id, collection, key, data) values ($1, 'user', $2, 'toolkits', $3, $4, $5::json)`,
+            params: [own.organization, own.user, collection, data.id ?? "", JSON.stringify(data)],
+          }) satisfies RowStatement;
+        yield* writeRows("v1-database.json", [
+          toolkitRow("toolkits", { id: "tk_forward", name: "Forwarded", slug: "forwarded" }),
+          toolkitRow("toolkitConnections", {
+            id: "tkconn_forward",
+            toolkitId: "tk_forward",
+            pattern: `${seeded.widgets}.user.main.*`,
+            position: "a0",
+          }),
+          toolkitRow("toolkitPolicies", {
+            id: "tkpol_forward",
+            toolkitId: "tk_forward",
+            pattern: `${seeded.widgets}.*.*.${seeded.v1Names.create}`,
+            action: "block",
+            position: "a0",
+          }),
+        ]);
         yield* googleSignIn(identity.email);
 
-        const { report, target, items } = yield* importOnServer(own.organization);
-        expect(target.slug).toBe(slug);
-        // A sign-in v2 does not offer cannot move, so the organization does not convert;
-        // everything else moved. v1 Cloud never ran a local MCP server, so it is skipped.
-        expect(report.status).toBe("failed");
-        expect(statuses(items, "integration", "Widgets")).toEqual(["imported"]);
-        expect(statuses(items, "integration", "Tracker")).toEqual(["imported"]);
-        expect(items.find((item) => item.label === "Local files")).toMatchObject({
-          status: "skipped",
-          reason: "Local (stdio) MCP servers do not run in Executor Cloud.",
-        });
-        expect(statuses(items, "connection", "main")).toEqual(["imported", "imported", "imported"]);
-        expect(statuses(items, "connection", "signin")).toEqual(["imported"]);
-        expect(statuses(items, "connection", "linear")).toEqual(["failed"]);
-        expect(items.find((item) => item.label === "linear")?.reason).toContain("Executor's own");
-        expect(statuses(items, "tool_policy", `${seeded.widgets}.*.*.widgets.remove`)).toEqual([
-          "imported",
+        const { report, target: imported, items } = yield* importOnServer(own.organization);
+        // This workspace has an item that cannot move, so verification fails: the import does not
+        // cut it over, and v1 keeps it frozen for a person to fix and restart or roll back.
+        expect(items.some((item) => item.status === "failed")).toBe(true);
+        expect(report.verification?.passed).toBe(false);
+        expect(report.cutover).toBe(false);
+        const flag = yield* writeRows("v1-database.json", [
+          {
+            sql: "select state from org_moved_to_v2 where org_id = $1",
+            params: [own.organization],
+          },
         ]);
-        // A rule for a removed integration never applied in v1: nothing to import, not a failure.
-        expect(items.find((item) => item.label === "removed_service.*")).toMatchObject({
-          status: "skipped",
-          reason: "Its integration no longer exists in v1.",
-        });
-        expect(items.find((item) => item.label === "Support")).toMatchObject({
-          status: "imported",
-          note: grantsNoConnection,
-        });
-        expect(items.find((item) => item.label === "Dashboard")).toMatchObject({
-          status: "imported",
-          needsRepair: true,
+        expect(flag).toEqual([[{ state: "moving" }]]);
+        // v2 accepts what v1 forwards from the import map alone; v1 forwards only once moved.
+        const forwarded = items.find(
+          (item) => item.kind === "toolkit" && item.label === "Forwarded",
+        );
+        expect(forwarded?.status).toBe("imported");
+        if (forwarded === undefined)
+          return yield* Effect.die("The import has no Forwarded toolkit");
+        // v1 names a toolkit by its row; the connection id it computes for the caller is the id of
+        // the caller's own copy.
+        const row = forwarded.id;
+        const connection = v1ToolkitConnectionId(imported.id, row, own.user);
+        expect(forwarded.v2Id).toBe(connection);
+
+        /** A bearer as v1 signs it for one request; each is distinct and lives a few minutes. */
+        let minted = 0;
+        const sign = (claims: Partial<V1ForwardClaims> = {}, signedWith = secret) =>
+          Redacted.make(
+            v1ForwardBearer(signedWith, {
+              account: own.user,
+              organization: own.organization,
+              exp: Math.floor(Date.now() / 1000) + 300 + minted++,
+              ...claims,
+            }),
+          );
+        const toolkit = { toolkit: row, connection };
+
+        const run = (
+          client: Effect.Success<ReturnType<McpClient["Service"]["connect"]>>,
+          operation: string,
+          code: string,
+        ) =>
+          client
+            .use(operation, (client, signal) =>
+              client.callTool({ name: "execute", arguments: { code } }, undefined, { signal }),
+            )
+            .pipe(
+              Effect.flatMap((result) =>
+                Schema.decodeUnknownEffect(Execution)(result.structuredContent),
+              ),
+            );
+        const Found = Schema.Struct({
+          items: Schema.Array(Schema.Struct({ path: Schema.String })),
         });
-        // The report holds no secret.
-        for (const value of [
-          "synthetic-user-key",
-          "synthetic-workspace-key",
-          "synthetic-access-token",
-          "synthetic-refresh-token",
-          "synthetic-client-secret",
-          "synthetic-tracker-key",
-        ])
-          expect(JSON.stringify(report)).not.toContain(value);
-        // Nothing is written to v1: no freeze, no moved notice.
-        expect(yield* emulators.v1OrganizationMetadata(own.organization)).toEqual({
-          v1_setting: "synthetic",
+        const search = (
+          client: Effect.Success<ReturnType<McpClient["Service"]["connect"]>>,
+          query: string,
+        ) =>
+          run(
+            client,
+            `Search for ${query}`,
+            `return await tools.search({query: ${JSON.stringify(query)}, limit: 50})`,
+          ).pipe(
+            Effect.flatMap((done) => Schema.decodeUnknownEffect(Found)(done.execution.value)),
+            Effect.map((found) => found.items.map((item) => item.path)),
+          );
+
+        // The account and organization alone reach every imported app, with a new bearer for each
+        // request of the one session.
+        const before = minted;
+        const workspace = yield* mcp.connect(() => sign(), "forwarded-workspace");
+        const listed = yield* workspace.use(
+          "List the forwarded session's tools",
+          (client, signal) => client.listTools(undefined, { signal }),
+        );
+        expect(listed.tools.map((tool) => tool.name)).toContain("execute");
+        const everything = yield* search(workspace, "widgets");
+        const has = (paths: readonly string[], name: string) =>
+          paths.some((path) => path.endsWith(name));
+        expect(has(everything, seeded.v1Names.list)).toBe(true);
+        expect(has(everything, seeded.v1Names.create)).toBe(true);
+        // Initialize, its notification, the listing and a search each signed their own bearer.
+        expect(minted - before).toBeGreaterThanOrEqual(4);
+
+        // A toolkit's bearer and URL reach only what the caller's copy of the toolkit grants.
+        const scoped = yield* mcp.connect(() => sign(toolkit), "forwarded-toolkit", {
+          connection,
         });
+        const granted = yield* search(scoped, "widgets");
+        // The listing tool, and not the tool the toolkit blocks.
+        expect(granted).toHaveLength(1);
+        expect(has(granted, seeded.v1Names.list)).toBe(true);
+        expect(has(granted, seeded.v1Names.create)).toBe(false);
 
-        const inventory = yield* call(
-          "Read the new organization",
-          "GET",
-          `/api/organizations/${target.id}/inventory`,
-        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
-        const widgets = inventory.apps.find((app) => app.name === "Widgets");
-        expect(inventory.apps.map((app) => app.name)).toEqual(
-          expect.arrayContaining(["Widgets", "Tracker"]),
-        );
-        // The personal connection keeps its name; the workspace's is suffixed. Team setup adds
-        // the Executor app's own account beside them.
+        /** The status of one initialize request carrying this bearer, at this URL query. */
+        const initialize = (bearer: Redacted.Redacted<string>, query = "") =>
+          Effect.scoped(
+            Effect.gen(function* () {
+              const http = yield* HttpClient.HttpClient;
+              const request = HttpClientRequest.post(`${target.metadata.origin}/mcp${query}`).pipe(
+                HttpClientRequest.setHeaders({
+                  accept: "application/json, text/event-stream",
+                  authorization: `Bearer ${Redacted.value(bearer)}`,
+                }),
+              );
+              const response = yield* http.execute(
+                yield* HttpClientRequest.bodyJson(request, {
+                  jsonrpc: "2.0",
+                  id: 1,
+                  method: "initialize",
+                  params: {
+                    protocolVersion: "2025-06-18",
+                    capabilities: {},
+                    clientInfo: { name: "forwarded-refusal", version: "1" },
+                  },
+                }),
+              );
+              yield* response.text;
+              return response.status;
+            }),
+          ).pipe(Effect.provide(FetchHttpClient.layer));
+        const now = Math.floor(Date.now() / 1000);
+        const toolkitQuery = `?connection=${connection}`;
+        expect(yield* initialize(sign())).toBe(200);
+        // v1 vouches for no one else, and a signature or lifetime v1 did not give is refused.
+        expect(yield* initialize(sign({}, "x".repeat(64)))).toBe(401);
+        expect(yield* initialize(sign({ exp: now - 10 }))).toBe(401);
+        expect(yield* initialize(sign({ exp: now + 3_600 }))).toBe(401);
+        expect(yield* initialize(sign({ toolkit: row }), toolkitQuery)).toBe(401);
+        // A valid bearer for an account or organization the import never mapped.
+        expect(yield* initialize(sign({ account: stranger.user }))).toBe(403);
+        expect(yield* initialize(sign({ organization: stranger.organization }))).toBe(403);
+        // A toolkit connection that is not the caller's copy: another member's, or another row's.
+        const otherMember = v1ToolkitConnectionId(imported.id, row, stranger.user);
         expect(
-          inventory.accounts
-            .map((account) => account.label)
-            .filter((label) => label !== "Your Executor access")
-            .sort(),
-        ).toEqual(["main", "main", "main (workspace)", "signin"]);
-        // The member's own Widgets connections are linked for them to the app's many() `service`
-        // requirement; the workspace's is linked for everyone to its `workspace` requirement.
-        const userLinks = yield* call(
-          "List the member's links of the imported app",
-          "GET",
-          `/api/organizations/${target.id}/apps/${widgets?.id}/accounts/user`,
-        );
-        expect(userLinks.status, JSON.stringify(userLinks.body)).toBe(200);
-        const memberLinks = yield* decode(Schema.Array(AccountLink), userLinks);
-        expect(memberLinks.map((link) => link.requirement)).toEqual(["service", "service"]);
-        expect(memberLinks.map((link) => link.account.label).toSorted()).toEqual([
-          "main",
-          "signin",
-        ]);
-        const appLinks = yield* call(
-          "List the imported app's links for everyone",
-          "GET",
-          `/api/organizations/${target.id}/apps/${widgets?.id}/accounts/app`,
-        );
-        expect(appLinks.status, JSON.stringify(appLinks.body)).toBe(200);
+          yield* initialize(
+            sign({ toolkit: row, connection: otherMember }),
+            `?connection=${otherMember}`,
+          ),
+        ).toBe(403);
+        const otherRow = v1ToolkitConnectionId(imported.id, "tk_other", own.user);
         expect(
-          (yield* decode(Schema.Array(AccountLink), appLinks)).map((link) => [
-            link.requirement,
-            link.account.label,
-          ]),
-        ).toEqual([["workspace", "main (workspace)"]]);
-
-        // Tools keep v1's names, through every linked account; the blocked one is left out.
-        const widgetTools = yield* call(
-          "List the imported tools",
-          "GET",
-          `/api/organizations/${target.id}/apps/${widgets?.id}/tools`,
-        );
-        expect(widgetTools.status, JSON.stringify(widgetTools.body)).toBe(200);
-        const tools = yield* decode(Tools, widgetTools);
-        expect(tools.items.map((tool) => tool.name).sort()).toEqual([
-          "widgets.create",
-          "widgets.list",
-        ]);
-      }).pipe(Effect.provide(services)),
+          yield* initialize(
+            sign({ toolkit: "tk_other", connection: otherRow }),
+            `?connection=${otherRow}`,
+          ),
+        ).toBe(403);
+        expect(yield* initialize(sign(toolkit), toolkitQuery)).toBe(200);
+      }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
     ),
   );
-  it.effect(scenarios.v1ImportChecks.title, (context) =>
-    withCase(
-      context,
-      Effect.gen(function* () {
-        const emulators = yield* Emulators;
-        const upstream = yield* checkedApi;
-        const identity = yield* emulators.identity("google");
-        const own = yield* emulators.v1Workspace([identity.email]);
-        const seeded = yield* seedChecks(
-          own.organization,
-          own.user,
-          `v1-${randomUUID().slice(0, 8)}`,
-          upstream.origin,
-        );
-        yield* googleSignIn(identity.email);
-
-        const { target, results } = yield* importOnServer(own.organization);
-        // Rules v1 never applied have nothing to import; they are not failures.
-        expect(results.get("executor.code.*")).toEqual({
-          status: "skipped",
-          reason: "It applies to v1's built-in tools, which v2 does not have.",
-        });
-        expect(results.get("Checked API")?.status, results.get("Checked API")?.reason).toBe(
-          "imported",
-        );
-        expect(results.get("Fixed MCP")?.status, results.get("Fixed MCP")?.reason).toBe("imported");
-        expect(results.get("Compiled API")?.status, results.get("Compiled API")?.reason).toBe(
-          "imported",
-        );
-        // Two operations that share a template keep their own tools: the stored row is the first
-        // one's, and the second keeps the tool v1 compiled for it.
-        expect(results.get("Merged API")?.status, results.get("Merged API")?.reason).toBe(
-          "imported",
-        );
-        // A tool v1 listed that the document does not name fails the integration by name.
-        expect(results.get("Unmatched API")).toMatchObject({
-          status: "failed",
-          reason: "v2 would not provide 1 of its v1 tools: items.archive.",
-        });
-        for (const name of [...Object.keys(keys), "fixed", "anonymous"])
-          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
-        // The tool v1 listed twice is imported once, under its lower snake case name.
-        expect(results.get("Fixed MCP")?.note).toBe(
-          "v1 listed a tool under two names; search_issues is now searchissues.",
-        );
-        expect(results.get("removed_service.*")).toEqual({
-          status: "skipped",
-          reason: "Its integration no longer exists in v1.",
-        });
-        expect(results.get("executor.code.*")?.status).toBe("skipped");
-        // A rule that matches no tool v1 listed still moves, and says so.
-        expect(results.get(`${seeded.api}.*.*.me.unlisted`)).toMatchObject({
-          status: "imported",
-          note: "It matches no tool v1 last listed for its integration.",
-        });
-
-        const inventory = yield* call(
-          "Read the new organization",
-          "GET",
-          `/api/organizations/${target.id}/inventory`,
-        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
-        const appId = (name: string) => inventory.apps.find((app) => app.name === name)?.id;
-        const accountId = (label: string) =>
-          inventory.accounts.find((account) => account.label === label)?.id;
-
-        // The fixed credential is the MCP account's field; only the non-credential header stays in
-        // the app's source.
-        expect(accountId("fixed")).toBeDefined();
-        // The connection without credentials is an account of the app's "No credentials" method.
-        expect(accountId("anonymous")).toBeDefined();
-
-        // Without stored operations, the tools v1 listed keep the names v1 compiled for them.
-        const compiledApp = appId("Compiled API");
-        expect(inventory.links.some((link) => link.app === compiledApp)).toBe(true);
-        const compiledTools = yield* call(
-          "List the compiled API's tools",
-          "GET",
-          `/api/organizations/${target.id}/apps/${compiledApp}/tools`,
-        );
-        expect(compiledTools.status, JSON.stringify(compiledTools.body)).toBe(200);
-        expect((yield* decode(Tools, compiledTools)).items.map((tool) => tool.name).sort()).toEqual(
-          compiledV1Names,
-        );
-        const source = yield* call(
-          "Read the MCP app's deployed source",
-          "GET",
-          `/api/organizations/${target.id}/apps/${appId("Fixed MCP")}/source`,
-        );
-        expect(source.status, JSON.stringify(source.body)).toBe(200);
-        const files = (yield* decode(Source, source)).files;
-        const written = JSON.stringify(files);
-        expect(written).not.toContain(fixedSecret);
-        expect(written).toContain("X-Client");
-        expect(files.find((file) => file.path === "provider.ts")?.content).toContain(
-          '"fixed header Authorization"',
-        );
 
-        // v1's check: its request and identity field for a working key, Google's disabled-API 403
-        // as a missing permission rather than a refused sign-in, a refused key, and a redirect, which
-        // fails the check without sending the key on to the plain HTTP page it names.
-        const check = (label: string) =>
-          call(
-            `Check the ${label} account`,
-            "POST",
-            `/api/organizations/${target.id}/accounts/${accountId(label)}/health`,
-          ).pipe(
-            Effect.tap((response) =>
-              Effect.sync(() => expect(response.status, JSON.stringify(response.body)).toBe(200)),
+  it.effect(
+    scenarios.v1ImportOptInToolkits.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const emulators = yield* Emulators,
+            fs = yield* FileSystem.FileSystem,
+            target = yield* Target,
+            mcp = yield* McpClient;
+          const upstream = yield* credentialUpstream;
+          const { secret } = yield* fs
+            .readFileString(`${target.directory}/${v1McpForwardFile}`)
+            .pipe(
+              Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
+            );
+          const identity = yield* emulators.identity("google");
+          // The opt-in import copied the organization to v2 while v1 kept serving it. The copy is
+          // made by importing a twin organization and handing its import map to this one.
+          const twin = yield* emulators.v1Workspace([identity.email]);
+          yield* seedToolkitCalls(
+            twin.organization,
+            twin.user,
+            `v1-${randomUUID().slice(0, 8)}`,
+            upstream.origin,
+          );
+          yield* googleSignIn(identity.email);
+          const copied = yield* importOnServer(twin.organization);
+          const organization = copied.target.id;
+          const own = yield* emulators.v1Workspace([identity.email]);
+          yield* seedToolkitCalls(
+            own.organization,
+            own.user,
+            `v1-${randomUUID().slice(0, 8)}`,
+            upstream.origin,
+          );
+          const [pairs = []] = yield* writeRows("v1-database.json", [
+            {
+              sql: `select twin.row_id as twin, own.row_id as own, twin.key from (
+                  select row_id, 'integration:' || name as key from integration where tenant = $1
+                  union all select row_id, 'connection:' || name from connection where tenant = $1
+                  union all select row_id, 'toolkit:' || (data->>'name') from plugin_storage
+                    where tenant = $1 and plugin_id = 'toolkits' and collection = 'toolkits'
+                ) twin join (
+                  select row_id, 'integration:' || name as key from integration where tenant = $2
+                  union all select row_id, 'connection:' || name from connection where tenant = $2
+                  union all select row_id, 'toolkit:' || (data->>'name') from plugin_storage
+                    where tenant = $2 and plugin_id = 'toolkits' and collection = 'toolkits'
+                ) own using (key)`,
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const matched = yield* Schema.decodeUnknownEffect(
+            Schema.Array(
+              Schema.Struct({ twin: Schema.String, own: Schema.String, key: Schema.String }),
             ),
-            Effect.flatMap((response) => decode(Health, response)),
+          )(pairs);
+          const rowOf = (name: string) =>
+            matched.find((pair) => pair.key === `toolkit:${name}`) ?? { twin: "", own: "" };
+          const team = rowOf("Team ledger");
+          const mine = rowOf("My ledger");
+          // The opt-in import keyed each toolkit's one copy by the toolkit alone, with an id from the
+          // toolkit and the organization.
+          const optInId = (row: string) =>
+            `v1-${createHash("sha256")
+              .update(JSON.stringify([organization, row]))
+              .digest("hex")
+              .slice(0, 40)}`;
+          yield* writeRows("sso-database.json", [
+            ...[team, mine].flatMap((row) => [
+              {
+                sql: `update "mcpConnection" set id = $2 where id = $1`,
+                params: [
+                  v1ToolkitConnectionId(organization, row.twin, twin.user),
+                  optInId(row.own),
+                ],
+              },
+              {
+                sql: "update private_v1_import_map set v1_id = $2, v2_id = $3 where v1_kind = 'toolkit' and v1_id = $1",
+                params: [`${row.twin}:${twin.user}`, row.own, optInId(row.own)],
+              },
+            ]),
+            ...[
+              ...matched.filter((pair) => !pair.key.startsWith("toolkit:")),
+              { twin: twin.organization, own: own.organization },
+            ].map((pair) => ({
+              sql: "update private_v1_import_map set v1_id = $2 where v1_org_id = $3 and v1_id = $1",
+              params: [pair.twin, pair.own, twin.organization],
+            })),
+            {
+              sql: "update private_v1_import_map set v1_org_id = $2 where v1_org_id = $1",
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const listConnections = (step: string) =>
+            call(step, "GET", `/api/organizations/${organization}/mcp-connections`).pipe(
+              Effect.flatMap((response) => decode(Connections, response)),
+            );
+          // The member renames their own toolkit's copy in v2.
+          const before = yield* listConnections("List the opt-in copies");
+          const renamed = yield* call(
+            "Rename a toolkit copy in v2",
+            "PUT",
+            `/api/organizations/${organization}/mcp-connections/${optInId(mine.own)}`,
+            {
+              name: "Renamed in v2",
+              apps: before.find((connection) => connection.id === optInId(mine.own))?.policy.apps,
+            },
           );
-        const checked = appId("Checked API");
-        const verdict = (health: typeof Health.Type) =>
-          health.apps.find((app) => app.app === checked);
-        const good = yield* check("good");
-        expect(verdict(good)).toMatchObject({ checkable: true, check: { status: "healthy" } });
-        expect(good.info?.email).toBe(checkedEmail);
-        expect(verdict(yield* check("disabled"))?.check?.status).toBe("forbidden");
-        expect(verdict(yield* check("revoked"))?.check?.status).toBe("credentials_rejected");
-        expect(verdict(yield* check("redirected"))?.check).toMatchObject({
-          status: "check_failed",
-          message:
-            "The service redirected the check (HTTP 302); an account's credentials never follow a redirect.",
-        });
-        expect(yield* upstream.received).toEqual(
-          [keys.good, keys.disabled, keys.revoked, keys.redirected].map((key) => ({
-            path: "/v1/me?fields=email",
-            key,
-          })),
-        );
-        expect(yield* upstream.landed).toEqual([]);
-      }).pipe(Effect.provide(services)),
-    ),
+          expect(renamed.status, JSON.stringify(renamed.body)).toBe(200);
+
+          // The move updates the copy the member kept and keeps the one they changed; neither gets
+          // a second copy.
+          const moved = yield* importOnServer(own.organization);
+          expect(moved.target).toEqual(copied.target);
+          expect(moved.report.cutover).toBe(true);
+          expect(moved.results.get("Team ledger")).toMatchObject({
+            status: "imported",
+            v2Id: optInId(team.own),
+          });
+          expect(moved.results.get("My ledger")).toMatchObject({
+            status: "imported",
+            v2Id: optInId(mine.own),
+            note: "Kept as its users changed it in v2 after an earlier run imported it.",
+          });
+          const after = yield* listConnections("List the moved copies");
+          expect(after.map((connection) => [connection.id, connection.name]).sort()).toEqual(
+            [
+              [optInId(team.own), "Team ledger"],
+              [optInId(mine.own), "Renamed in v2"],
+            ].sort(),
+          );
+
+          // v1 forwards each toolkit's URL with the id the import gives a copy now; the request runs
+          // under the member's own copy.
+          let minted = 0;
+          const sign = (claims: Partial<V1ForwardClaims>) =>
+            Redacted.make(
+              v1ForwardBearer(secret, {
+                account: own.user,
+                organization: own.organization,
+                exp: Math.floor(Date.now() / 1000) + 300 + minted++,
+                ...claims,
+              }),
+            );
+          for (const row of [team.own, mine.own]) {
+            const connection = v1ToolkitConnectionId(organization, row, own.user);
+            const client = yield* mcp.connect(
+              () => sign({ toolkit: row, connection }),
+              `opt-in-${row}`,
+              { connection },
+            );
+            const searched = yield* client
+              .use(`Search through the copy of ${row}`, (client, signal) =>
+                client.callTool(
+                  {
+                    name: "execute",
+                    arguments: { code: `return await tools.search({query: "entries", limit: 50})` },
+                  },
+                  undefined,
+                  { signal },
+                ),
+              )
+              .pipe(
+                Effect.flatMap((result) =>
+                  Schema.decodeUnknownEffect(Execution)(result.structuredContent),
+                ),
+                Effect.flatMap((done) =>
+                  Schema.decodeUnknownEffect(
+                    Schema.Struct({ items: Schema.Array(Schema.Struct({ path: Schema.String })) }),
+                  )(done.execution.value),
+                ),
+              );
+            expect(searched.items.map((item) => item.path)).toHaveLength(1);
+          }
+        }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+      ),
+    // It copies a twin organization and moves this one: two runs of the import.
+    { timeout: 180_000 },
   );
 
-  it.effect(scenarios.v1ImportToolkits.title, (context) =>
+  it.effect(scenarios.v1ImportToolkitCalls.title, (context) =>
     withCase(
       context,
       Effect.gen(function* () {
-        const emulators = yield* Emulators;
+        const emulators = yield* Emulators,
+          fs = yield* FileSystem.FileSystem,
+          target = yield* Target,
+          mcp = yield* McpClient;
+        const upstream = yield* credentialUpstream;
+        const { secret } = yield* fs
+          .readFileString(`${target.directory}/${v1McpForwardFile}`)
+          .pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
+          );
         const identity = yield* emulators.identity("google");
         const own = yield* emulators.v1Workspace([identity.email]);
-        const seeded = yield* seedToolkits(
+        yield* seedToolkitCalls(
           own.organization,
           own.user,
           `v1-${randomUUID().slice(0, 8)}`,
+          upstream.origin,
+        );
+        // The service answers only the two keys, each where v1 sent it.
+        yield* upstream.issue(
+          Object.values(ledgerKeys).map((value) => ({ in: "header", name: "x-api-key", value })),
         );
         yield* googleSignIn(identity.email);
 
-        const { target, results } = yield* importOnServer(own.organization);
-        for (const name of ["Hosted", "Open", "main", "first", "second"])
+        const { report, target: imported, results } = yield* importOnServer(own.organization);
+        for (const name of ["Ledger", "shared", "mine", "Team ledger", "My ledger"])
           expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
-
-        // The personal toolkit: its granted tools and accounts, without the tool it blocked; the
-        // tool the workspace blocks is not in the app, so the toolkit cannot select it.
-        const support = results.get("Support");
-        expect(support).toMatchObject({
-          status: "imported",
-          note: "1 tool v1 allowed only through this toolkit is blocked in the workspace, so it is left out: Hosted purge_items.",
-        });
-        expect(results.get("Shared")).toMatchObject({
-          status: "imported",
-          note: grantsNoConnection,
-        });
+        expect(report.cutover).toBe(true);
         const inventory = yield* call(
           "Read the new organization",
           "GET",
-          `/api/organizations/${target.id}/inventory`,
+          `/api/organizations/${imported.id}/inventory`,
         ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
-        const appId = (name: string) => inventory.apps.find((app) => app.name === name)?.id;
+        const app = inventory.apps.find((candidate) => candidate.name === "Ledger")?.id;
         const connections = yield* call(
           "List the scoped MCP connections",
           "GET",
-          `/api/organizations/${target.id}/mcp-connections`,
+          `/api/organizations/${imported.id}/mcp-connections`,
         ).pipe(Effect.flatMap((response) => decode(Connections, response)));
-        const scoped = connections.find((connection) => connection.id === support?.v2Id);
-        expect(scoped?.name).toBe("Support");
-        expect(scoped?.url).toContain(`connection=${support?.v2Id}`);
-        expect([...(scoped?.policy.apps ?? [])].sort((a, b) => (a.app < b.app ? -1 : 1))).toEqual(
-          [
+        const policyOf = (toolkit: string) =>
+          connections.find((connection) => connection.id === results.get(toolkit)?.v2Id)?.policy
+            .apps;
+        // The workspace's account is linked to the app for everyone, so the org toolkit's copy runs
+        // as the app; the member's toolkit runs as their own account.
+        expect(policyOf("Team ledger")).toEqual([
+          { app, runsAs: [{ kind: "app" }], tools: { kind: "selected", names: ["entries.list"] } },
+        ]);
+        expect(policyOf("My ledger")).toEqual([
+          {
+            app,
+            runsAs: [{ kind: "account", id: results.get("mine")?.v2Id }],
+            tools: { kind: "selected", names: ["entries.list"] },
+          },
+        ]);
+
+        let minted = 0;
+        const sign = (claims: Partial<V1ForwardClaims>) =>
+          Redacted.make(
+            v1ForwardBearer(secret, {
+              account: own.user,
+              organization: own.organization,
+              exp: Math.floor(Date.now() / 1000) + 300 + minted++,
+              ...claims,
+            }),
+          );
+        const Found = Schema.Struct({
+          items: Schema.Array(Schema.Struct({ path: Schema.String })),
+        });
+        // Through the v1 URL of each toolkit, as v1 forwards it to the caller's own copy: search
+        // finds the tool, and calling it with the connection's account reaches the service with
+        // that connection's key.
+        for (const [toolkit, connection, key] of [
+          ["Team ledger", "shared", ledgerKeys.shared],
+          ["My ledger", "mine", ledgerKeys.mine],
+        ] as const) {
+          const row = report.items?.find(
+            (item) => item.kind === "toolkit" && item.label === toolkit,
+          )?.id;
+          if (row === undefined) return yield* Effect.die(`The import has no ${toolkit} toolkit`);
+          const copy = v1ToolkitConnectionId(imported.id, row, own.user);
+          expect(results.get(toolkit)?.v2Id).toBe(copy);
+          const client = yield* mcp.connect(
+            () => sign({ toolkit: row, connection: copy }),
+            `toolkit-${connection}`,
+            { connection: copy },
+          );
+          const run = (operation: string, code: string) =>
+            client
+              .use(operation, (client, signal) =>
+                client.callTool({ name: "execute", arguments: { code } }, undefined, { signal }),
+              )
+              .pipe(
+                Effect.flatMap((result) =>
+                  Schema.decodeUnknownEffect(Execution)(result.structuredContent),
+                ),
+              );
+          const searched = yield* run(
+            `Search ${toolkit}`,
+            `return await tools.search({query: "entries", limit: 50})`,
+          );
+          expect(searched.execution.ok, JSON.stringify(searched)).toBe(true);
+          const paths = (yield* Schema.decodeUnknownEffect(Found)(searched.execution.value)).items
+            .map((item) => item.path)
+            .filter((path) => path.endsWith("entries.list"));
+          expect(paths, JSON.stringify(searched)).toHaveLength(1);
+          const [path] = paths;
+          const callWith = (operation: string, account: string | undefined) =>
+            run(
+              operation,
+              `return await ${(path ?? "")
+                .split(".")
+                .map((part, index) => (index === 0 ? part : `[${JSON.stringify(part)}]`))
+                .join("")}(${JSON.stringify({ accountId: account, input: {} })})`,
+            );
+          const called = yield* callWith(
+            `Call entries.list through ${toolkit}`,
+            results.get(connection)?.v2Id,
+          );
+          expect(called.execution.ok, JSON.stringify(called)).toBe(true);
+          const received = yield* upstream.received;
+          expect(received.at(-1)?.url).toBe("/ledger/entries");
+          expect(received.at(-1)?.headers["x-api-key"]).toBe(key);
+          // The org toolkit's copy grants no member's own account: a call with one is refused
+          // before it reaches the service. App accounts follow app access, so the personal copy
+          // is not narrowed away from the workspace's account.
+          if (connection === "shared") {
+            const crossed = yield* callWith(
+              `Call entries.list through ${toolkit} as mine`,
+              results.get("mine")?.v2Id,
+            );
+            expect(crossed.execution.ok, JSON.stringify(crossed)).toBe(false);
+            expect(yield* upstream.received).toHaveLength(received.length);
+          }
+        }
+      }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+    ),
+  );
+
+  it.effect(
+    scenarios.v1ImportSplitConnections.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const emulators = yield* Emulators,
+            fs = yield* FileSystem.FileSystem,
+            target = yield* Target,
+            mcp = yield* McpClient;
+          const operator = yield* v1ImportOperator;
+          const upstream = yield* credentialUpstream;
+          const { secret } = yield* fs
+            .readFileString(`${target.directory}/${v1McpForwardFile}`)
+            .pipe(
+              Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
+            );
+          const identity = yield* emulators.identity("google");
+          // The first run imports a twin workspace; handing its import map to this one makes this
+          // one's import run again over what the first made, as a restarted import does.
+          const twin = yield* emulators.v1Workspace([identity.email]);
+          const names = randomUUID().slice(0, 6);
+          yield* seedSplitConnections(
+            twin.organization,
+            twin.user,
+            `v1-${randomUUID().slice(0, 8)}`,
+            upstream.origin,
+            names,
+          );
+          // The service answers only the connections' keys, each where v1 sent it.
+          yield* upstream.issue(
+            Object.values(splitKeys).map((value) => ({ in: "header", name: "x-api-key", value })),
+          );
+          yield* googleSignIn(identity.email);
+          const appsOf = (report: V1Report, label: string) =>
+            [
+              ...(report.splitIntegrations?.find((split) => split.label === label)?.apps ?? []),
+            ].sort((a, b) => (a.label < b.label ? -1 : 1));
+
+          // The dry run plans Ledger as an app per connection, each with its own rules. Notes,
+          // whose moving connections share their rules, and Signals, whose connections differ only
+          // in when they listed a tool, stay one app each.
+          const dry = v1RunId("split-dry");
+          const started = yield* operator.start({
+            mode: "dry-run",
+            runId: dry,
+            organizations: [twin.organization],
+          });
+          expect(started.status, JSON.stringify(started.body)).toBe(200);
+          const planned = yield* operator.waitForReport(dry, twin.organization);
+          expect(planned.status, planned.reason ?? "").toBe("planned");
+          expect(planned.splitIntegrations?.map((split) => split.label)).toEqual(["Ledger"]);
+          expect(
+            appsOf(planned, "Ledger").map(({ label, owner, name, status, rules }) => ({
+              label,
+              owner,
+              name,
+              status,
+              rules,
+            })),
+          ).toEqual([
             {
-              app: appId("Hosted"),
-              // The connection's result is the account it linked, which the grant targets.
-              runsAs: [{ kind: "account", id: results.get("main")?.v2Id }],
-              tools: { kind: "selected", names: ["create_item", "list_items"] },
+              label: "bot",
+              owner: "org",
+              name: "Ledger (bot)",
+              status: "planned",
+              rules: { omitted: 1, always: 0, never: 0, otherwise: null },
             },
             {
-              app: appId("Open"),
-              runsAs: [{ kind: "app" }],
-              tools: { kind: "selected", names: ["search"] },
+              label: "mine",
+              owner: "user",
+              name: "Ledger (mine)",
+              status: "planned",
+              rules: { omitted: 0, always: 0, never: 0, otherwise: null },
             },
-          ].sort((a, b) => ((a.app ?? "") < (b.app ?? "") ? -1 : 1)),
+            {
+              label: "reader",
+              owner: "org",
+              name: "Ledger (reader)",
+              status: "planned",
+              rules: { omitted: 1, always: 0, never: 0, otherwise: null },
+            },
+          ]);
+          expect(planned.counts.v2.apps).toBe(5);
+
+          const first = yield* importOnServer(twin.organization);
+          const imported = first.target;
+          expect(first.report.cutover, first.report.reason ?? "").toBe(true);
+          for (const label of ["Ledger", "Notes", "Signals"])
+            expect(statuses(first.items, "integration", label), label).toEqual(["imported"]);
+          for (const label of ["bot", "reader", "mine", "alpha", "beta", "east", "west"])
+            expect(statuses(first.items, "connection", label), label).toEqual(["imported"]);
+          // The connection that cannot move counts for no app's rules.
+          expect(statuses(first.items, "connection", "gamma")).toEqual(["skipped"]);
+          const ledgerApps = appsOf(first.report, "Ledger");
+          expect(ledgerApps.map((app) => [app.name, app.status])).toEqual([
+            ["Ledger (bot)", "imported"],
+            ["Ledger (mine)", "imported"],
+            ["Ledger (reader)", "imported"],
+          ]);
+
+          const SlugInventory = Schema.Struct({
+            ...Inventory.fields,
+            apps: Schema.Array(
+              Schema.Struct({ id: Schema.String, name: Schema.String, slug: Schema.String }),
+            ),
+          });
+          const readInventory = (step: string) =>
+            call(step, "GET", `/api/organizations/${imported.id}/inventory`).pipe(
+              Effect.flatMap((response) => decode(SlugInventory, response)),
+            );
+          const seededApps = /^(Ledger|Notes|Signals)\b/u;
+          const seededAccounts = ["bot", "reader", "mine", "alpha", "beta"];
+          const before = yield* readInventory("Read the organization after the first run");
+          const appList = (inventory: typeof before) =>
+            inventory.apps
+              .filter((app) => seededApps.test(app.name))
+              .map((app) => [app.name, app.id])
+              .sort();
+          expect(appList(before).map(([name]) => name)).toEqual([
+            "Ledger (bot)",
+            "Ledger (mine)",
+            "Ledger (reader)",
+            "Notes",
+            "Signals",
+          ]);
+          const appOf = (name: string) => before.apps.find((app) => app.name === name);
+          const accountOf = (label: string) =>
+            before.accounts.find((account) => account.label === label)?.id;
+          expect(ledgerApps.map((app) => app.v2Id)).toEqual(
+            ["Ledger (bot)", "Ledger (mine)", "Ledger (reader)"].map((name) => appOf(name)?.id),
+          );
+          // Each app has exactly its connection's account: a workspace connection's linked for
+          // everyone, the member's for them. Notes keeps both of its own.
+          const linked = (name: string) =>
+            Effect.gen(function* () {
+              const scopes: Record<string, unknown> = {};
+              for (const scope of ["app", "user"] as const) {
+                const links = yield* call(
+                  `List ${name}'s ${scope} links`,
+                  "GET",
+                  `/api/organizations/${imported.id}/apps/${appOf(name)?.id}/accounts/${scope}`,
+                );
+                expect(links.status, JSON.stringify(links.body)).toBe(200);
+                scopes[scope] = (yield* decode(Schema.Array(AccountLink), links))
+                  .map((link) => [link.requirement, link.account.label])
+                  .sort();
+              }
+              return scopes;
+            });
+          expect(yield* linked("Ledger (bot)")).toEqual({ app: [["workspace", "bot"]], user: [] });
+          expect(yield* linked("Ledger (reader)")).toEqual({
+            app: [["workspace", "reader"]],
+            user: [],
+          });
+          expect(yield* linked("Ledger (mine)")).toEqual({ app: [], user: [["service", "mine"]] });
+          expect(yield* linked("Notes")).toEqual({
+            app: [
+              ["workspace", "alpha"],
+              ["workspace", "beta"],
+            ],
+            user: [],
+          });
+          // The member's connection was theirs alone in v1, so its app is private to them.
+          for (const [name, audience] of [
+            ["Ledger (bot)", "everyone"],
+            ["Ledger (reader)", "everyone"],
+            ["Ledger (mine)", "private"],
+          ] as const) {
+            const access = yield* call(
+              `Read ${name}'s access`,
+              "GET",
+              `/api/organizations/${imported.id}/apps/${appOf(name)?.id}/access`,
+            );
+            expect(access.status, JSON.stringify(access.body)).toBe(200);
+            expect(access.body, name).toMatchObject({ audience: { kind: audience } });
+          }
+
+          // Each app has the tools v1 gave its connection alone.
+          const toolsOf = (name: string) =>
+            call(
+              `List ${name}'s tools`,
+              "GET",
+              `/api/organizations/${imported.id}/apps/${appOf(name)?.id}/tools`,
+            ).pipe(
+              Effect.flatMap((response) => decode(Tools, response)),
+              Effect.map((tools) => tools.items.map((tool) => tool.name).sort()),
+            );
+          expect(yield* toolsOf("Ledger (bot)")).toEqual(["entries.create", "entries.list"]);
+          expect(yield* toolsOf("Ledger (reader)")).toEqual(["entries.list", "entries.search"]);
+          expect(yield* toolsOf("Ledger (mine)")).toEqual([
+            "entries.create",
+            "entries.list",
+            "entries.search",
+          ]);
+          expect(yield* toolsOf("Notes")).toEqual(["notes.list"]);
+          const signals = (yield* appSource(imported.id, appOf("Signals")?.id)).find(
+            (file) => file.path === "tools.ts",
+          );
+          expect(signals?.content).toContain('"erase": "always"');
+
+          // Each call runs with its connection's own key, under its connection's rules.
+          for (const [name, account, tool, kind, outcome, path] of [
+            ["Ledger (reader)", "reader", "entries.search", "query", 200, "/ledger/entries/search"],
+            ["Ledger (bot)", "bot", "entries.list", "query", 200, "/ledger/entries"],
+            ["Ledger (mine)", "mine", "entries.search", "query", 200, "/ledger/entries/search"],
+            ["Ledger (bot)", "bot", "entries.create", "mutation", 409, null],
+            ["Ledger (bot)", "bot", "entries.search", "query", 404, null],
+          ] as const) {
+            const sent = yield* upstream.received;
+            const result = yield* call(
+              `Call ${tool} on ${name}`,
+              "POST",
+              `/api/organizations/${imported.id}/apps/${appOf(name)?.id}/tools/call`,
+              { tool, kind, input: { accountId: accountOf(account), input: {} } },
+            );
+            expect(result.status, `${name} ${tool}: ${JSON.stringify(result.body)}`).toBe(outcome);
+            const received = yield* upstream.received;
+            if (path === null) {
+              expect(result.body).toMatchObject({
+                _tag: outcome === 409 ? "ToolApprovalRequired" : "ToolNotFound",
+              });
+              expect(received).toHaveLength(sent.length);
+            } else {
+              expect(received.at(-1)?.url).toBe(path);
+              expect(received.at(-1)?.headers["x-api-key"]).toBe(splitKeys[account]);
+            }
+          }
+
+          // The org toolkit over both workspace connections selects both of their apps, each with
+          // the tools granted through its connection.
+          const listConnections = (step: string) =>
+            call(step, "GET", `/api/organizations/${imported.id}/mcp-connections`).pipe(
+              Effect.flatMap((response) => decode(Connections, response)),
+            );
+          const byApp = (
+            a: { readonly app: string | undefined },
+            b: { readonly app: string | undefined },
+          ) => ((a.app ?? "") < (b.app ?? "") ? -1 : 1);
+          const copies = yield* listConnections("List the toolkit's copies");
+          expect(copies).toHaveLength(1);
+          expect([...(copies[0]?.policy.apps ?? [])].sort(byApp)).toEqual(
+            [
+              {
+                app: appOf("Ledger (bot)")?.id,
+                runsAs: [{ kind: "app" }],
+                tools: { kind: "selected", names: ["entries.create", "entries.list"] },
+              },
+              {
+                app: appOf("Ledger (reader)")?.id,
+                runsAs: [{ kind: "app" }],
+                tools: { kind: "selected", names: ["entries.list", "entries.search"] },
+              },
+            ].sort(byApp),
+          );
+
+          // This workspace takes over the twin's import map, matched by name, and its own import
+          // runs over it: it updates every app, account and toolkit copy the first run made and
+          // creates none.
+          const own = yield* emulators.v1Workspace([identity.email]);
+          yield* seedSplitConnections(
+            own.organization,
+            own.user,
+            `v1-${randomUUID().slice(0, 8)}`,
+            upstream.origin,
+            names,
+          );
+          const [pairs = []] = yield* writeRows("v1-database.json", [
+            {
+              sql: `select twin.row_id as twin, own.row_id as own, twin.key from (
+                  select row_id, 'integration:' || name as key from integration where tenant = $1
+                  union all select row_id, 'connection:' || name from connection where tenant = $1
+                  union all select row_id, 'tool_policy:' || pattern from tool_policy where tenant = $1
+                  union all select row_id, 'toolkit:' || (data->>'name') from plugin_storage
+                    where tenant = $1 and plugin_id = 'toolkits' and collection = 'toolkits'
+                ) twin join (
+                  select row_id, 'integration:' || name as key from integration where tenant = $2
+                  union all select row_id, 'connection:' || name from connection where tenant = $2
+                  union all select row_id, 'tool_policy:' || pattern from tool_policy where tenant = $2
+                  union all select row_id, 'toolkit:' || (data->>'name') from plugin_storage
+                    where tenant = $2 and plugin_id = 'toolkits' and collection = 'toolkits'
+                ) own using (key)`,
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const matched = yield* Schema.decodeUnknownEffect(
+            Schema.Array(
+              Schema.Struct({ twin: Schema.String, own: Schema.String, key: Schema.String }),
+            ),
+          )(pairs);
+          const toolkitRow = matched.find((pair) => pair.key === "toolkit:Ledger team");
+          if (toolkitRow === undefined) return yield* Effect.die("The twin has no toolkit");
+          // The member's toolkit copy keeps the id v1 computes for this workspace's toolkit.
+          const copy = v1ToolkitConnectionId(imported.id, toolkitRow.own, own.user);
+          yield* writeRows("sso-database.json", [
+            {
+              sql: `update "mcpConnection" set id = $2 where id = $1`,
+              params: [v1ToolkitConnectionId(imported.id, toolkitRow.twin, twin.user), copy],
+            },
+            {
+              sql: "update private_v1_import_map set v1_id = $2, v2_id = $3 where v1_kind = 'toolkit' and v1_id = $1",
+              params: [`${toolkitRow.twin}:${twin.user}`, `${toolkitRow.own}:${own.user}`, copy],
+            },
+            ...[
+              ...matched.filter((pair) => pair !== toolkitRow),
+              { twin: twin.organization, own: own.organization },
+            ].map((pair) => ({
+              sql: "update private_v1_import_map set v1_id = $2 where v1_org_id = $3 and v1_id = $1",
+              params: [pair.twin, pair.own, twin.organization],
+            })),
+            {
+              sql: "update private_v1_import_map set v1_org_id = $2 where v1_org_id = $1",
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const second = yield* importOnServer(own.organization);
+          expect(second.target).toEqual(imported);
+          expect(second.report.cutover, second.report.reason ?? "").toBe(true);
+          expect(appsOf(second.report, "Ledger").map((app) => [app.name, app.v2Id])).toEqual(
+            ledgerApps.map((app) => [app.name, app.v2Id]),
+          );
+          for (const label of ["Notes", "Signals"])
+            expect(second.results.get(label)?.v2Id, label).toBe(appOf(label)?.id);
+          const after = yield* readInventory("Read the organization after the second run");
+          expect(appList(after)).toEqual(appList(before));
+          const accountIds = (inventory: typeof before) =>
+            inventory.accounts
+              .filter((account) => seededAccounts.includes(account.label))
+              .map((account) => account.id)
+              .sort();
+          expect(accountIds(after)).toEqual(accountIds(before));
+          expect(accountIds(after)).toHaveLength(seededAccounts.length);
+          const recopied = yield* listConnections("List the toolkit's copies again");
+          expect(recopied.map((connection) => connection.id)).toEqual([copy]);
+          expect([...(recopied[0]?.policy.apps ?? [])].sort(byApp)).toEqual(
+            [...(copies[0]?.policy.apps ?? [])].sort(byApp),
+          );
+
+          // v1 forwards the toolkit's URL to the member's copy: v1's tools through each
+          // connection reach that connection's app, with its key.
+          const toolkit = second.items.find(
+            (item) => item.kind === "toolkit" && item.label === "Ledger team",
+          );
+          expect(toolkit).toMatchObject({ id: toolkitRow.own, status: "imported", v2Id: copy });
+          let minted = 0;
+          const client = yield* mcp.connect(
+            () =>
+              Redacted.make(
+                v1ForwardBearer(secret, {
+                  account: own.user,
+                  organization: own.organization,
+                  exp: Math.floor(Date.now() / 1000) + 300 + minted++,
+                  toolkit: toolkitRow.own,
+                  connection: copy,
+                }),
+              ),
+            "toolkit-split",
+            { connection: copy },
+          );
+          const run = (operation: string, code: string) =>
+            client
+              .use(operation, (client, signal) =>
+                client.callTool({ name: "execute", arguments: { code } }, undefined, { signal }),
+              )
+              .pipe(
+                Effect.flatMap((result) =>
+                  Schema.decodeUnknownEffect(Execution)(result.structuredContent),
+                ),
+              );
+          const searched = yield* run(
+            "Search the forwarded toolkit",
+            `return await tools.search({query: "entries", limit: 50})`,
+          );
+          expect(searched.execution.ok, JSON.stringify(searched)).toBe(true);
+          const slugOf = (name: string) => appOf(name)?.slug ?? "";
+          expect(
+            (yield* Schema.decodeUnknownEffect(
+              Schema.Struct({ items: Schema.Array(Schema.Struct({ path: Schema.String })) }),
+            )(searched.execution.value)).items
+              .map((item) => item.path)
+              .sort(),
+          ).toEqual(
+            [
+              ["Ledger (bot)", "entries.create"],
+              ["Ledger (bot)", "entries.list"],
+              ["Ledger (reader)", "entries.list"],
+              ["Ledger (reader)", "entries.search"],
+            ]
+              .map(([name, tool]) => `tools[${JSON.stringify(slugOf(name ?? ""))}].${tool}`)
+              .sort(),
+          );
+          const callThrough = (name: string, tool: string, account: string) =>
+            run(
+              `Call ${tool} on ${name} through the toolkit`,
+              `return await tools[${JSON.stringify(slugOf(name))}]${tool
+                .split(".")
+                .map((part) => `[${JSON.stringify(part)}]`)
+                .join("")}(${JSON.stringify({ accountId: accountOf(account), input: {} })})`,
+            );
+          const searchedReader = yield* callThrough("Ledger (reader)", "entries.search", "reader");
+          expect(searchedReader.execution.ok, JSON.stringify(searchedReader)).toBe(true);
+          const received = yield* upstream.received;
+          expect(received.at(-1)?.url).toBe("/ledger/entries/search");
+          expect(received.at(-1)?.headers["x-api-key"]).toBe(splitKeys.reader);
+          // `bot` has no search in v1, so its app has none to call.
+          const searchedBot = yield* callThrough("Ledger (bot)", "entries.search", "bot");
+          expect(searchedBot.execution.ok, JSON.stringify(searchedBot)).toBe(false);
+          expect(yield* upstream.received).toHaveLength(received.length);
+        }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+      ),
+    // A dry run and two imports.
+    { timeout: 240_000 },
+  );
+
+  it.effect(scenarios.v1ImportStampedApprovals.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const upstream = yield* approvalMcpUpstream;
+        const identity = yield* emulators.identity("google");
+        const own = yield* emulators.v1Workspace([identity.email]);
+        yield* seedStampedApprovals(
+          own.organization,
+          `v1-${randomUUID().slice(0, 8)}`,
+          upstream.origin,
         );
-        expect(
-          connections.find((connection) => connection.id === results.get("Shared")?.v2Id)?.policy
-            .apps,
-        ).toEqual([]);
+        yield* googleSignIn(identity.email);
 
-        // The toolkit asked before creating, so the app asks every caller.
-        const source = yield* call(
-          "Read the MCP app's deployed source",
-          "GET",
-          `/api/organizations/${target.id}/apps/${appId("Hosted")}/source`,
-        ).pipe(Effect.flatMap((response) => decode(Source, response)));
-        const rules = source.files.find((file) => file.path === "tools.ts")?.content ?? "";
-        expect(rules).toContain('"create_item": "always"');
-        expect(rules).not.toContain('"delete_item"');
+        const { target: imported, results } = yield* importOnServer(own.organization);
+        for (const name of ["Approvals", "Ops"])
+          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
+        const app = results.get("Approvals")?.v2Id;
+        // v1's stamp becomes the app's own rule, so the app asks whatever the server says now.
+        // A tool v1 allowed gets no rule, and a policy's approve stays the app's `never`.
+        const tools = (yield* appSource(imported.id, app)).find((file) => file.path === "tools.ts");
+        expect(tools?.content).toContain('"unhinted": "always"');
+        expect(tools?.content).toContain('"read": "never"');
+        expect(tools?.content).not.toContain('"safe"');
 
-        // Artifacts become apps with source and no version, and say what needs repair.
-        const dashboard = results.get("Dashboard");
-        expect(dashboard).toEqual({
-          status: "imported",
-          v2Id: expect.any(String),
-          needsRepair: true,
-          note: `${repairNote} Its calls map to ${seeded.hosted} → Hosted (main). other: Its integration no longer exists in v1.`,
-        });
-        expect(results.get("Legacy view")).toMatchObject({
-          status: "imported",
-          needsRepair: true,
-          note: `${repairNote} Its calls map to ${seeded.open}.user.first → Open (first).`,
-        });
-        const apps = yield* call(
-          "List the apps",
-          "GET",
-          `/api/organizations/${target.id}/apps`,
-        ).pipe(Effect.flatMap((response) => decode(Apps, response)));
-        expect(apps.find((app) => app.id === dashboard?.v2Id)).toMatchObject({
-          name: "Dashboard",
-          activeVersion: null,
-        });
-        // Its package files are not read here: managed local Cloud has no Git storage for app
-        // source, and the v1 import runs only there.
+        // Called as the member, the stamped tool waits for approval and never reaches the server;
+        // the tools v1 allowed run.
+        for (const [tool, kind, asks] of [
+          ["unhinted", "mutation", true],
+          ["safe", "mutation", false],
+          ["read", "query", false],
+        ] as const) {
+          const before = yield* upstream.calls;
+          const result = yield* call(
+            `Call ${tool}`,
+            "POST",
+            `/api/organizations/${imported.id}/apps/${app}/tools/call`,
+            { tool, kind, input: {} },
+          );
+          if (asks) {
+            expect(result.status, `${tool}: ${JSON.stringify(result.body)}`).toBe(409);
+            expect(result.body).toMatchObject({ _tag: "ToolApprovalRequired" });
+            expect(yield* upstream.calls, tool).toEqual(before);
+          } else {
+            expect(result.status, `${tool}: ${JSON.stringify(result.body)}`).toBe(200);
+            expect(yield* upstream.calls, tool).toEqual([...before, tool]);
+          }
+        }
       }).pipe(Effect.provide(services)),
     ),
   );
 
-  it.effect(scenarios.v1ImportMcpForward.title, (context) =>
+  it.effect(scenarios.v1ImportUnlistedRules.title, (context) =>
     withCase(
       context,
       Effect.gen(function* () {
-        const emulators = yield* Emulators,
-          fs = yield* FileSystem.FileSystem,
-          target = yield* Target,
-          mcp = yield* McpClient;
-        const { secret } = yield* fs
-          .readFileString(`${target.directory}/${v1McpForwardFile}`)
-          .pipe(
-            Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
-          );
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        const upstream = yield* approvalMcpUpstream;
         const identity = yield* emulators.identity("google");
         const own = yield* emulators.v1Workspace([identity.email]);
-        const stranger = yield* emulators.v1Workspace([
-          (yield* emulators.identity("google")).email,
-        ]);
-        const seeded = yield* seedWorkspace(
+        yield* seedUnlistedRules(
           own.organization,
-          own.user,
           `v1-${randomUUID().slice(0, 8)}`,
+          upstream.origin,
         );
-        // A toolkit over the user's Widgets account that blocks creating.
-        const toolkitRow = (collection: string, data: Record<string, string>) =>
-          ({
-            sql: `insert into plugin_storage (tenant, owner, subject, plugin_id, collection, key, data) values ($1, 'user', $2, 'toolkits', $3, $4, $5::json)`,
-            params: [own.organization, own.user, collection, data.id ?? "", JSON.stringify(data)],
-          }) satisfies RowStatement;
-        yield* writeRows("v1-database.json", [
-          toolkitRow("toolkits", { id: "tk_forward", name: "Forwarded", slug: "forwarded" }),
-          toolkitRow("toolkitConnections", {
-            id: "tkconn_forward",
-            toolkitId: "tk_forward",
-            pattern: `${seeded.widgets}.user.main.*`,
-            position: "a0",
-          }),
-          toolkitRow("toolkitPolicies", {
-            id: "tkpol_forward",
-            toolkitId: "tk_forward",
-            pattern: `${seeded.widgets}.*.*.${seeded.v1Names.create}`,
-            action: "block",
-            position: "a0",
-          }),
-        ]);
         yield* googleSignIn(identity.email);
 
-        const { report, target: imported, items } = yield* importOnServer(own.organization);
-        // This workspace has an item that cannot move, so verification fails: the import does not
-        // cut it over, and v1 keeps it frozen for a person to fix and restart or roll back.
-        expect(items.some((item) => item.status === "failed")).toBe(true);
-        expect(report.verification?.passed).toBe(false);
-        expect(report.cutover).toBe(false);
-        const flag = yield* writeRows("v1-database.json", [
-          {
-            sql: "select state from org_moved_to_v2 where org_id = $1",
-            params: [own.organization],
-          },
-        ]);
-        expect(flag).toEqual([[{ state: "moving" }]]);
-        // v2 accepts what v1 forwards from the import map alone; v1 forwards only once moved.
-        const forwarded = items.find(
-          (item) => item.kind === "toolkit" && item.label === "Forwarded",
-        );
-        expect(forwarded?.status).toBe("imported");
-        if (forwarded === undefined)
-          return yield* Effect.die("The import has no Forwarded toolkit");
-        // v1 names a toolkit by its row; the connection id it computes for the caller is the id of
-        // the caller's own copy.
-        const row = forwarded.id;
-        const connection = v1ToolkitConnectionId(imported.id, row, own.user);
-        expect(forwarded.v2Id).toBe(connection);
-
-        /** A bearer as v1 signs it for one request; each is distinct and lives a few minutes. */
-        let minted = 0;
-        const sign = (claims: Partial<V1ForwardClaims> = {}, signedWith = secret) =>
-          Redacted.make(
-            v1ForwardBearer(signedWith, {
-              account: own.user,
-              organization: own.organization,
-              exp: Math.floor(Date.now() / 1000) + 300 + minted++,
-              ...claims,
-            }),
-          );
-        const toolkit = { toolkit: row, connection };
+        const { target: imported, results } = yield* importOnServer(own.organization);
+        expect(results.get("Unlisted")?.status, results.get("Unlisted")?.reason).toBe("imported");
+        const app = results.get("Unlisted")?.v2Id;
+        const tools = (yield* appSource(imported.id, app)).find((file) => file.path === "tools.ts");
+        expect(tools?.content).toContain('"read": "never"');
+        expect(tools?.content).toMatch(/const omitted = new Set<string>\(\[\s*"unhinted"\s*\]\)/u);
 
-        const run = (
-          client: Effect.Success<ReturnType<McpClient["Service"]["connect"]>>,
-          operation: string,
-          code: string,
-        ) =>
-          client
-            .use(operation, (client, signal) =>
-              client.callTool({ name: "execute", arguments: { code } }, undefined, { signal }),
-            )
-            .pipe(
-              Effect.flatMap((result) =>
-                Schema.decodeUnknownEffect(Execution)(result.structuredContent),
-              ),
-            );
-        const Found = Schema.Struct({
-          items: Schema.Array(Schema.Struct({ path: Schema.String })),
-        });
-        const search = (
-          client: Effect.Success<ReturnType<McpClient["Service"]["connect"]>>,
-          query: string,
-        ) =>
-          run(
-            client,
-            `Search for ${query}`,
-            `return await tools.search({query: ${JSON.stringify(query)}, limit: 50})`,
-          ).pipe(
-            Effect.flatMap((done) => Schema.decodeUnknownEffect(Found)(done.execution.value)),
-            Effect.map((found) => found.items.map((item) => item.path)),
+        // As the member: the tool v1 approved runs, the one its rule blocks by name is not there,
+        // and every tool no rule names waits for approval without reaching the server, even one
+        // the server does not mark destructive.
+        for (const [tool, kind, outcome] of [
+          ["read", "query", 200],
+          ["unhinted", "mutation", 404],
+          ["safe", "mutation", 409],
+          ["erase", "mutation", 409],
+        ] as const) {
+          const before = yield* upstream.calls;
+          const result = yield* call(
+            `Call ${tool}`,
+            "POST",
+            `/api/organizations/${imported.id}/apps/${app}/tools/call`,
+            { tool, kind, input: {} },
           );
+          expect(result.status, `${tool}: ${JSON.stringify(result.body)}`).toBe(outcome);
+          if (outcome === 404) expect(result.body).toMatchObject({ _tag: "ToolNotFound" });
+          if (outcome === 409) expect(result.body).toMatchObject({ _tag: "ToolApprovalRequired" });
+          expect(yield* upstream.calls, tool).toEqual(outcome === 200 ? [...before, tool] : before);
+        }
 
-        // The account and organization alone reach every imported app, with a new bearer for each
-        // request of the one session.
-        const before = minted;
-        const workspace = yield* mcp.connect(() => sign(), "forwarded-workspace");
-        const listed = yield* workspace.use(
-          "List the forwarded session's tools",
-          (client, signal) => client.listTools(undefined, { signal }),
+        // The API's read operation, which v1 compiled but never listed, asks as v1's rule says
+        // rather than running as a read.
+        expect(results.get("Status")?.status, results.get("Status")?.reason).toBe("imported");
+        const status = results.get("Status")?.v2Id;
+        const health = yield* call(
+          "Call status.health",
+          "POST",
+          `/api/organizations/${imported.id}/apps/${status}/tools/call`,
+          { tool: "status.health", kind: "query", input: {} },
         );
-        expect(listed.tools.map((tool) => tool.name)).toContain("execute");
-        const everything = yield* search(workspace, "widgets");
-        const has = (paths: readonly string[], name: string) =>
-          paths.some((path) => path.endsWith(name));
-        expect(has(everything, seeded.v1Names.list)).toBe(true);
-        expect(has(everything, seeded.v1Names.create)).toBe(true);
-        // Initialize, its notification, the listing and a search each signed their own bearer.
-        expect(minted - before).toBeGreaterThanOrEqual(4);
-
-        // A toolkit's bearer and URL reach only what the caller's copy of the toolkit grants.
-        const scoped = yield* mcp.connect(() => sign(toolkit), "forwarded-toolkit", {
-          connection,
-        });
-        const granted = yield* search(scoped, "widgets");
-        // The listing tool, and not the tool the toolkit blocks.
-        expect(granted).toHaveLength(1);
-        expect(has(granted, seeded.v1Names.list)).toBe(true);
-        expect(has(granted, seeded.v1Names.create)).toBe(false);
+        expect(health.status, JSON.stringify(health.body)).toBe(409);
+        expect(health.body).toMatchObject({ _tag: "ToolApprovalRequired" });
 
-        /** The status of one initialize request carrying this bearer, at this URL query. */
-        const initialize = (bearer: Redacted.Redacted<string>, query = "") =>
-          Effect.scoped(
-            Effect.gen(function* () {
-              const http = yield* HttpClient.HttpClient;
-              const request = HttpClientRequest.post(`${target.metadata.origin}/mcp${query}`).pipe(
-                HttpClientRequest.setHeaders({
-                  accept: "application/json, text/event-stream",
-                  authorization: `Bearer ${Redacted.value(bearer)}`,
-                }),
-              );
-              const response = yield* http.execute(
-                yield* HttpClientRequest.bodyJson(request, {
-                  jsonrpc: "2.0",
-                  id: 1,
-                  method: "initialize",
-                  params: {
-                    protocolVersion: "2025-06-18",
-                    capabilities: {},
-                    clientInfo: { name: "forwarded-refusal", version: "1" },
-                  },
-                }),
-              );
-              yield* response.text;
-              return response.status;
+        // The repair names what the rules decide for tools v1 did not list, and finds the
+        // import's own apps already hold it.
+        const repaired = yield* operator.repair(own.organization, false);
+        expect(repaired.status, JSON.stringify(repaired.body)).toBe(200);
+        expect(repaired.body).toMatchObject({
+          apps: expect.arrayContaining([
+            expect.objectContaining({
+              app,
+              always: [],
+              unlisted: { omitted: ["unhinted"], always: [], otherwise: "always" },
+              decision: "unchanged",
+              files: [],
             }),
-          ).pipe(Effect.provide(FetchHttpClient.layer));
-        const now = Math.floor(Date.now() / 1000);
-        const toolkitQuery = `?connection=${connection}`;
-        expect(yield* initialize(sign())).toBe(200);
-        // v1 vouches for no one else, and a signature or lifetime v1 did not give is refused.
-        expect(yield* initialize(sign({}, "x".repeat(64)))).toBe(401);
-        expect(yield* initialize(sign({ exp: now - 10 }))).toBe(401);
-        expect(yield* initialize(sign({ exp: now + 3_600 }))).toBe(401);
-        expect(yield* initialize(sign({ toolkit: row }), toolkitQuery)).toBe(401);
-        // A valid bearer for an account or organization the import never mapped.
-        expect(yield* initialize(sign({ account: stranger.user }))).toBe(403);
-        expect(yield* initialize(sign({ organization: stranger.organization }))).toBe(403);
-        // A toolkit connection that is not the caller's copy: another member's, or another row's.
-        const otherMember = v1ToolkitConnectionId(imported.id, row, stranger.user);
-        expect(
-          yield* initialize(
-            sign({ toolkit: row, connection: otherMember }),
-            `?connection=${otherMember}`,
-          ),
-        ).toBe(403);
-        const otherRow = v1ToolkitConnectionId(imported.id, "tk_other", own.user);
-        expect(
-          yield* initialize(
-            sign({ toolkit: "tk_other", connection: otherRow }),
-            `?connection=${otherRow}`,
-          ),
-        ).toBe(403);
-        expect(yield* initialize(sign(toolkit), toolkitQuery)).toBe(200);
-      }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+            expect.objectContaining({
+              app: status,
+              always: [],
+              unlisted: { omitted: [], always: ["status.health"], otherwise: null },
+              decision: "unchanged",
+              files: [],
+            }),
+          ]),
+        });
+      }).pipe(Effect.provide(services)),
     ),
   );
 
-  it.effect(scenarios.v1ImportToolkitCalls.title, (context) =>
+  it.effect(scenarios.v1ImportRepair.title, (context) =>
     withCase(
       context,
       Effect.gen(function* () {
-        const emulators = yield* Emulators,
-          fs = yield* FileSystem.FileSystem,
-          target = yield* Target,
-          mcp = yield* McpClient;
-        const upstream = yield* credentialUpstream;
-        const { secret } = yield* fs
-          .readFileString(`${target.directory}/${v1McpForwardFile}`)
-          .pipe(
-            Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1McpForwardSecret))),
-          );
+        const emulators = yield* Emulators;
+        const operator = yield* v1ImportOperator;
+        const upstream = yield* approvalMcpUpstream;
         const identity = yield* emulators.identity("google");
         const own = yield* emulators.v1Workspace([identity.email]);
-        yield* seedToolkitCalls(
+        yield* seedStampedApprovals(
           own.organization,
-          own.user,
           `v1-${randomUUID().slice(0, 8)}`,
           upstream.origin,
         );
-        // The service answers only the two keys, each where v1 sent it.
-        yield* upstream.issue(
-          Object.values(ledgerKeys).map((value) => ({ in: "header", name: "x-api-key", value })),
+        yield* googleSignIn(identity.email);
+        const { target: imported, results } = yield* importOnServer(own.organization);
+        expect(results.get("Approvals")?.status, results.get("Approvals")?.reason).toBe("imported");
+        const app = results.get("Approvals")?.v2Id;
+        const appPath = `/api/organizations/${imported.id}/apps/${app}`;
+        const callTool = (tool: string) =>
+          call(`Call ${tool}`, "POST", `${appPath}/tools/call`, {
+            tool,
+            kind: "mutation",
+            input: {},
+          });
+        const deploy = (step: string, files: readonly SourceFile[]) =>
+          call(step, "POST", `${appPath}/deploy`, { files }).pipe(
+            Effect.tap((response) =>
+              Effect.sync(() => expect(response.status, JSON.stringify(response.body)).toBe(200)),
+            ),
+          );
+        // The app's files by path: the repair keeps every file and replaces the ones it changes.
+        const deployed = appSource(imported.id, app).pipe(
+          Effect.map((files) => files.toSorted((a, b) => a.path.localeCompare(b.path))),
+        );
+        const withTools = (files: readonly SourceFile[], edit: (content: string) => string) =>
+          files.map((file) =>
+            file.path === "tools.ts" ? { ...file, content: edit(file.content) } : file,
+          );
+
+        const withIndex = (files: readonly SourceFile[], edit: (content: string) => string) =>
+          files.map((file) =>
+            file.path === "index.ts" ? { ...file, content: edit(file.content) } : file,
+          );
+        const asks = (tool: string) =>
+          callTool(tool).pipe(
+            Effect.tap((result) =>
+              Effect.sync(() => {
+                expect(result.status, `${tool} runs: ${JSON.stringify(result.body)}`).toBe(409);
+                expect(result.body).toMatchObject({ _tag: "ToolApprovalRequired" });
+              }),
+            ),
+          );
+        const runs = (tool: string) =>
+          callTool(tool).pipe(
+            Effect.tap((result) =>
+              Effect.sync(() =>
+                expect(result.status, `${tool} asks: ${JSON.stringify(result.body)}`).toBe(200),
+              ),
+            ),
+          );
+
+        // Make the app what an import before the fix left: no rule for the tool v1 stamped, so it
+        // runs because the server no longer marks it destructive.
+        const files = yield* deployed;
+        const earlier = withTools(files, (content) =>
+          content.replace(/\n {2}"unhinted": "always",|,\n {2}"unhinted": "always"/u, ""),
         );
-        yield* googleSignIn(identity.email);
+        expect(earlier).not.toEqual(files);
+        yield* deploy("Deploy the earlier importer's source", earlier);
+        yield* runs("unhinted");
 
-        const { report, target: imported, results } = yield* importOnServer(own.organization);
-        for (const name of ["Ledger", "shared", "mine", "Team ledger", "My ledger"])
-          expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
-        expect(report.cutover).toBe(true);
-        const inventory = yield* call(
-          "Read the new organization",
-          "GET",
-          `/api/organizations/${imported.id}/inventory`,
-        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
-        const app = inventory.apps.find((candidate) => candidate.name === "Ledger")?.id;
-        const connections = yield* call(
-          "List the scoped MCP connections",
-          "GET",
-          `/api/organizations/${imported.id}/mcp-connections`,
-        ).pipe(Effect.flatMap((response) => decode(Connections, response)));
-        const policyOf = (toolkit: string) =>
-          connections.find((connection) => connection.id === results.get(toolkit)?.v2Id)?.policy
-            .apps;
-        // The workspace's account is linked to the app for everyone, so the org toolkit's copy runs
-        // as the app; the member's toolkit runs as their own account.
-        expect(policyOf("Team ledger")).toEqual([
-          { app, runsAs: [{ kind: "app" }], tools: { kind: "selected", names: ["entries.list"] } },
-        ]);
-        expect(policyOf("My ledger")).toEqual([
+        // Planning the earlier importer's app names the change and writes nothing.
+        const planned = yield* operator.repair(own.organization, false);
+        expect(planned.status, JSON.stringify(planned.body)).toBe(200);
+        expect(planned.body).toMatchObject({
+          status: "planned",
+          applied: false,
+          apps: [
+            {
+              app,
+              always: ["unhinted"],
+              decision: "deploy",
+              source: "generated",
+              files: ["tools.ts"],
+            },
+          ],
+        });
+        expect(yield* deployed).toEqual(earlier);
+        yield* runs("unhinted");
+
+        // Applying deploys the app with v1's stamp as its rule: the import's own source again.
+        const applied = yield* operator.repair(own.organization, true);
+        expect(applied.status, JSON.stringify(applied.body)).toBe(200);
+        expect(applied.body).toMatchObject({
+          status: "repaired",
+          applied: true,
+          apps: [{ app, decision: "deploy", files: ["tools.ts"] }],
+        });
+        expect(yield* deployed).toEqual(files);
+        yield* asks("unhinted");
+        yield* runs("safe");
+
+        // An app an earlier importer wrote, whose files the importer no longer generates, is
+        // still the import's own: it gets the importer's source now.
+        const older = withIndex(earlier, (content) => `// An earlier importer.\n${content}`);
+        yield* deploy("Deploy an earlier importer's source", older);
+        yield* writeRows("sso-database.json", [
           {
-            app,
-            runsAs: [{ kind: "account", id: results.get("mine")?.v2Id }],
-            tools: { kind: "selected", names: ["entries.list"] },
+            sql: "update private_v1_import_map set updated_at = now() where v1_kind = 'integration' and v2_id = $1",
+            params: [app ?? ""],
           },
         ]);
+        yield* runs("unhinted");
+        const regenerated = yield* operator.repair(own.organization, true);
+        expect(regenerated.body).toMatchObject({
+          apps: [
+            {
+              app,
+              decision: "deploy",
+              source: "generated",
+              files: ["index.ts", "tools.ts"],
+            },
+          ],
+        });
+        expect(yield* deployed).toEqual(files);
+        yield* asks("unhinted");
 
-        let minted = 0;
-        const sign = (claims: Partial<V1ForwardClaims>) =>
-          Redacted.make(
-            v1ForwardBearer(secret, {
-              account: own.user,
-              organization: own.organization,
-              exp: Math.floor(Date.now() / 1000) + 300 + minted++,
-              ...claims,
-            }),
-          );
-        const Found = Schema.Struct({
-          items: Schema.Array(Schema.Struct({ path: Schema.String })),
+        // An app whose users changed its approvals in v2 keeps them, even where they ask less than
+        // v1 did: here they turned every approval off.
+        const relaxed = withIndex(files, (content) =>
+          content
+            .replace(
+              'import { always } from "apps/operations/approval"',
+              'import { always, never } from "apps/operations/approval"',
+            )
+            .replace(
+              "(tool, name) => approval(name) ?? (toolAnnotations(tool)?.destructiveHint === true ? always() : undefined)",
+              "() => never()",
+            ),
+        );
+        expect(relaxed.find((file) => file.path === "index.ts")?.content).toContain(
+          "() => never()",
+        );
+        expect(relaxed).not.toEqual(files);
+        yield* deploy("Turn every approval off in v2", relaxed);
+        for (const tool of ["unhinted", "erase", "safe"]) yield* runs(tool);
+        const kept = yield* operator.repair(own.organization, true);
+        expect(kept.body).toMatchObject({
+          status: "repaired",
+          apps: [{ app, always: ["unhinted"], decision: "kept", source: "edited" }],
         });
-        // Through the v1 URL of each toolkit, as v1 forwards it to the caller's own copy: search
-        // finds the tool, and calling it with the connection's account reaches the service with
-        // that connection's key.
-        for (const [toolkit, connection, key] of [
-          ["Team ledger", "shared", ledgerKeys.shared],
-          ["My ledger", "mine", ledgerKeys.mine],
-        ] as const) {
-          const row = report.items?.find(
-            (item) => item.kind === "toolkit" && item.label === toolkit,
-          )?.id;
-          if (row === undefined) return yield* Effect.die(`The import has no ${toolkit} toolkit`);
-          const copy = v1ToolkitConnectionId(imported.id, row, own.user);
-          expect(results.get(toolkit)?.v2Id).toBe(copy);
-          const client = yield* mcp.connect(
-            () => sign({ toolkit: row, connection: copy }),
-            `toolkit-${connection}`,
-            { connection: copy },
-          );
-          const run = (operation: string, code: string) =>
-            client
-              .use(operation, (client, signal) =>
-                client.callTool({ name: "execute", arguments: { code } }, undefined, { signal }),
-              )
-              .pipe(
-                Effect.flatMap((result) =>
-                  Schema.decodeUnknownEffect(Execution)(result.structuredContent),
-                ),
-              );
-          const searched = yield* run(
-            `Search ${toolkit}`,
-            `return await tools.search({query: "entries", limit: 50})`,
-          );
-          expect(searched.execution.ok, JSON.stringify(searched)).toBe(true);
-          const paths = (yield* Schema.decodeUnknownEffect(Found)(searched.execution.value)).items
-            .map((item) => item.path)
-            .filter((path) => path.endsWith("entries.list"));
-          expect(paths, JSON.stringify(searched)).toHaveLength(1);
-          const [path] = paths;
-          const callWith = (operation: string, account: string | undefined) =>
-            run(
-              operation,
-              `return await ${(path ?? "")
-                .split(".")
-                .map((part, index) => (index === 0 ? part : `[${JSON.stringify(part)}]`))
-                .join("")}(${JSON.stringify({ accountId: account, input: {} })})`,
-            );
-          const called = yield* callWith(
-            `Call entries.list through ${toolkit}`,
-            results.get(connection)?.v2Id,
-          );
-          expect(called.execution.ok, JSON.stringify(called)).toBe(true);
-          const received = yield* upstream.received;
-          expect(received.at(-1)?.url).toBe("/ledger/entries");
-          expect(received.at(-1)?.headers["x-api-key"]).toBe(key);
-          // The org toolkit's copy grants no member's own account: a call with one is refused
-          // before it reaches the service. App accounts follow app access, so the personal copy
-          // is not narrowed away from the workspace's account.
-          if (connection === "shared") {
-            const crossed = yield* callWith(
-              `Call entries.list through ${toolkit} as mine`,
-              results.get("mine")?.v2Id,
-            );
-            expect(crossed.execution.ok, JSON.stringify(crossed)).toBe(false);
-            expect(yield* upstream.received).toHaveLength(received.length);
-          }
-        }
-      }).pipe(Effect.provide(Layer.mergeAll(services, McpClient.layer))),
+        expect(yield* deployed).toEqual(relaxed);
+        for (const tool of ["unhinted", "erase", "safe"]) yield* runs(tool);
+
+        // So does code that sets no approvals of its own any more.
+        const bare = withIndex(files, (content) =>
+          content
+            .replace("withApprovals(renameTools(", "renameTools(")
+            .replace(
+              ", (tool, name) => approval(name) ?? (toolAnnotations(tool)?.destructiveHint === true ? always() : undefined))",
+              "",
+            ),
+        );
+        expect(bare.find((file) => file.path === "index.ts")?.content).not.toContain(
+          "withApprovals(",
+        );
+        yield* deploy("Drop the app's approvals in v2", bare);
+        const dropped = yield* operator.repair(own.organization, true);
+        expect(dropped.body).toMatchObject({
+          apps: [{ app, decision: "kept", source: "edited" }],
+        });
+        expect(yield* deployed).toEqual(bare);
+        for (const tool of ["unhinted", "erase", "safe"]) yield* runs(tool);
+
+        // An app its users changed in v2 beside its approvals keeps their code, and gets v1's
+        // approvals beneath it, laid out differently or not: here the earlier importer's app, whose
+        // stamped tool runs.
+        const activeVersion = call(
+          "List the apps",
+          "GET",
+          `/api/organizations/${imported.id}/apps`,
+        ).pipe(
+          Effect.flatMap((response) => decode(Apps, response)),
+          Effect.map((apps) => apps.find((found) => found.id === app)?.activeVersion),
+        );
+        const changed = withIndex(earlier, (content) =>
+          `// Changed in v2.\n${content}`.replace(
+            "(tool, name) => approval(name) ?? (toolAnnotations(tool)?.destructiveHint === true ? always() : undefined)",
+            "(tool, name) =>\n  // The app's own rule.\n  (approval(name) ?? (toolAnnotations(tool)?.destructiveHint === true ? always() : undefined))",
+          ),
+        );
+        expect(changed.find((file) => file.path === "index.ts")?.content).toContain(
+          "// The app's own rule.",
+        );
+        yield* deploy("Change the earlier importer's app in v2", changed);
+        const users = yield* activeVersion;
+        yield* runs("unhinted");
+        const plannedEdit = yield* operator.repair(own.organization, false);
+        expect(plannedEdit.body).toMatchObject({
+          apps: [
+            {
+              app,
+              always: ["unhinted"],
+              decision: "deploy",
+              source: "edited",
+              files: ["index.ts", "v1-approvals.ts"],
+            },
+          ],
+        });
+        expect(yield* deployed).toEqual(changed);
+        const layered = yield* operator.repair(own.organization, true);
+        expect(layered.body).toMatchObject({
+          status: "repaired",
+          apps: [{ app, decision: "deploy", source: "edited" }],
+        });
+        const after = yield* deployed;
+        const index = after.find((file) => file.path === "index.ts");
+        expect(index?.content).toContain('import { withApprovals } from "./v1-approvals.ts"');
+        expect(index?.content).toContain("// The app's own rule.");
+        expect(
+          after.filter((file) => file.path !== "index.ts" && file.path !== "v1-approvals.ts"),
+        ).toEqual(changed.filter((file) => file.path !== "index.ts"));
+        // v1 asked before the tool it stamped; the tool it ran without asking still runs.
+        yield* asks("unhinted");
+        yield* asks("erase");
+        yield* runs("safe");
+        const repaired = yield* activeVersion;
+        expect(repaired).not.toBe(users);
+
+        // A second repair finds nothing left to change.
+        const again = yield* operator.repair(own.organization, false);
+        expect(again.body).toMatchObject({
+          apps: [{ app, decision: "unchanged", source: "edited", files: [] }],
+        });
+
+        // The restore runs the version a repair replaced again, and only while the app still runs
+        // the repair's version.
+        const stale = yield* operator.restore(own.organization, {
+          app: app ?? "",
+          version: users ?? "",
+          expected: users ?? "",
+        });
+        expect(stale.status, JSON.stringify(stale.body)).toBe(409);
+        expect(stale.body).toMatchObject({ status: "changed", active: repaired });
+        expect(yield* activeVersion).toBe(repaired);
+        const unknown = yield* operator.restore(own.organization, {
+          app: `app_${randomUUID()}`,
+          version: users ?? "",
+          expected: repaired ?? "",
+        });
+        expect(unknown.status, JSON.stringify(unknown.body)).toBe(409);
+        expect(unknown.body).toMatchObject({ status: "not_found" });
+        const restored = yield* operator.restore(own.organization, {
+          app: app ?? "",
+          version: users ?? "",
+          expected: repaired ?? "",
+        });
+        expect(restored.status, JSON.stringify(restored.body)).toBe(200);
+        expect(restored.body).toMatchObject({ app, version: users, status: "restored" });
+        expect(yield* activeVersion).toBe(users);
+        expect(yield* deployed).toEqual(changed);
+        yield* runs("unhinted");
+      }).pipe(Effect.provide(services)),
     ),
   );
 
@@ -3941,8 +5667,9 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
 
         const { target, results } = yield* importOnServer(own.organization);
         // v1 made a connection whose recorded token endpoint it no longer trusted reconnect.
+        // It moves without its account, for its owner to connect again in v2.
         expect(results.get("untrusted")).toEqual({
-          status: "failed",
+          status: "skipped",
           reason:
             "v1 no longer trusted the token endpoint its sign-in recorded. Reconnect it in v2.",
         });
@@ -4073,6 +5800,235 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
     ),
   );
 
+  /**
+   * v1 reads an organization's connections in creation order, then by row ID. A seed creates them
+   * at once with random row IDs, so the copied organization and its own are put in the same order,
+   * as one organization's rows always are.
+   */
+  const orderConnections = (organization: string) =>
+    writeRows("v1-database.json", [
+      {
+        sql: `update connection c set created_at = timestamptz '2026-01-01' + (
+            select count(*) from connection o where o.tenant = c.tenant and o.name < c.name
+          ) * interval '1 second' where c.tenant = $1`,
+        params: [organization],
+      },
+    ]);
+
+  it.effect(
+    scenarios.v1ImportCopiedMove.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const emulators = yield* Emulators;
+          const operator = yield* v1ImportOperator;
+          const service = yield* oauthService;
+          const identity = yield* emulators.identity("google");
+          // The opt-in import copied an organization to v2 while v1 kept serving it: imported, with
+          // no import instance and not moved. The copy is made by importing a twin organization
+          // and handing its import map to this one, whose rows match the twin's by name.
+          const twin = yield* emulators.v1Workspace([identity.email]);
+          const copySlug = `v1-${randomUUID().slice(0, 8)}`;
+          const names = randomUUID().slice(0, 6);
+          yield* seedRenewal(twin.organization, twin.user, copySlug, service.origin, names);
+          // The copy also got a connection its v1 organization no longer has when it moves.
+          yield* writeRows("v1-database.json", [
+            {
+              sql: `insert into connection (tenant, owner, subject, integration, name, template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope, oauth_token_url)
+                select tenant, owner, subject, integration, 'spare', template, item_ids, oauth_client, oauth_client_owner, refresh_item_id, expires_at, oauth_scope, oauth_token_url
+                from connection where tenant = $1 and name = 'second'`,
+              params: [twin.organization],
+            },
+          ]);
+          yield* orderConnections(twin.organization);
+          yield* googleSignIn(identity.email);
+          const target = (yield* importOnServer(twin.organization)).target;
+          expect(target.slug).toBe(copySlug);
+          const own = yield* emulators.v1Workspace([identity.email]);
+          const slug = `v1-${randomUUID().slice(0, 8)}`;
+          yield* seedRenewal(own.organization, own.user, slug, service.origin, names);
+          yield* orderConnections(own.organization);
+          const [pairs = []] = yield* writeRows("v1-database.json", [
+            {
+              sql: `select twin.row_id as twin, own.row_id as own from (
+                  select row_id, 'integration:' || name as key from integration where tenant = $1
+                  union all select row_id, 'connection:' || name from connection where tenant = $1
+                  union all select row_id, 'tool_policy:' || pattern from tool_policy where tenant = $1
+                ) twin join (
+                  select row_id, 'integration:' || name as key from integration where tenant = $2
+                  union all select row_id, 'connection:' || name from connection where tenant = $2
+                  union all select row_id, 'tool_policy:' || pattern from tool_policy where tenant = $2
+                ) own using (key)`,
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const matched = yield* Schema.decodeUnknownEffect(
+            Schema.Array(Schema.Struct({ twin: Schema.String, own: Schema.String })),
+          )(pairs);
+          yield* writeRows("sso-database.json", [
+            ...[...matched, { twin: twin.organization, own: own.organization }].map((pair) => ({
+              sql: "update private_v1_import_map set v1_id = $2 where v1_org_id = $3 and v1_id = $1",
+              params: [pair.twin, pair.own, twin.organization],
+            })),
+            {
+              sql: "update private_v1_import_map set v1_org_id = $2 where v1_org_id = $1",
+              params: [twin.organization, own.organization],
+            },
+          ]);
+          const inventory = yield* call(
+            "Read the copied organization",
+            "GET",
+            `/api/organizations/${target.id}/inventory`,
+          ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
+          const accountOf = (label: string) =>
+            inventory.accounts.find((entry) => entry.label === label)?.id;
+          const callMail = (step: string, label: string) =>
+            call(step, "POST", `/api/organizations/${target.id}/apps/${appOf("Mail")}/tools/call`, {
+              tool: "mail.me",
+              kind: "query",
+              input: { accountId: accountOf(label), input: {} },
+            });
+          const appOf = (name: string) => inventory.apps.find((entry) => entry.name === name)?.id;
+          const expectMail = (step: string, label: string) =>
+            callMail(step, label).pipe(
+              Effect.map((sent) => expect(sent.status, JSON.stringify(sent.body)).toBe(200)),
+            );
+
+          // v2 renews the expired account on its first call.
+          yield* expectMail("Call the mail API as the renewed account", "renewed");
+          expect(yield* service.tokens).toHaveLength(1);
+
+          // v1 renews the second account later, and the service rotates its refresh token: v1 now
+          // holds the only tokens that work, which expire after the ones copied to v2.
+          const rotated = randomUUID().slice(0, 8);
+          const userScope = `executor/user/${encodeURIComponent(own.organization)}/${encodeURIComponent(own.user)}`;
+          yield* emulators.v1VaultObject(
+            vaultName(userScope, `oauth:user:rotated${rotated}:second`),
+            service.renewedToken,
+          );
+          yield* emulators.v1VaultObject(
+            vaultName(userScope, `oauth:user:rotated${rotated}:second:refresh`),
+            "synthetic-second-rotated-refresh",
+          );
+          yield* writeRows("v1-database.json", [
+            {
+              sql: "update connection set item_ids = $2::json, refresh_item_id = $3, expires_at = $4::bigint where tenant = $1 and name = 'second'",
+              params: [
+                own.organization,
+                JSON.stringify({ token: `oauth:user:rotated${rotated}:second` }),
+                `oauth:user:rotated${rotated}:second:refresh`,
+                String(Date.now() + 7_200_000),
+              ],
+            },
+          ]);
+          // A member changes an imported app in v2, and its integration changes in v1.
+          const gated = appOf("Gated mail");
+          const edited = (yield* appSource(target.id, gated)).map((file) =>
+            file.path === "index.ts"
+              ? { ...file, content: `${file.content}\n// edited in v2\n` }
+              : file,
+          );
+          const redeployed = yield* call(
+            "Deploy a member's version of the gated app",
+            "POST",
+            `/api/organizations/${target.id}/apps/${gated}/deploy`,
+            { files: edited },
+          );
+          expect(redeployed.status, JSON.stringify(redeployed.body)).toBe(200);
+          yield* writeRows("v1-database.json", [
+            {
+              sql: "insert into tool_policy (tenant, owner, subject, pattern, action) values ($1, 'org', '', 'removed_service.*', 'block')",
+              params: [own.organization],
+            },
+            // The member removes in v1 the connection that could not move.
+            {
+              sql: "delete from connection where tenant = $1 and name = 'untrusted'",
+              params: [own.organization],
+            },
+            // They rename the mail integration, which gives its app another provider.
+            {
+              sql: "update integration set name = 'Team mail' where tenant = $1 and name = 'Mail'",
+              params: [own.organization],
+            },
+          ]);
+          // In v2 they remove an app and two accounts, and add a teammate.
+          expect(accountOf("spare")).toBeDefined();
+          for (const [step, path] of [
+            ["Remove the pasted app in v2", `apps/${appOf("Pasted mail")}`],
+            ["Remove the pasted account in v2", `accounts/${accountOf("pasted")}`],
+            ["Remove the spare account in v2", `accounts/${accountOf("spare")}`],
+          ] as const) {
+            const removed = yield* call(step, "DELETE", `/api/organizations/${target.id}/${path}`);
+            expect(removed.status, JSON.stringify(removed.body)).toBeLessThan(300);
+          }
+          const teammate = randomUUID();
+          yield* writeRows("sso-database.json", [
+            {
+              sql: `insert into "user" (id, name, email, "emailVerified", "createdAt", "updatedAt") values ($1, 'Teammate', $2, true, now(), now())`,
+              params: [teammate, `teammate-${teammate.slice(0, 8)}@example.test`],
+            },
+            {
+              sql: `insert into member (id, "organizationId", "userId", role, "createdAt") values ($1, $2, $3, 'member', now())`,
+              params: [randomUUID(), target.id, teammate],
+            },
+          ]);
+
+          // The dry run reports the copy's slug, which the move keeps.
+          const dryRun = v1RunId("copied-dry-run");
+          const checked = yield* operator.start({
+            mode: "dry-run",
+            runId: dryRun,
+            organizations: [own.organization],
+          });
+          expect(checked.status, JSON.stringify(checked.body)).toBe(200);
+          expect((yield* operator.waitForReport(dryRun, own.organization)).slug).toEqual({
+            v1: slug,
+            v2: copySlug,
+            changed: true,
+          });
+
+          const moved = yield* importOnServer(own.organization);
+          expect(moved.report.cutover, JSON.stringify(moved.report.verification)).toBe(true);
+          expect(moved.target).toEqual(target);
+          // What the member removed in v2 stays removed.
+          const removedInV2 = {
+            status: "skipped",
+            reason: "Its users removed it in v2 after an earlier run imported it.",
+          };
+          expect(moved.results.get("Pasted mail")).toEqual(removedInV2);
+          expect(moved.results.get("pasted")).toMatchObject(removedInV2);
+          // The second account takes v1's newer tokens; the renewed one keeps v2's own renewal. Both
+          // move to the renamed app's provider, so calls can still select them.
+          const followed = "Moved to its app's new sign-in methods.";
+          expect(moved.results.get("second")).toMatchObject({
+            status: "imported",
+            note: `Took v1's newer sign-in. ${followed}`,
+          });
+          expect(moved.results.get("renewed")?.note).toBe(followed);
+          // The spare account, removed in v2 and its connection in v1, is neither moved nor verified.
+          expect(moved.results.has("spare")).toBe(false);
+          yield* expectMail("Call the mail API as the second account", "second");
+          yield* expectMail("Call the mail API as the renewed account again", "renewed");
+          expect((yield* service.calls).slice(-2)).toEqual([
+            `Bearer ${service.renewedToken}`,
+            `Bearer ${service.renewedToken}`,
+          ]);
+          expect(yield* service.tokens).toHaveLength(1);
+          // The member's version of the gated app stands; the others follow v1's change.
+          expect(moved.results.get("Gated mail")).toMatchObject({
+            status: "imported",
+            note: "Kept as its users changed it in v2 after an earlier run imported it.",
+          });
+          expect(
+            (yield* appSource(target.id, gated)).find((file) => file.path === "index.ts")?.content,
+          ).toContain("// edited in v2");
+        }).pipe(Effect.provide(services)),
+      ),
+    // It copies the organization, checks it again and moves it: three runs of the import.
+    { timeout: 180_000 },
+  );
+
   it.effect(scenarios.v1ImportFirstParty.title, (context) =>
     withCase(
       context,
@@ -4094,18 +6050,72 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
         yield* seedFirstParty(own.organization, own.user, `v1-${randomUUID().slice(0, 8)}`, origin);
         yield* googleSignIn(identity.email);
 
-        const { target: organization, results } = yield* importOnServer(own.organization);
-        // v2 does not offer Notion's app, and the Google client allows no scope beyond its menu.
-        expect(results.get("notion")).toEqual({
-          status: "failed",
-          reason:
-            "It signed in through Executor's own Notion app, which Executor v2 does not offer yet. Reconnect it in v2.",
+        // The dry run names every connection whose account the import would leave out, with the
+        // reason the import gives. Each moves without its account, for its owner to connect again,
+        // except one through a first-party client v2 does not offer, which blocks the organization.
+        const importer = yield* v1ImportOperator;
+        const dry = v1RunId("first-party-dry");
+        const started = yield* importer.start({
+          mode: "dry-run",
+          runId: dry,
+          organizations: [own.organization],
         });
-        expect(results.get("beyond")).toEqual({
-          status: "failed",
-          reason:
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const planned = yield* importer.waitForReport(dry, own.organization);
+        expect(planned.status).toBe("blocked");
+        expect(planned.integrationFailures).toEqual([]);
+        expect(planned.vaultFailures).toEqual([]);
+        expect(planned.staleItems).toEqual([]);
+        expect(
+          planned.connectionFailures.flatMap((failure) =>
+            failure.reconnect === true ? [] : failure.connections.map((c) => c.label),
+          ),
+        ).toEqual(["notion"]);
+        const predicted = Object.fromEntries(
+          planned.connectionFailures.flatMap((failure) =>
+            failure.connections.map((connection) => [connection.label, failure.reason] as const),
+          ),
+        );
+        const githubHosts = v1GitHubHosts(origin);
+        const elsewhere = `Executor v2's own V1-github app sends its tokens only to ${new URL(origin).host}, and its integration calls none of them. Reconnect it in v2.`;
+        expect(predicted).toEqual({
+          notion:
+            "It signed in through Executor's own Notion app, which Executor v2 does not offer yet. Reconnect it in v2.",
+          beyond:
             "It was granted permissions Executor v2's own V1-google app does not allow. Reconnect it in v2.",
+          // The GitHub client's tokens go only to its pinned host, which neither this API nor
+          // this MCP server is on.
+          elsewhere,
+          "mcp-elsewhere": elsewhere,
+          // A client whose tokens reach only one of an API's two hosts would leave the other's
+          // calls refused, so the account is not imported, and the reason names that host.
+          apionly: `Executor v2's own V1-github-api app sends its tokens only to ${githubHosts.api}, and its integration also calls ${githubHosts.uploads}, where its calls would be refused. Reconnect it in v2.`,
+          // Slack's MCP server names Slack's authorization server, not the GitHub client's.
+          "wrong-server":
+            "Its integration does not sign in where Executor v2's own V1-github app does. Reconnect it in v2.",
+          // Its resource metadata names the resource at `/github/mcp`, not this server.
+          moved: "Its sign-in could not be carried over to v2. Reconnect it in v2.",
         });
+
+        const { target: organization, results, items } = yield* importOnServer(own.organization);
+        // The import leaves out exactly the accounts its dry run did, for the same reasons, and
+        // imports every other connection.
+        const connections = items.filter((item) => item.kind === "connection");
+        expect(connections).toHaveLength(12);
+        expect(
+          Object.fromEntries(
+            connections
+              .filter((item) => item.status !== "imported")
+              .map((item) => [item.label, resultOf(item)] as const),
+          ),
+        ).toEqual(
+          Object.fromEntries(
+            Object.entries(predicted).map(([label, reason]) => [
+              label,
+              { status: label === "notion" ? "failed" : "skipped", reason },
+            ]),
+          ),
+        );
         for (const name of [
           "Synthetic Google",
           "Synthetic GitHub",
@@ -4115,6 +6125,8 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
           "GitHub one host",
           "Synthetic GitHub MCP",
           "GitHub MCP elsewhere",
+          "GitHub MCP on Slack's server",
+          "GitHub MCP moved",
           "google",
           "github",
           "slack",
@@ -4122,20 +6134,6 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
           "github-mcp",
         ])
           expect(results.get(name)?.status, results.get(name)?.reason).toBe("imported");
-        // The GitHub client's tokens go only to its pinned host, which neither this API nor this
-        // MCP server is on.
-        for (const label of ["elsewhere", "mcp-elsewhere"])
-          expect(results.get(label), label).toMatchObject({
-            status: "failed",
-            reason: `Executor v2's own V1-github app sends its tokens only to ${new URL(origin).host}, and its integration calls none of them. Reconnect it in v2.`,
-          });
-        // A client whose tokens reach only one of an API's two hosts would leave the other's calls
-        // refused, so the account is not imported, and the reason names the host it cannot reach.
-        const githubHosts = v1GitHubHosts(origin);
-        expect(results.get("apionly")).toMatchObject({
-          status: "failed",
-          reason: `Executor v2's own V1-github-api app sends its tokens only to ${githubHosts.api}, and its integration also calls ${githubHosts.uploads}, where its calls would be refused. Reconnect it in v2.`,
-        });
 
         const inventory = yield* call(
           "Read the new organization",
@@ -4366,7 +6364,7 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
           ],
         ] as const)
           expect(results.get(`connection:${label} · Synthetic GraphQL`), label).toEqual({
-            status: "failed",
+            status: "skipped",
             reason,
           });
 
@@ -4606,6 +6604,100 @@ layer(TestLive, { excludeTestServices: true })("Cloud v1 import", (it) => {
     ),
   );
 
+  it.effect(scenarios.v1ImportMicrosoftGraph.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const emulators = yield* Emulators;
+        const identity = yield* emulators.identity("google");
+        const own = yield* emulators.v1Workspace([identity.email]);
+        const seeded = yield* seedGraph(own.organization, `v1-${randomUUID().slice(0, 8)}`);
+        yield* googleSignIn(identity.email);
+
+        const { target, results } = yield* importOnServer(own.organization);
+        const inventory = yield* call(
+          "Read the new organization",
+          "GET",
+          `/api/organizations/${target.id}/inventory`,
+        ).pipe(Effect.flatMap((response) => decode(Inventory, response)));
+        // Each preset's app has exactly the operations v1 kept for it, under v1's names, and of the
+        // shared document only the components they reach: none of the areas it left out, no
+        // examples, no security schemes and no security requirements.
+        for (const preset of seeded.presets.slice(0, 2)) {
+          const result = results.get(preset.name);
+          expect(result?.status, result?.reason).toBe("imported");
+          const app = inventory.apps.find((entry) => entry.name === preset.name)?.id;
+          const operations = preset.areas.flatMap((area) => area.operations);
+          const listed = yield* call(
+            `List the ${preset.name} app's tools`,
+            "GET",
+            `/api/organizations/${target.id}/apps/${app}/tools`,
+          );
+          expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+          expect((yield* decode(Tools, listed)).items.map((tool) => tool.name).sort()).toEqual(
+            operations.map(([tool]) => tool).sort(),
+          );
+          const configuration = (yield* appSource(target.id, app)).find(
+            (file) => file.path === "openapi.json",
+          )?.content;
+          if (configuration === undefined)
+            return yield* Effect.die(`The ${preset.name} app has no openapi.json`);
+          const { document } = Schema.decodeUnknownSync(
+            Schema.fromJsonString(
+              Schema.Struct({
+                source: Schema.Struct({
+                  document: Schema.Record(Schema.String, Schema.Unknown),
+                }),
+              }),
+            ),
+          )(configuration).source;
+          expect(Object.keys(document)).toEqual([
+            "openapi",
+            "info",
+            "servers",
+            "paths",
+            "components",
+            "tags",
+          ]);
+          const Sections = Schema.Record(
+            Schema.String,
+            Schema.Record(Schema.String, Schema.Unknown),
+          );
+          const paths = Schema.decodeUnknownSync(Sections)(document.paths);
+          expect(
+            Object.entries(paths)
+              .flatMap(([path, item]) =>
+                Object.keys(item)
+                  .filter((key) => key !== "description" && key !== "parameters")
+                  .map((method) => `${method} ${path}`),
+              )
+              .sort(),
+          ).toEqual(operations.map(([, method, path]) => `${method} ${path}`).sort());
+          const components = Schema.decodeUnknownSync(Sections)(document.components);
+          expect(
+            Object.fromEntries(
+              Object.entries(components).map(([section, entries]) => [
+                section,
+                Object.keys(entries).sort(),
+              ]),
+            ),
+          ).toEqual(graphComponents(preset.areas));
+        }
+        // An entry the preset's cut reaches cannot be parsed, so v1 could not read it either; the
+        // reason names the line and column of the document, as for a document parsed whole.
+        expect(results.get("Graph Tasks")).toMatchObject({
+          status: "skipped",
+          reason: `v1's stored specification could not be read: as YAML, bad indentation of a mapping entry at line ${seeded.broken.line}, column 12 (${seeded.broken.bytes} bytes).`,
+        });
+        expect(results.get("Graph Files")).toMatchObject({
+          status: "failed",
+          reason:
+            "v1's stored Microsoft Graph specification is not block YAML the import can read one entry at a time, as v1 read it: line 1 holds no key it can read.",
+        });
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
   it.effect(scenarios.v1ImportPlanOutage.title, (context) =>
     withCase(
       context,
diff --git a/e2e/tests/cloud-v1-session-handoff.spec.ts b/e2e/tests/cloud-v1-session-handoff.spec.ts
new file mode 100644
index 0000000000..ecdb2ce6ab
--- /dev/null
+++ b/e2e/tests/cloud-v1-session-handoff.spec.ts
@@ -0,0 +1,289 @@
+/**
+ * v1 session handoff: v1's dashboard redirects a signed-in member of a workspace that has moved to
+ * v2's `/api/v1-handoff` with a token it signs for that member, and v2 starts its own session for
+ * the user the import mapped them to (`notes/v1-import.md`, Session handoff). The scenarios move a
+ * synthetic workspace with the operator's import, then sign tokens as v1 does with the secret the
+ * managed Cloud shares with its synthetic v1.
+ */
+import { randomUUID } from "node:crypto";
+import { expect, layer } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Schema } from "effect";
+import { TestLive, withCase } from "../support/case.ts";
+import { Browser } from "../support/browser.ts";
+import { writeRows } from "../support/cloud-rows.ts";
+import { Emulators } from "../support/emulators.ts";
+import { Onboarding } from "../support/onboarding.ts";
+import { driver, Target } from "../support/platform.ts";
+import { targetHosts } from "../support/role-hosts.ts";
+import { allowV1Import, v1ImportOperator, v1RunId } from "../support/v1-import.ts";
+import {
+  V1SessionHandoffSecret,
+  v1HandoffId,
+  v1HandoffToken,
+  v1SessionHandoffFile,
+  type V1HandoffClaims,
+} from "../support/v1-session-handoff.ts";
+import { scenarios } from "../test-plan.ts";
+
+const services = Layer.mergeAll(Onboarding.layer, Emulators.layer);
+
+const Session = Schema.NullOr(Schema.Struct({ user: Schema.Struct({ email: Schema.String }) }));
+
+/**
+ * A two-member v1 workspace, moved to v2 by the operator's import and cut over. Both members are
+ * new to v2, so the import created their users; neither has signed in to v2.
+ */
+const movedWorkspace = Effect.gen(function* () {
+  const emulators = yield* Emulators,
+    operator = yield* v1ImportOperator,
+    fs = yield* FileSystem.FileSystem,
+    target = yield* Target;
+  const { secret } = yield* fs
+    .readFileString(`${target.directory}/${v1SessionHandoffFile}`)
+    .pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(V1SessionHandoffSecret))),
+    );
+  const ownerEmail = `handoff-owner-${randomUUID().slice(0, 8)}@example.test`;
+  const memberEmail = `handoff-member-${randomUUID().slice(0, 8)}@example.test`;
+  const workspace = yield* emulators.v1Workspace([ownerEmail, memberEmail]);
+  const member = yield* emulators.v1User(memberEmail);
+  yield* writeRows("v1-database.json", [
+    {
+      sql: "insert into organizations (id, name, slug) values ($1, 'Synthetic moved workspace', $2)",
+      params: [workspace.organization, `v1-${randomUUID().slice(0, 8)}`],
+    },
+  ]);
+  yield* allowV1Import(workspace.organization);
+  const run = v1RunId("handoff");
+  const started = yield* operator.start({
+    mode: "import",
+    runId: run,
+    organizations: [workspace.organization],
+  });
+  expect(started.status, JSON.stringify(started.body)).toBe(200);
+  const report = yield* operator.waitForReport(run, workspace.organization);
+  expect(report.status, report.reason ?? "").toBe("imported");
+  expect(report.cutover).toBe(true);
+  const moved = report.v2Organization;
+  if (moved === undefined) return yield* Effect.die("The import named no organization");
+  /** A token as v1 signs it for one handoff, a minute long. */
+  const sign = (claims: Partial<V1HandoffClaims> = {}, signedWith = secret) => {
+    const now = Math.floor(Date.now() / 1000);
+    return v1HandoffToken(signedWith, {
+      user: workspace.user,
+      organization: workspace.organization,
+      slug: moved.slug,
+      iat: now,
+      exp: now + 60,
+      jti: v1HandoffId(),
+      ...claims,
+    });
+  };
+  return {
+    sign,
+    slug: moved.slug,
+    v2Organization: moved.id,
+    owner: { user: workspace.user, email: ownerEmail },
+    member: { user: member, email: memberEmail },
+  };
+});
+
+const handoffPath = (token: string) => `/api/v1-handoff?token=${encodeURIComponent(token)}`;
+const signInFor = (slug: string) => `/login?redirect=${encodeURIComponent(`/org/${slug}`)}`;
+
+/** One handoff request from a browser with no session, without following its redirect. */
+const signedOut = (token: string) =>
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const url = `${targetHosts(target).browser}${handoffPath(token)}`;
+    return yield* driver("Open a v1 handoff signed out", (signal) =>
+      fetch(url, { redirect: "manual", signal }).then((response) =>
+        response.text().then(() => ({
+          status: response.status,
+          location: response.headers.get("location"),
+          referrerPolicy: response.headers.get("referrer-policy"),
+          cookies: response.headers.getSetCookie().length,
+        })),
+      ),
+    );
+  });
+
+/** One handoff request from the signed-in browser, with its cookies, without following it. */
+const fromBrowser = (step: string, token: string) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    return yield* browser.use(step, (page) =>
+      page
+        .context()
+        .request.get(handoffPath(token), { maxRedirects: 0 })
+        .then((response) => ({
+          status: response.status(),
+          location: response.headers()["location"] ?? null,
+          cookies: response.headersArray().filter((header) => header.name === "set-cookie").length,
+        })),
+    );
+  });
+
+/** The email of the browser's v2 session, or null when it has none. */
+const sessionEmail = (step: string) =>
+  Effect.gen(function* () {
+    const browser = yield* Browser;
+    const session = yield* browser
+      .use(step, (page) =>
+        page.evaluate(() => fetch("/api/auth/get-session").then((response) => response.json())),
+      )
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Session)));
+    return session?.user.email ?? null;
+  });
+
+layer(TestLive, { excludeTestServices: true })("Cloud v1 session handoff", (it) => {
+  it.effect(scenarios.v1HandoffSignIn.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const browser = yield* Browser;
+        const moved = yield* movedWorkspace;
+        const token = moved.sign();
+
+        // The browser follows the redirects; the handoff's own response is the first of them.
+        const handoff = yield* browser.use("Open the handoff v1 redirects to", (page) =>
+          page.goto(handoffPath(token)).then((response) => {
+            let request = response?.request() ?? null;
+            while (request !== null && new URL(request.url()).pathname !== "/api/v1-handoff")
+              request = request.redirectedFrom();
+            return request?.response() ?? null;
+          }),
+        );
+        if (handoff === null) return yield* Effect.die("The handoff did not redirect");
+        const headers = yield* browser.use("Read the handoff's response", () =>
+          handoff.headersArray(),
+        );
+        const header = (name: string) =>
+          headers.filter((entry) => entry.name.toLowerCase() === name).map((entry) => entry.value);
+        const landed = yield* browser.use(
+          "The handoff opens the organization's dashboard",
+          (page) =>
+            page
+              .getByRole("heading", { name: /^Apps(?:\s*\d+)?$/ })
+              .waitFor({ state: "visible" })
+              .then(() => new URL(page.url()).pathname),
+        );
+        expect(landed.startsWith(`/org/${moved.slug}/`)).toBe(true);
+        const opened = {
+          status: handoff.status(),
+          location: header("location")[0],
+          referrerPolicy: header("referrer-policy")[0],
+          cacheControl: header("cache-control")[0],
+          sessionCookie: header("set-cookie").length,
+        };
+        expect(opened).toMatchObject({
+          status: 302,
+          location: `/org/${moved.slug}`,
+          referrerPolicy: "no-referrer",
+          cacheControl: "no-store",
+        });
+        expect(opened.sessionCookie).toBeGreaterThan(0);
+        expect(yield* sessionEmail("Read the session the handoff started")).toBe(moved.owner.email);
+        yield* browser.checkpoint("signed in through the v1 handoff");
+
+        // Signed in as the same user, a new handoff only redirects.
+        expect(yield* fromBrowser("Hand off the same user again", moved.sign())).toEqual({
+          status: 302,
+          location: `/org/${moved.slug}`,
+          cookies: 0,
+        });
+
+        // Another user's handoff never replaces the session the browser holds.
+        expect(
+          yield* fromBrowser(
+            "Hand off another member to the signed-in browser",
+            moved.sign({ user: moved.member.user }),
+          ),
+        ).toEqual({ status: 302, location: signInFor(moved.slug), cookies: 0 });
+        expect(yield* sessionEmail("The browser keeps its own session")).toBe(moved.owner.email);
+
+        // The token is used: replayed from anywhere, it opens sign-in and starts no session.
+        expect(yield* signedOut(token)).toEqual({
+          status: 302,
+          location: signInFor(moved.slug),
+          referrerPolicy: "no-referrer",
+          cookies: 0,
+        });
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+
+  it.effect(scenarios.v1HandoffRefusals.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const moved = yield* movedWorkspace;
+        const now = Math.floor(Date.now() / 1000);
+        const refused = {
+          status: 302,
+          location: signInFor(moved.slug),
+          referrerPolicy: "no-referrer",
+          cookies: 0,
+        };
+        // Not signed by v1, expired, longer-lived than v1 makes them, or for another audience.
+        expect(yield* signedOut(moved.sign({}, "x".repeat(64)))).toEqual(refused);
+        expect(yield* signedOut(moved.sign({ iat: now - 120, exp: now - 60 }))).toEqual(refused);
+        expect(yield* signedOut(moved.sign({ exp: now + 3_600 }))).toEqual(refused);
+        expect(yield* signedOut(moved.sign({ aud: "v2-mcp-forward" }))).toEqual(refused);
+        expect(yield* signedOut(moved.sign({ v: 2 }))).toEqual(refused);
+        // A WorkOS user the import never mapped, even one in no other workspace.
+        expect(yield* signedOut(moved.sign({ user: `user_${randomUUID()}` }))).toEqual(refused);
+        // The organization's slug claimed for a v1 organization that was not imported as it.
+        expect(yield* signedOut(moved.sign({ organization: `org_${randomUUID()}` }))).toEqual(
+          refused,
+        );
+        // The endpoint that starts the session is server-only: over HTTP it does not exist, even
+        // for the mapped user and their organization.
+        const ownerRows = yield* writeRows("sso-database.json", [
+          {
+            sql: `select v2_id from private_v1_import_map where v1_kind = 'user' and v1_id = $1`,
+            params: [moved.owner.user],
+          },
+        ]);
+        const owner = yield* Schema.decodeUnknownEffect(Schema.Struct({ v2_id: Schema.String }))(
+          ownerRows[0]?.[0],
+        );
+        const direct = yield* Effect.gen(function* () {
+          const target = yield* Target;
+          const url = `${targetHosts(target).browser}/api/auth/v1-handoff/session`;
+          return yield* driver("Call the handoff's session endpoint directly", (signal) =>
+            fetch(url, {
+              method: "POST",
+              redirect: "manual",
+              signal,
+              headers: { "content-type": "application/json", origin: targetHosts(target).browser },
+              body: JSON.stringify({ userId: owner.v2_id, organizationId: moved.v2Organization }),
+            }).then((response) =>
+              response.text().then(() => ({
+                status: response.status,
+                cookies: response.headers.getSetCookie().length,
+              })),
+            ),
+          );
+        });
+        expect(direct).toEqual({ status: 404, cookies: 0 });
+        // A member who has left the v2 organization since it moved.
+        yield* writeRows("sso-database.json", [
+          {
+            sql: `delete from member where "organizationId" = $1 and "userId" = (select v2_id from private_v1_import_map where v1_kind = 'user' and v1_id = $2) returning id`,
+            params: [moved.v2Organization, moved.member.user],
+          },
+        ]).pipe(Effect.map((rows) => expect(rows[0]).toHaveLength(1)));
+        expect(yield* signedOut(moved.sign({ user: moved.member.user }))).toEqual(refused);
+        // The workspace itself hands off: what was refused was each token.
+        const accepted = yield* signedOut(moved.sign());
+        expect(accepted).toMatchObject({
+          status: 302,
+          location: `/org/${moved.slug}`,
+          referrerPolicy: "no-referrer",
+        });
+        expect(accepted.cookies).toBeGreaterThan(0);
+      }).pipe(Effect.provide(services)),
+    ),
+  );
+});
diff --git a/e2e/tests/connection-keys.spec.ts b/e2e/tests/connection-keys.spec.ts
index b9b9fcac7c..ddb622b4c9 100644
--- a/e2e/tests/connection-keys.spec.ts
+++ b/e2e/tests/connection-keys.spec.ts
@@ -218,7 +218,7 @@ layer(HostedLive, { excludeTestServices: true })("Connection keys", (it) => {
           page.goto(`/org/${actors.organization.slug}/connect`),
         );
         yield* browser.use("Open the bound connection", (page) =>
-          page.getByRole("button", { name: new RegExp(bound.name) }).click(),
+          page.getByRole("link", { name: bound.name, exact: true }).click(),
         );
         yield* browser.use("Start a connection key", (page) =>
           page.getByRole("button", { name: "Create connection key", exact: true }).click(),
@@ -505,7 +505,7 @@ layer(HostedLive, { excludeTestServices: true })("Connection keys", (it) => {
           page.goto(`/org/${actors.organization.slug}/connect`),
         );
         yield* browser.use("Open the seat's connection", (page) =>
-          page.getByRole("button", { name: new RegExp(seat.name) }).click(),
+          page.getByRole("link", { name: seat.name, exact: true }).click(),
         );
         const keyName = `Replacement ${receipt.slice(0, 6)}`;
         const keyList = (page: Page) => page.getByRole("region", { name: "Connection keys" });
diff --git a/e2e/tests/credential-placement.spec.ts b/e2e/tests/credential-placement.spec.ts
index 009facb479..d69bf2f7b1 100644
--- a/e2e/tests/credential-placement.spec.ts
+++ b/e2e/tests/credential-placement.spec.ts
@@ -526,7 +526,8 @@ const harness = Effect.gen(function* () {
   /** Call `tool` with the accounts linked to the app: for a plain requirement, the newest. */
   const call = <A>(path: string, output: Schema.Decoder<A>, tool: string) =>
     Effect.gen(function* () {
-      // Every tool here only reads; naming the kind lets a refused call renew and repeat.
+      // Every tool here only reads. Naming the kind, once a kept listing confirms it (`list`),
+      // lets a refused call renew and repeat.
       const response = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
         tool,
         kind: "query",
@@ -544,6 +545,16 @@ const harness = Effect.gen(function* () {
       expect(response.status, JSON.stringify(response.body)).toBe(200);
       return yield* body(output, response);
     });
+  /**
+   * List the app's tools, as a caller discovering them does. The listing is kept, and only a kept
+   * listing confirms that a query only reads, so a refused query is repeated after renewal and a
+   * failed renewal is its failure.
+   */
+  const list = (path: string) =>
+    Effect.gen(function* () {
+      const listed = yield* api.request(actors.owner, "GET", `${path}/tools`);
+      expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+    });
   /** The first redirect of an authorization URL: the callback the issuer sends the browser to. */
   const consent = (authorizationUrl: string) =>
     Effect.scoped(
@@ -556,7 +567,7 @@ const harness = Effect.gen(function* () {
         return location;
       }),
     ).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }));
-  return { api, actors, prefix, deploy, connection, submit, call, callWith, consent };
+  return { api, actors, prefix, deploy, connection, submit, call, callWith, list, consent };
 });
 
 layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) => {
@@ -1080,6 +1091,24 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
           firstParty: { label: "Executor for Google" },
           scopes: ["openid", "email", "profile"],
         });
+        // Each approved product must offer the shared client and forward its exact scopes.
+        for (const [key, scopes] of [
+          ["youtube", ["youtube", "youtube.force-ssl"]],
+          ["ads", ["adwords"]],
+          ["bigquery", ["bigquery"]],
+          [
+            "apps-script",
+            ["script.projects", "script.deployments", "script.processes", "script.metrics"],
+          ],
+        ] as const) {
+          const requested = scopes.map((scope) => `https://www.googleapis.com/auth/${scope}`);
+          const product = yield* signIn(key, requested);
+          expect(product.setup.firstParty, key).toEqual({ label: "Executor for Google" });
+          expect(product.started.status, key).toBe(200);
+          const url = new URL((yield* body(Redirect, product.started)).authorizationUrl);
+          expect(url.searchParams.get("client_id"), key).toBe(clientId);
+          expect(url.searchParams.get("scope")?.split(" "), key).toEqual(requested);
+        }
         expect(wider.setup.firstParty).toBeUndefined();
         expect(wider.started.body).toMatchObject({ _tag: "OAuthClientUnavailable" });
       }),
@@ -1423,7 +1452,7 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
     withHostedCase(
       context,
       Effect.gen(function* () {
-        const { api, actors, prefix, deploy } = yield* harness;
+        const { api, actors, prefix, deploy, list } = yield* harness;
         const { issuer, store, issuerHost, storeHost } = yield* operatorWith({ revocation: true });
         const hosts = [issuerHost, storeHost];
         yield* issuer.configure({ revocation: "recorded" });
@@ -1523,6 +1552,8 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
         });
         const renewing = yield* signIn(scoped);
         expect(renewing.completed.status, JSON.stringify(renewing.completed.body)).toBe(200);
+        // The app's listing confirms `resource` only reads, so the renewal's refusal is the call's.
+        yield* list(scoped);
         yield* issuer.expireAccessTokens;
         const read = yield* api.request(actors.owner, "POST", `${scoped}/tools/call`, {
           tool: "resource",
@@ -1984,7 +2015,7 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
     withHostedCase(
       context,
       Effect.gen(function* () {
-        const { api, actors, prefix, deploy, call, consent } = yield* harness;
+        const { api, actors, prefix, deploy, call, list, consent } = yield* harness;
         const issuer = yield* oauthSetupIssuer;
         const store = yield* credentialUpstream;
         const hosts = [new URL(issuer.origin).host, `127.0.0.1:${store.port}`];
@@ -2138,7 +2169,9 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
         expect(health.apps.map((entry) => entry.check?.status)).toEqual(["healthy"]);
 
         // And a retry after the service refused the user's token: the renewal it waited for
-        // returned the operator's credential, which the retry reads sealed and sends placed.
+        // returned the operator's credential, which the retry reads sealed and sends placed. The
+        // app's listing, kept since the restart, confirms `resource` only reads, so it is retried.
+        yield* list(refused.path);
         yield* issuer.expireAccessTokens;
         const retried = yield* interleaved(
           refused,
@@ -2239,7 +2272,9 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
         const signIn = yield* startSignIn(first.path);
         const firstSent = yield* sent(signIn.started);
         expectOperatorRequest(firstSent.url);
+        const originalRedirectUri = firstSent.redirect.redirectUri;
         const account = yield* completeSignIn(issuer, signIn.connection, firstSent.redirect);
+        yield* issuer.configure({ requireRefreshRedirectUri: originalRedirectUri });
         // The exchange sent the operator's resource, and the account holds the nested user token:
         // the service accepts only tokens it issued.
         expect((yield* issuer.metrics).exchangeResource).toBe(resource);
@@ -2256,11 +2291,25 @@ layer(HostedLive, { excludeTestServices: true })("Credential placement", (it) =>
           operatorClients(issuer.origin, hosts, { ...slack, unlisted: true }),
           twoHours,
         );
-        const renewed = yield* call(first.path, Called, "resource");
-        expect(renewed.status).toBe(200);
+        const renewalResponse = yield* api.request(
+          actors.owner,
+          "POST",
+          `${first.path}/tools/call`,
+          { tool: "resource", kind: "query", input: {} },
+        );
         const metrics = yield* issuer.metrics;
+        expect(metrics.refreshRedirectUri, "refresh request redirect_uri").toBe(
+          originalRedirectUri,
+        );
+        expect(renewalResponse.status, "managed account renewal failed").toBe(200);
+        const renewed = yield* body(Called, renewalResponse);
+        expect(renewed.status).toBe(200);
         expect(metrics.refreshesIssued).toBeGreaterThan(refreshed);
-        expect(metrics.refreshChecks).toMatchObject({ issued: true, authSecret: true });
+        expect(metrics.refreshChecks).toMatchObject({
+          issued: true,
+          authSecret: true,
+          redirect: true,
+        });
         expect(metrics.refreshResource).toBe(resource);
         expect(metrics.resourceAuthorizations.at(-1)).toMatch(/^Bearer synthetic-refreshed-token-/);
 
diff --git a/e2e/tests/dashboard-batch-authentication.spec.ts b/e2e/tests/dashboard-batch-authentication.spec.ts
new file mode 100644
index 0000000000..b4771a34d3
--- /dev/null
+++ b/e2e/tests/dashboard-batch-authentication.spec.ts
@@ -0,0 +1,214 @@
+import { expect, layer } from "@effect/vitest";
+import { Clock, Effect, Redacted, Schedule, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { randomUUID } from "node:crypto";
+import { Actors, freshOwnerSession } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { Target } from "../support/platform.ts";
+import { batchPath, type BatchedRead } from "../support/read-batches.ts";
+import { targetHosts } from "../support/role-hosts.ts";
+import { scenarios } from "../test-plan.ts";
+
+const App = Schema.Struct({ id: Schema.String });
+const Answer = Schema.Struct({
+  id: Schema.Int,
+  status: Schema.Int,
+  text: Schema.optional(Schema.String),
+});
+const decodeAnswer = Schema.decodeUnknownEffect(Schema.fromJsonString(Answer));
+
+/** Read the public batch stream with an actor's cookie jar, without opening a dashboard page. */
+const send = (session: Session, reads: ReadonlyArray<BatchedRead>) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      const origin = targetHosts(yield* Target).browser;
+      const cookies = Redacted.value(yield* session.cookies);
+      const traceId = randomUUID().replaceAll("-", "");
+      const request = yield* HttpClientRequest.post(new URL(batchPath, origin)).pipe(
+        HttpClientRequest.setHeaders({
+          origin,
+          cookie: cookies.map(({ name, value }) => `${name}=${value}`).join("; "),
+          "executor-wire-revision": "1",
+        }),
+        HttpClientRequest.bodyJson({
+          reads: reads.map((read) => ({
+            ...read,
+            traceparent: `00-${traceId}-${traceId.slice(0, 16)}-01`,
+          })),
+        }),
+      );
+      const started = yield* Clock.currentTimeMillis;
+      const response = yield* client.execute(request);
+      const text = yield* response.text;
+      const ms = (yield* Clock.currentTimeMillis) - started;
+      expect(response.status).toBe(200);
+      const answers = yield* Effect.forEach(text.trim().split("\n"), (line) => decodeAnswer(line));
+      return { traceId, ms, answers: answers.sort((left, right) => left.id - right.id) };
+    }),
+  );
+
+/** Wait for all reads to be delivered before counting the batch's actual authentication spans. */
+const authentication = (traceId: string, reads: number) =>
+  Effect.gen(function* () {
+    const telemetry = yield* Telemetry;
+    const evidence = yield* Evidence;
+    let operations: Record<string, number> = {};
+    return yield* telemetry.query(traceId).pipe(
+      Effect.tap((result) =>
+        Effect.sync(() => {
+          operations = {};
+          for (const { span } of result.data)
+            operations[span.operationName] = (operations[span.operationName] ?? 0) + 1;
+        }),
+      ),
+      Effect.flatMap((result) =>
+        result.data.filter(({ span }) => span.operationName === "dashboard.batch.read").length ===
+        reads
+          ? Effect.succeed(result.data)
+          : Effect.fail(new Error("The completed batch trace must reach Motel")),
+      ),
+      Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
+      Effect.timeout("25 seconds"),
+      Effect.tapError(() => evidence.json("batch-trace-counts.json", { reads, operations })),
+      Effect.map((spans) => ({
+        sessions: spans.filter(({ span }) => span.operationName === "auth.current").length,
+        organizations: spans.filter(({ span }) => span.operationName === "auth.organization")
+          .length,
+        memberships: spans.filter(({ span }) => span.operationName === "auth.membership").length,
+        removals: spans.filter(
+          ({ span }) =>
+            span.operationName === "sql.execute" &&
+            String(span.tags["db.query.text"] ?? "").includes("from hosted_organization_removal"),
+        ).length,
+      })),
+    );
+  });
+
+layer(HostedLive, { excludeTestServices: true })("Dashboard batch authentication", (it) => {
+  it.effect(scenarios.dashboardBatchAuthentication.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors;
+        const api = yield* Api;
+        const evidence = yield* Evidence;
+        const cloud = (yield* Target).metadata.target === "cloud";
+        const expected = {
+          sessions: 1,
+          organizations: cloud ? 1 : 0,
+          memberships: 1,
+          removals: cloud ? 1 : 0,
+        };
+        const organization = actors.organization.id;
+        const prefix = `/api/organizations/${organization}`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: "Batch authentication",
+          files: [
+            {
+              path: "index.ts",
+              content: `import { defineApp, query, object, router } from "apps";
+export default defineApp({}, async () => ({
+  tools: router({ hello: query({ description: "Greeting", input: object({}) }, async () => "Hello") }),
+}));`,
+            },
+            appsManifest,
+          ],
+        });
+        expect(deployed.status).toBe(200);
+        const app = yield* body(App, deployed);
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+        );
+        const read = (group: string, endpoint: string, params: Record<string, string> = {}) => ({
+          id: 0,
+          group,
+          endpoint,
+          params,
+          query: {},
+        });
+        const batch = (reads: ReadonlyArray<BatchedRead>) =>
+          reads.map((read, id) => ({ ...read, id }));
+        const page = batch([
+          read("viewer", "get"),
+          read("organization", "access", { organization }),
+          read("organization", "inventory", { organization }),
+          read("apps", "get", { organization, app: app.id }),
+          read("appAccounts", "appList", { organization, app: app.id }),
+          read("appAccounts", "userList", { organization, app: app.id }),
+          read("resourceAccess", "app", { organization, app: app.id }),
+          read("tools", "index", { organization, app: app.id }),
+        ]);
+        const first = yield* send(actors.owner, page);
+        expect(first.answers.map(({ status }) => status)).toEqual(page.map(() => 200));
+        const firstChecks = yield* authentication(first.traceId, page.length);
+
+        const samples: Array<number> = [];
+        let last = first;
+        for (let index = 0; index < 30; index++) {
+          last = yield* send(actors.owner, page);
+          expect(last.answers.map(({ status }) => status)).toEqual(page.map(() => 200));
+          samples.push(last.ms);
+        }
+        const lastChecks = yield* authentication(last.traceId, page.length);
+        samples.sort((left, right) => left - right);
+        yield* evidence.json("batch-profile.json", {
+          reads: page.length,
+          samples: samples.length,
+          p50Ms: samples[Math.ceil(samples.length * 0.5) - 1],
+          p90Ms: samples[Math.ceil(samples.length * 0.9) - 1],
+          firstChecks,
+          lastChecks,
+        });
+        expect(firstChecks, "Dashboard batch authentication budget").toEqual(expected);
+        expect(lastChecks, "Dashboard batch authentication budget").toEqual(expected);
+
+        // Aliases share a membership check; another reference must never inherit that access.
+        const mixed = yield* send(
+          actors.owner,
+          batch([
+            read("organization", "access", { organization }),
+            read("organization", "access", { organization: actors.organization.slug }),
+            read("organization", "access", { organization: `missing-${randomUUID()}` }),
+          ]),
+        );
+        expect(mixed.answers.map(({ status }) => status)).toEqual([200, 200, 403]);
+        expect(yield* authentication(mixed.traceId, 3)).toEqual({
+          ...expected,
+          organizations: cloud ? 3 : 0,
+        });
+
+        const identity = batch([
+          read("viewer", "get"),
+          read("organization", "access", { organization }),
+        ]);
+        const member = yield* send(actors.member, identity);
+        expect(member.answers.map(({ status }) => status)).toEqual([200, 200]);
+        expect(JSON.parse(member.answers[1]?.text ?? "null")).toMatchObject({ role: "member" });
+        const signedIn = yield* body(
+          Schema.Struct({ user: Schema.Struct({ email: Schema.String }) }),
+          yield* api.request(actors.member, "GET", "/api/auth/get-session"),
+        );
+        expect(
+          (yield* api.request(actors.owner, "POST", "/api/auth/organization/remove-member", {
+            organizationId: organization,
+            memberIdOrEmail: signedIn.user.email,
+          })).status,
+        ).toBe(200);
+        const removed = yield* send(actors.member, identity);
+        expect(removed.answers.map(({ status }) => status)).toEqual([200, 403]);
+
+        const fresh = yield* freshOwnerSession;
+        expect((yield* send(fresh, identity)).answers.map(({ status }) => status)).toEqual([
+          200, 200,
+        ]);
+        expect((yield* api.request(fresh, "POST", "/api/auth/sign-out", {})).status).toBe(200);
+        const revoked = yield* send(fresh, identity);
+        expect(revoked.answers.map(({ status }) => status)).toEqual([401, 401]);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/dashboard-batch-isolation.spec.ts b/e2e/tests/dashboard-batch-isolation.spec.ts
new file mode 100644
index 0000000000..40891a4ee3
--- /dev/null
+++ b/e2e/tests/dashboard-batch-isolation.spec.ts
@@ -0,0 +1,278 @@
+import { expect, layer } from "@effect/vitest";
+import { Effect, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { randomUUID } from "node:crypto";
+import { Actors } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { Organization } from "../support/contracts.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Target } from "../support/platform.ts";
+import { batchPath } from "../support/read-batches.ts";
+import { targetHosts } from "../support/role-hosts.ts";
+import { scenarios } from "../test-plan.ts";
+
+const Answer = Schema.Struct({
+  id: Schema.Int,
+  status: Schema.Int,
+  text: Schema.optional(Schema.String),
+});
+const decodeAnswer = Schema.decodeUnknownEffect(Schema.fromJsonString(Answer));
+const Viewer = Schema.Struct({ userId: Schema.String });
+const Access = Schema.Struct({ role: Schema.String });
+const Key = Schema.Struct({ key: Schema.RedactedFromValue(Schema.String), id: Schema.String });
+const Roster = Schema.Struct({
+  members: Schema.Array(Schema.Struct({ id: Schema.String, userId: Schema.String })),
+});
+
+interface Read {
+  readonly group: string;
+  readonly endpoint: string;
+  readonly params: Readonly<Record<string, string>>;
+}
+const read = (group: string, endpoint: string, params: Record<string, string> = {}): Read => ({
+  group,
+  endpoint,
+  params,
+});
+
+/** Send one batch with an actor's cookies, plus any extra headers, and return answers in read order. */
+const send = (
+  session: Session,
+  reads: ReadonlyArray<Read>,
+  headers: Readonly<Record<string, string>> = {},
+) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      const origin = targetHosts(yield* Target).browser;
+      const cookies = Redacted.value(yield* session.cookies);
+      const response = yield* client.execute(
+        yield* HttpClientRequest.post(new URL(batchPath, origin)).pipe(
+          HttpClientRequest.setHeaders({
+            origin,
+            cookie: cookies.map(({ name, value }) => `${name}=${value}`).join("; "),
+            "executor-wire-revision": "1",
+            ...headers,
+          }),
+          HttpClientRequest.bodyJson({
+            reads: reads.map((entry, id) => ({ ...entry, id, query: {} })),
+          }),
+        ),
+      );
+      expect(response.status).toBe(200);
+      const text = yield* response.text;
+      const answers = yield* Effect.forEach(text.trim().split("\n"), (line) => decodeAnswer(line));
+      expect(answers).toHaveLength(reads.length);
+      return answers.toSorted((left, right) => left.id - right.id);
+    }),
+  );
+
+/** The URL each read has as a request of its own. */
+const paths: Readonly<Record<string, (params: Readonly<Record<string, string>>) => string>> = {
+  "viewer.get": () => "/api/viewer",
+  "organization.access": ({ organization }) => `/api/organizations/${organization}/access`,
+  "oauthClients.list": ({ organization }) => `/api/organizations/${organization}/oauth-clients`,
+};
+
+/** Send each read alone, with the same cookies and headers, and return its status. */
+const alone = (
+  session: Session,
+  reads: ReadonlyArray<Read>,
+  headers: Readonly<Record<string, string>> = {},
+) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const origin = targetHosts(yield* Target).browser;
+    const cookies = Redacted.value(yield* session.cookies);
+    return yield* Effect.forEach(reads, (entry) => {
+      const path = paths[`${entry.group}.${entry.endpoint}`];
+      if (path === undefined) return Effect.die(`No path for ${entry.group}.${entry.endpoint}`);
+      return Effect.scoped(
+        client
+          .execute(
+            HttpClientRequest.get(new URL(path(entry.params), origin)).pipe(
+              HttpClientRequest.setHeaders({
+                cookie: cookies.map(({ name, value }) => `${name}=${value}`).join("; "),
+                ...headers,
+              }),
+            ),
+          )
+          .pipe(Effect.map(({ status }) => status)),
+      );
+    });
+  });
+
+const statuses = (answers: ReadonlyArray<typeof Answer.Type>) =>
+  answers.map(({ status }) => status);
+const viewerOf = (answer: typeof Answer.Type | undefined) =>
+  Schema.decodeUnknownEffect(Schema.fromJsonString(Viewer))(answer?.text ?? "");
+const roleOf = (answer: typeof Answer.Type | undefined) =>
+  Schema.decodeUnknownEffect(Schema.fromJsonString(Access))(answer?.text ?? "").pipe(
+    Effect.map(({ role }) => role),
+  );
+
+/** A fixed shuffle per round, so concurrent reads start in a different order each time. */
+const rotate = <A>(items: ReadonlyArray<A>, by: number) =>
+  items.map((_, index) => items[(index + by) % items.length] as A);
+
+layer(HostedLive, { excludeTestServices: true })("Dashboard batch isolation", (it) => {
+  it.effect(scenarios.dashboardBatchIsolation.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors;
+        const api = yield* Api;
+        const cloud = (yield* Target).metadata.target === "cloud";
+        const home = actors.organization;
+        const viewers = {
+          owner: yield* body(Viewer, yield* api.request(actors.owner, "GET", "/api/viewer")),
+          member: yield* body(Viewer, yield* api.request(actors.member, "GET", "/api/viewer")),
+        };
+
+        // Concurrent batches from different callers each see only their own identity and role.
+        const identity = [
+          read("viewer", "get"),
+          read("organization", "access", { organization: home.id }),
+          read("oauthClients", "list", { organization: home.id }),
+        ];
+        yield* Effect.forEach(
+          Array.from({ length: 6 }, (_, round) => round),
+          (round) =>
+            Effect.all(
+              [
+                send(actors.owner, rotate(identity, round)),
+                send(actors.member, rotate(identity, round)),
+              ],
+              { concurrency: "unbounded" },
+            ).pipe(
+              Effect.flatMap(([owner, member]) =>
+                Effect.gen(function* () {
+                  const order = rotate([0, 1, 2], round);
+                  const at = (answers: typeof owner, index: number) =>
+                    answers[order.indexOf(index)];
+                  expect((yield* viewerOf(at(owner, 0))).userId).toBe(viewers.owner.userId);
+                  expect(yield* roleOf(at(owner, 1))).toBe("owner");
+                  expect(at(owner, 2)?.status).toBe(200);
+                  expect((yield* viewerOf(at(member, 0))).userId).toBe(viewers.member.userId);
+                  expect(yield* roleOf(at(member, 1))).toBe("member");
+                  expect(at(member, 2)?.status).toBe(403);
+                }),
+              ),
+            ),
+          { concurrency: 3, discard: true },
+        );
+
+        // A bearer grant never uses the batch's shared session checks. Whatever the cookie beside
+        // it, even another user's, every read answers exactly as it does sent alone with the same
+        // headers: the API key's authority on organization reads, and a refusal on browser-only ones.
+        const key = yield* body(
+          Key,
+          yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+            name: "Batch isolation",
+            metadata: { organization: home.id },
+          }),
+        );
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+            .pipe(Effect.orDie),
+        );
+        const bearer = { authorization: `Bearer ${Redacted.value(key.key)}` };
+        for (const caller of [actors.owner, actors.member, yield* api.session()]) {
+          const batched = statuses(yield* send(caller, identity, bearer));
+          expect(batched).toEqual(yield* alone(caller, identity, bearer));
+          expect(batched[0]).toBe(401);
+        }
+
+        // A role change between batches is read by the next batch.
+        const roster = yield* body(
+          Roster,
+          yield* api.request(
+            actors.owner,
+            "GET",
+            `/api/auth/organization/list-members?organizationId=${home.id}`,
+          ),
+        );
+        const membership = roster.members.find(({ userId }) => userId === viewers.member.userId);
+        if (membership === undefined)
+          return yield* Effect.die("The member's membership is missing");
+        const setRole = (role: "admin" | "member") =>
+          api
+            .request(actors.owner, "POST", "/api/auth/organization/update-member-role", {
+              organizationId: home.id,
+              memberId: membership.id,
+              role,
+            })
+            .pipe(Effect.map((response) => expect(response.status).toBe(200)));
+        yield* setRole("admin");
+        const promoted = yield* send(actors.member, identity);
+        expect(yield* roleOf(promoted[1])).toBe("admin");
+        expect(promoted[2]?.status).toBe(200);
+        yield* setRole("member");
+        const demoted = yield* send(actors.member, identity);
+        expect(yield* roleOf(demoted[1])).toBe("member");
+        expect(demoted[2]?.status).toBe(403);
+
+        if (!cloud) return;
+        // Self-host has one organization. On Cloud, one batch spans organizations where the caller
+        // has different roles, one it does not belong to, and aliases of each.
+        const suffix = randomUUID().slice(0, 8);
+        const foreign = yield* body(
+          Organization,
+          yield* api.request(actors.owner, "POST", "/api/auth/organization/create", {
+            name: "Batch isolation foreign",
+            slug: `batch-foreign-${suffix}`,
+            keepCurrentActiveOrganization: true,
+          }),
+        );
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "DELETE", `/api/organizations/${foreign.id}`)
+            .pipe(Effect.orDie),
+        );
+        const own = yield* body(
+          Organization,
+          yield* api.request(actors.member, "POST", "/api/auth/organization/create", {
+            name: "Batch isolation own",
+            slug: `batch-own-${suffix}`,
+            keepCurrentActiveOrganization: true,
+          }),
+        );
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.member, "DELETE", `/api/organizations/${own.id}`).pipe(Effect.orDie),
+        );
+        const mixed = [
+          read("organization", "access", { organization: home.id }),
+          read("oauthClients", "list", { organization: home.id }),
+          read("organization", "access", { organization: foreign.id }),
+          read("oauthClients", "list", { organization: foreign.id }),
+          read("organization", "access", { organization: own.id }),
+          read("oauthClients", "list", { organization: own.id }),
+          read("organization", "access", { organization: home.slug }),
+          read("organization", "access", { organization: foreign.slug }),
+          read("organization", "access", { organization: own.slug }),
+          read("oauthClients", "list", { organization: foreign.slug }),
+        ];
+        const expected = [200, 403, 403, 403, 200, 200, 200, 403, 200, 403];
+        for (let round = 0; round < mixed.length; round++) {
+          const order = rotate(
+            mixed.map((_, index) => index),
+            round,
+          );
+          const answers = yield* send(
+            actors.member,
+            order.map((index) => mixed[index] as Read),
+          );
+          // Answers come back by position sent; map each to the read it answers.
+          const of = (index: number) => answers[order.indexOf(index)];
+          expect(mixed.map((_, index) => of(index)?.status)).toEqual(expected);
+          const roles = yield* Effect.forEach([0, 4, 6, 8], (index) => roleOf(of(index)));
+          expect(roles).toEqual(["member", "owner", "member", "owner"]);
+        }
+        // The owner's batch on the same organizations is answered with the owner's roles.
+        const owner = yield* send(actors.owner, mixed);
+        expect(statuses(owner)).toEqual([200, 200, 200, 200, 403, 403, 200, 200, 403, 200]);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/dashboard-loading.spec.ts b/e2e/tests/dashboard-loading.spec.ts
index 8230f54fb3..25cc31914a 100644
--- a/e2e/tests/dashboard-loading.spec.ts
+++ b/e2e/tests/dashboard-loading.spec.ts
@@ -44,7 +44,7 @@ layer(HostedLive, { excludeTestServices: true })("Dashboard loading", (it) => {
         ]) {
           for (const section of ["apps", "accounts"] as const) {
             yield* browser.use("Open a page that reads neither section", (page) =>
-              page.goto(`/org/${actors.organization.slug}/connect`),
+              page.goto(`/org/${actors.organization.slug}/organization`),
             );
             yield* Effect.scoped(
               Effect.gen(function* () {
diff --git a/e2e/tests/dashboard-read-batches.spec.ts b/e2e/tests/dashboard-read-batches.spec.ts
index 580012d7e3..f251a09fd4 100644
--- a/e2e/tests/dashboard-read-batches.spec.ts
+++ b/e2e/tests/dashboard-read-batches.spec.ts
@@ -4,7 +4,8 @@
  * schemas under the batch request's identity, streaming each answer as it finishes.
  */
 import { expect, layer } from "@effect/vitest";
-import { Effect, Schema } from "effect";
+import { Effect, Schedule, Schema } from "effect";
+import { randomUUID } from "node:crypto";
 import { Actors } from "../support/actors.ts";
 import { Api, body } from "../support/api.ts";
 import { Browser } from "../support/browser.ts";
@@ -12,7 +13,7 @@ import { HostedLive, withHostedCase } from "../support/case.ts";
 import { openInApp, openThroughBrowser } from "../support/in-app-navigation.ts";
 import { appsManifest } from "../support/apps-release.ts";
 import { batchedReads, batchPath } from "../support/read-batches.ts";
-import { Evidence } from "../support/evidence.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
 import { Target } from "../support/platform.ts";
 import { targetHosts } from "../support/role-hosts.ts";
 import { serverControl } from "../support/server-control.ts";
@@ -307,7 +308,7 @@ layer(HostedLive, { excludeTestServices: true })("Dashboard read batches", (it)
           ),
         );
         yield* browser.use("Open a page that does not read the app", (page) =>
-          page.goto(`/org/${actors.organization.slug}/connect`),
+          page.goto(`/org/${actors.organization.slug}/organization`),
         );
         yield* browser.use("Record the dashboard's failed reads", (page) =>
           page.evaluate(() => {
@@ -338,6 +339,98 @@ layer(HostedLive, { excludeTestServices: true })("Dashboard read batches", (it)
     ),
   );
 
+  it.effect(scenarios.dashboardReadStatus.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors;
+        const browser = yield* Browser;
+        const telemetry = yield* Telemetry;
+        const evidence = yield* Evidence;
+        const organization = actors.organization.id;
+        const prefix = `/api/organizations/${organization}`;
+        // Listing this app's tools fails on the server: its factory throws.
+        const failing = yield* deploy(
+          "Failing batched read",
+          'throw new Error("Synthetic factory failure");',
+        );
+        const index = "/api/organizations/:organization/apps/:app/tools/index";
+        const planned: ReadonlyArray<{ readonly read: Read; readonly route: string }> = [
+          { read: { group: "viewer", endpoint: "get", path: "/api/viewer" }, route: "/api/viewer" },
+          {
+            read: {
+              group: "tools",
+              endpoint: "index",
+              params: { organization, app: "app_missing" },
+              path: `${prefix}/apps/app_missing/tools/index`,
+            },
+            route: index,
+          },
+          {
+            read: {
+              group: "tools",
+              endpoint: "index",
+              params: { organization, app: failing.id },
+              path: `${prefix}/apps/${failing.id}/tools/index`,
+            },
+            route: index,
+          },
+        ];
+        // Each read joins a trace of its own, as a page's reads do, so its span is found by it.
+        const reads = planned.map(({ read, route }) => {
+          const traceId = randomUUID().replaceAll("-", "");
+          return {
+            route,
+            traceId,
+            read: { ...read, extra: { traceparent: `00-${traceId}-${traceId.slice(0, 16)}-01` } },
+          };
+        });
+
+        yield* browser.login(actors.owner);
+        yield* browser.use("Open the organization's apps", (page) =>
+          page.goto(`/org/${actors.organization.slug}`),
+        );
+        const batch = yield* batchFromPage(reads.map(({ read }) => read));
+        expect(batch.status).toBe(200);
+        expect(contents(batch.batched)).toEqual(batch.direct);
+        const [found, missing, failed] = batch.direct.map((answer) => answer.status);
+        expect(found).toBe(200);
+        expect(missing).toBeGreaterThanOrEqual(400);
+        expect(missing).toBeLessThan(500);
+        expect(failed).toBe(502);
+
+        // The batch answered 200, but each read's span records the status it answered itself. A
+        // refusal is the endpoint's answer; only a server error fails the span.
+        const spans: Array<unknown> = [];
+        for (const [position, { route, traceId, read }] of reads.entries()) {
+          const status = batch.direct[position]?.status;
+          const span = yield* telemetry.query(traceId).pipe(
+            Effect.flatMap((result) => {
+              const delivered = result.data.find(
+                ({ span }) => span.operationName === "dashboard.batch.read",
+              );
+              return delivered === undefined
+                ? Effect.fail(new Error("Missing delivered dashboard.batch.read span"))
+                : Effect.succeed(delivered.span);
+            }),
+            Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 80 }),
+          );
+          expect(span.tags, read.path).toMatchObject({
+            "http.route": route,
+            "http.response.status_code": String(status),
+            "executor.batch.read": `${read.group}.${read.endpoint}`,
+          });
+          expect(span.status, read.path).toBe(status === 502 ? "error" : "ok");
+          expect(span.tags["executor.outcome"], read.path).toBe(
+            status === 502 ? "failed" : undefined,
+          );
+          spans.push(span);
+        }
+        yield* evidence.json("batched-read-spans.json", spans);
+      }),
+    ),
+  );
+
   it.effect(scenarios.dashboardBuildChange.title, (context) =>
     withHostedCase(
       context,
diff --git a/e2e/tests/departed-member-app-links.spec.ts b/e2e/tests/departed-member-app-links.spec.ts
new file mode 100644
index 0000000000..8f7da60cad
--- /dev/null
+++ b/e2e/tests/departed-member-app-links.spec.ts
@@ -0,0 +1,64 @@
+/**
+ * An app link to a member's personal account serves the app only while that member is in the
+ * organization. Once they leave, the account no longer fills the requirement, while its link stays
+ * listed for the app's managers to remove; a shared account linked beside it keeps serving every
+ * caller.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { appLinksFixture, keyProvider, ok } from "../support/app-links.ts";
+import { scenarios } from "../test-plan.ts";
+
+/** An app whose many() app requirement reports the accounts a call ran with. */
+const source = `import { defineApp, defineProvider, query, secrets, object, string, router, type QueryContext } from "apps";
+const team = ${keyProvider("Departed member link fixture")};
+const requirements = { app: { accounts: { team: team.many() } } };
+const accounts = query({ input: object({}) }, async (ctx: QueryContext<typeof requirements>) => ({
+  team: ctx.app.accounts.team.map((account) => account.id),
+}));
+export default defineApp(requirements, async () => ({ tools: router({ accounts }) }));`;
+const Accounts = Schema.Struct({ team: Schema.Array(Schema.String) });
+const SessionIdentity = Schema.Struct({ user: Schema.Struct({ email: Schema.String }) });
+
+layer(HostedLive, { excludeTestServices: true })("Departed member app links", (it) => {
+  it.effect(scenarios.hostedDepartedMemberAppLink.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const fixture = yield* appLinksFixture([{ path: "index.ts", content: source }]);
+        const { api, actors, connect, links } = fixture;
+        const used = Effect.gen(function* () {
+          const response = yield* fixture.call(actors.member, "accounts");
+          yield* ok(response);
+          return (yield* body(Accounts, response)).team;
+        });
+        const listed = Effect.map(links(), (read) => read.map((item) => item.account.id));
+
+        // The admin links their personal account for everyone, then the owner a shared one.
+        const personal = yield* connect(actors.admin, "app", "team", "departed-admin-team");
+        const shared = yield* connect(actors.owner, "app", "team", "departed-shared-team", {
+          kind: "shared",
+          audience: { kind: "everyone" },
+        });
+        expect(yield* used).toEqual([personal, shared]);
+        expect(yield* listed).toEqual([personal, shared]);
+
+        // The admin leaves. The app can no longer use their account; its link stays listed.
+        const { user } = yield* body(
+          SessionIdentity,
+          yield* api.request(actors.admin, "GET", "/api/auth/get-session"),
+        );
+        yield* ok(
+          yield* api.request(actors.owner, "POST", "/api/auth/organization/remove-member", {
+            organizationId: actors.organization.id,
+            memberIdOrEmail: user.email,
+          }),
+        );
+        expect(yield* used).toEqual([shared]);
+        expect(yield* listed).toEqual([personal, shared]);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/desktop-recovery.spec.ts b/e2e/tests/desktop-recovery.spec.ts
index 752b11c6d2..d6eb912502 100644
--- a/e2e/tests/desktop-recovery.spec.ts
+++ b/e2e/tests/desktop-recovery.spec.ts
@@ -1,26 +1,43 @@
 import { expect, it } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { Config, Effect, Fiber, FileSystem, Layer, Path, Schedule, Schema } from "effect";
-import { FetchHttpClient } from "effect/http";
+import { Config, Effect, Fiber, FileSystem, Layer, Option, Path, Schedule, Schema } from "effect";
+import { FetchHttpClient, HttpRouter, HttpServer, HttpServerResponse } from "effect/http";
 import type { ElectronApplication, Page } from "playwright";
 import { randomBytes, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
 import { driver } from "../support/platform.ts";
 import { localNpmRegistry } from "../support/npm-registry.ts";
-import { freePort } from "../support/ports.ts";
+import { connectionRefused, freePort } from "../support/ports.ts";
 import {
   answerDialogs,
   answeredDialogs,
-  backendPids,
+  answersReady,
+  clickMenuItem,
+  dashboardLoads,
+  desktopCli,
   desktopEvents,
   eventsNamed,
-  clickMenuItem,
-  killBackend,
+  failDashboardLoads,
   lateLoadFailures,
   launchDesktop,
+  menuBar,
   menuLabels,
-  nextBackendPid,
+  nextServer,
+  processAlive,
+  registeredServer,
   reportReplacedLoadFailuresLate,
+  runnerSession,
+  serverStarts,
+  stallStarter,
+  stopBackgroundServers,
+  suspendProcess,
 } from "../support/desktop.ts";
+import {
+  crashServer,
+  type ServiceRegistration,
+  stoppingServer,
+} from "../support/background-service.ts";
 import { scenarios } from "../test-plan.ts";
 
 const Installation = Schema.Struct({
@@ -48,11 +65,27 @@ const Manifest = Schema.Struct({
  * the OS credential store somewhere it cannot be used: an empty home has no macOS default
  * keychain, which refuses access, and a missing bus has no Linux Secret Service, which is absent.
  * Windows Credential Manager cannot be made unusable for one process.
+ *
+ * The desktop starts its background server detached, and it outlives the desktop, so the scope
+ * stops every server the scenario left for the data directory, or for `legacy`, the directory an
+ * older desktop kept its data in. `port: false` leaves EXECUTOR_PORT unset for the desktop, so
+ * `service.json` chooses its server's port.
+ *
+ * The OS per-user cache directory is inside the scenario's directory too: the server keeps its
+ * compile cache there, and a packaged desktop's updater downloads updates into it
+ * (`%LOCALAPPDATA%`, `~/Library/Caches` or `$XDG_CACHE_HOME`).
  */
-const desktopHome = (keys: "supplied" | "file" | "unreachable-store" = "supplied") =>
+const desktopHome = (
+  options: {
+    readonly keys?: "supplied" | "file" | "unreachable-store";
+    readonly port?: boolean;
+    readonly legacy?: boolean;
+  } = {},
+) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
+    const keys = options.keys ?? "supplied";
     const home = yield* fs.makeTempDirectoryScoped({ prefix: "executor-desktop-recovery-" });
     const runtimePath = yield* Config.String("EXECUTOR_E2E_RUNTIME_PATH").pipe(
       Config.withDefault(process.env.PATH ?? ""),
@@ -61,30 +94,30 @@ const desktopHome = (keys: "supplied" | "file" | "unreachable-store" = "supplied
     // The server deploys the bundled Executor app, which pins this checkout's apps release.
     const registry = yield* localNpmRegistry;
     const data = path.join(home, "data");
-    const display = Object.fromEntries(
-      [
-        "DISPLAY",
-        "XAUTHORITY",
-        "WAYLAND_DISPLAY",
-        "XDG_RUNTIME_DIR",
-        "XDG_SESSION_TYPE",
-        "DBUS_SESSION_BUS_ADDRESS",
-      ].flatMap((name) => {
-        const value = process.env[name];
-        return value === undefined ? [] : [[name, value] as const];
-      }),
-    );
+    const legacy = path.join(home, "legacy");
+    const cacheHome = path.join(home, "cache-home");
     const common = {
-      ...display,
+      ...runnerSession(),
       // Release scenarios never send product analytics, even from a build with a baked key.
       DO_NOT_TRACK: "1",
+      EXECUTOR_NO_UPDATE_CHECK: "1",
       PATH: runtimePath,
-      EXECUTOR_PORT: String(port),
+      ...(process.platform === "win32"
+        ? { LOCALAPPDATA: cacheHome }
+        : process.platform === "darwin"
+          ? {}
+          : { XDG_CACHE_HOME: cacheHome }),
+      ...(options.port === false ? {} : { EXECUTOR_PORT: String(port) }),
       EXECUTOR_DESKTOP_DATA_DIR: data,
+      ...(options.legacy === true ? { EXECUTOR_DESKTOP_LEGACY_DATA_DIR: legacy } : {}),
       EXECUTOR_DESKTOP_PROFILE_DIR: path.join(home, "profile"),
       EXECUTOR_NPM_REGISTRY: registry.url,
     };
-    const env: Record<string, string> = { ...common, HOME: process.env.HOME ?? "" };
+    // macOS has no variable for its cache directory, only the home it is in.
+    const env: Record<string, string> = {
+      ...common,
+      HOME: process.platform === "darwin" ? cacheHome : (process.env.HOME ?? ""),
+    };
     if (keys === "supplied") {
       env.EXECUTOR_API_KEY = randomBytes(32).toString("hex");
       env.EXECUTOR_ENCRYPTION_KEY = randomBytes(32).toString("hex");
@@ -93,7 +126,26 @@ const desktopHome = (keys: "supplied" | "file" | "unreachable-store" = "supplied
       env.HOME = home;
       env.DBUS_SESSION_BUS_ADDRESS = `unix:path=${path.join(home, "no-bus")}`;
     }
-    return { home, data, env, origin: `http://127.0.0.1:${port}` };
+    const seen: Array<ServiceRegistration> = [];
+    yield* Effect.addFinalizer(() =>
+      Effect.forEach([data, legacy], (directory) => stopBackgroundServers(directory, () => seen)),
+    );
+    // The CLI on the same data directory as the desktop.
+    const cli = yield* desktopCli({ env: { ...env, EXECUTOR_DATA_DIR: data }, cwd: home });
+    return {
+      home,
+      data,
+      legacy,
+      env,
+      port,
+      origin: `http://127.0.0.1:${port}`,
+      cli,
+      /** Wait for a server for `directory` other than `pids`; it is stopped with the scope. */
+      nextServer: (pids: ReadonlyArray<number>, directory = data) =>
+        nextServer(directory, pids).pipe(
+          Effect.tap((server) => Effect.sync(() => seen.push(server))),
+        ),
+    };
   });
 
 const screenshot = (page: Page, name: string) =>
@@ -128,51 +180,112 @@ const dashboard = (page: Page) =>
     page.getByRole("heading", { name: /^Apps/ }).waitFor({ state: "visible", timeout: 60_000 }),
   );
 
+/** The window's session is paired with the server it shows. */
+const pairedSession = (page: Page) =>
+  driver("the window's session is paired", () =>
+    page.evaluate(() =>
+      fetch("/auth/session", { credentials: "include" }).then((response) => response.json()),
+    ),
+  );
+
+/** `executor service status` for a running server. */
+const statusLine = (server: ServiceRegistration) =>
+  `${server.url} (version ${server.version}, process ${server.pid})`;
+
 const services = Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer);
 
-const exited = "Desktop backend exited";
-const restarting = "Restarting the desktop backend";
+/** What the CLI says on stderr when it starts a background server. */
+const startingInCli = "Starting background Executor";
+const Apps = Schema.fromJsonString(
+  Schema.Array(Schema.Struct({ id: Schema.String, slug: Schema.String })),
+);
+
+const lostServer = "Background Executor stopped answering";
+const dashboardFailed = "Desktop window could not load the dashboard";
+const waitingForServer = "Waiting for the background Executor to start again";
 
 it.live(scenarios.desktopCrashRecovery.title, () =>
   Effect.scoped(
     Effect.gen(function* () {
-      const { home, data, env, origin } = yield* desktopHome();
+      const { data, home, env, origin, cli, nextServer } = yield* desktopHome();
       const electron = yield* launchDesktop({ cwd: home, env });
       const page = yield* driver("desktop window", () => electron.firstWindow());
       yield* dashboard(page);
       expect(new URL(page.url()).origin).toBe(origin);
+      const first = yield* nextServer([]);
+      const pids = [first.pid];
 
-      // An outside request to stop is not a crash, but the server is still gone: it restarts.
-      const [first] = yield* backendPids(data);
-      expect(first).toBeTypeOf("number");
-      yield* killBackend(first!, "SIGTERM");
-      const second = yield* nextBackendPid(data, [first!]);
-      const [stopped] = yield* eventsNamed(data, exited, 1);
-      expect(stopped?.annotations).toMatchObject({
-        kind: process.platform === "win32" ? "crash" : "external-shutdown",
-        ready: true,
-      });
-
-      // A crash before readiness doubles the restart delay.
-      yield* killBackend(second, "SIGKILL");
-      const third = yield* nextBackendPid(data, [first!, second]);
-      const early = (yield* eventsNamed(data, exited, 2))[1];
-      expect(early?.annotations).toMatchObject({ kind: "crash", ready: false });
+      // Stopping the shared server on purpose, as `executor service stop` does, is not a crash,
+      // and the desktop does not start another by itself: it says the server was stopped.
+      const stopped = yield* cli.run(["service", "stop"]);
+      expect(stopped.code, stopped.stderr).toBe(0);
+      yield* recoveryHeading(page, "The background Executor was stopped");
+      yield* screenshot(page, "stopped");
       expect(
-        (yield* eventsNamed(data, restarting, 2)).map((event) => event.annotations.delayMillis),
-      ).toEqual([500, 1_000]);
+        yield* driver("stopped page actions", () => page.getByRole("button").allTextContents()),
+      ).toEqual(["Start", "Quit"]);
+      yield* eventsNamed(data, waitingForServer, 1);
+      const starts = yield* serverStarts(data);
+      expect((yield* cli.run(["service", "status"])).stdout.trim()).toBe("stopped");
 
-      // The restarted server accepts the window's new one-use pairing.
+      // A server the CLI starts again is joined as soon as it answers, without starting one: the
+      // CLI found none running, and the desktop started none.
+      const begun = yield* cli.run(["service", "start"]);
+      expect(begun.code, begun.stderr).toBe(0);
+      expect(begun.stderr).toContain(startingInCli);
+      const fromCli = yield* nextServer(pids);
+      pids.push(fromCli.pid);
       yield* dashboard(page);
-      const session = yield* driver("the restarted server accepts the window's pairing", () =>
-        page.evaluate(() =>
-          fetch("/auth/session", { credentials: "include" }).then((response) => response.json()),
-        ),
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect((yield* eventsNamed(data, "Background Executor ready", 2))[1]?.annotations.pid).toBe(
+        fromCli.pid,
       );
-      expect(session).toEqual({ authenticated: true });
 
-      // Three unexpected exits within a minute stop restarts and show recovery.
-      yield* killBackend(third);
+      // `executor service restart` replaces it, and the desktop follows to the new one.
+      const restart = yield* cli.run(["service", "restart"]);
+      expect(restart.code, restart.stderr).toBe(0);
+      const replacement = yield* nextServer(pids);
+      pids.push(replacement.pid);
+      expect((yield* eventsNamed(data, "Background Executor ready", 3))[2]?.annotations.pid).toBe(
+        replacement.pid,
+      );
+      yield* dashboard(page);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect(yield* serverStarts(data)).toBe(starts);
+
+      // Start on the stopped page starts a server from the desktop and pairs the window with it.
+      expect((yield* cli.run(["service", "stop"])).code).toBe(0);
+      yield* recoveryHeading(page, "The background Executor was stopped");
+      yield* driver("start from the stopped page", () =>
+        page.getByRole("button", { name: "Start", exact: true }).click(),
+      );
+      const fromDesktop = yield* nextServer(pids);
+      pids.push(fromDesktop.pid);
+      expect(fromDesktop.url).toBe(origin);
+      yield* dashboard(page);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect(yield* serverStarts(data)).toBe(starts + 1);
+      const deliberate = (yield* eventsNamed(data, lostServer, 3)).map(
+        (event) => event.annotations.loss,
+      );
+      expect(deliberate[0]).toBe("stopped");
+      expect(["stopped", "replaced"]).toContain(deliberate[1]);
+      expect(deliberate[2]).toBe("stopped");
+
+      // A server that crashes leaves its registration behind and stops answering. The desktop
+      // replaces it and pairs the window with the new one.
+      for (const _ of [1, 2]) {
+        yield* crashServer(pids[pids.length - 1]!);
+        const next = yield* nextServer(pids);
+        expect(next.url).toBe(origin);
+        pids.push(next.pid);
+        yield* dashboard(page);
+        expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      }
+      const crashStarts = yield* serverStarts(data);
+
+      // A third crash within a minute stops reconnecting and shows recovery; no server starts.
+      yield* crashServer(pids[pids.length - 1]!);
       yield* driver("crash-loop recovery", () =>
         page
           .getByRole("heading", { name: "Executor keeps stopping", exact: true })
@@ -183,27 +296,23 @@ it.live(scenarios.desktopCrashRecovery.title, () =>
         page.getByRole("button").allTextContents(),
       );
       expect(actions).toEqual(["Restart", "Show logs", "Reset data…", "Quit"]);
-      expect(yield* backendPids(data)).toHaveLength(3);
-      expect(yield* eventsNamed(data, restarting, 2)).toHaveLength(2);
+      expect(
+        (yield* eventsNamed(data, lostServer, 6)).slice(3).map((event) => event.annotations.loss),
+      ).toEqual(["unanswered", "unanswered", "unanswered"]);
+      expect(yield* serverStarts(data)).toBe(crashStarts);
+      const left = yield* registeredServer(data);
+      expect(Option.isNone(left) || !(yield* processAlive(left.value.pid))).toBe(true);
 
-      // Restart from the recovery page starts supervision afresh.
+      // Restart from the recovery page starts a server and pairs the window again.
       yield* driver("restart from recovery", () =>
         page.getByRole("button", { name: "Restart", exact: true }).click(),
       );
-      const fourth = yield* nextBackendPid(data, [first!, second, third]);
-      yield* killBackend(fourth);
-      const fifth = yield* nextBackendPid(data, [first!, second, third, fourth]);
-      expect((yield* eventsNamed(data, exited, 4))[3]?.annotations.ready).toBe(false);
-      // Readiness resets the delay: this exit waits the first delay again, not a doubled one.
-      yield* dashboard(page);
-      yield* killBackend(fifth);
-      yield* nextBackendPid(data, [first!, second, third, fourth, fifth]);
-      expect((yield* eventsNamed(data, exited, 5))[4]?.annotations.ready).toBe(true);
-      expect(
-        (yield* eventsNamed(data, restarting, 4)).map((event) => event.annotations.delayMillis),
-      ).toEqual([500, 1_000, 500, 500]);
+      const restarted = yield* nextServer(pids);
       yield* dashboard(page);
-      expect(yield* backendPids(data)).toHaveLength(6);
+      expect(new URL(page.url()).origin).toBe(origin);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      const status = yield* cli.run(["service", "status"]);
+      expect(status.stdout.trim()).toBe(statusLine(restarted));
     }),
   ).pipe(Effect.provide(services)),
 );
@@ -211,29 +320,29 @@ it.live(scenarios.desktopCrashRecovery.title, () =>
 it.live(scenarios.desktopLateLoadFailure.title, () =>
   Effect.scoped(
     Effect.gen(function* () {
-      const { home, data, env } = yield* desktopHome();
+      const { home, data, env, nextServer } = yield* desktopHome();
       const electron = yield* launchDesktop({ cwd: home, env });
       const page = yield* driver("desktop window", () => electron.firstWindow());
       yield* dashboard(page);
       yield* reportReplacedLoadFailuresLate(electron);
 
-      // The server exits, so the window shows the startup page, and then hears that the dashboard
-      // it replaced failed to load. The startup page shows only until the restarted server is
-      // ready, so the wait for it starts on the dashboard. It reads from the window: a desktop
-      // stopped behind its error box answers no main-process call.
+      // The server crashes, so the window shows the startup page, and then hears that the
+      // dashboard it replaced failed to load. The startup page shows only until the replacement
+      // server is ready, so the wait for it starts on the dashboard. It reads from the window: a
+      // desktop stopped behind its error box answers no main-process call.
       const startupPage = yield* driver("the window shows the startup page", () =>
         page.waitForURL((url) => url.protocol === "data:", { timeout: 30_000 }),
       ).pipe(Effect.forkScoped({ startImmediately: true }));
-      const [first] = yield* backendPids(data);
-      yield* killBackend(first!);
-      yield* nextBackendPid(data, [first!]);
+      const first = yield* nextServer([]);
+      yield* crashServer(first.pid);
+      yield* nextServer([first.pid]);
       yield* Fiber.join(startupPage);
 
       // That failure was the dashboard's, not the startup page's: the desktop keeps its window
-      // and opens the restarted server's dashboard.
+      // and opens the new server's dashboard.
       yield* dashboard(page);
       expect(yield* lateLoadFailures(electron)).toBe(1);
-      expect(yield* eventsNamed(data, "Desktop backend ready", 2)).toHaveLength(2);
+      expect(yield* eventsNamed(data, "Executor desktop ready", 2)).toHaveLength(2);
       expect((yield* desktopEvents(data)).map((event) => event.message)).not.toContain(
         "Desktop stopped",
       );
@@ -241,6 +350,793 @@ it.live(scenarios.desktopLateLoadFailure.title, () =>
   ).pipe(Effect.provide(services)),
 );
 
+it.live(scenarios.desktopDashboardRetry.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { home, data, env, origin, nextServer } = yield* desktopHome();
+      const electron = yield* launchDesktop({ cwd: home, env });
+      const page = yield* driver("desktop window", () => electron.firstWindow());
+      yield* dashboard(page);
+      const first = yield* nextServer([]);
+      const failures = Effect.map(desktopEvents(data), (events) =>
+        events.filter((event) => event.message === dashboardFailed),
+      );
+      expect(yield* failures).toEqual([]);
+
+      // The window's next two dashboard loads fail. Each time the desktop loads the dashboard
+      // again with a fresh pairing link, since the one it used is spent, and the window is paired.
+      yield* failDashboardLoads(electron, origin, 2);
+      yield* crashServer(first.pid);
+      const second = yield* nextServer([first.pid]);
+      yield* dashboard(page);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect(yield* dashboardLoads(electron)).toEqual({ failed: 2, links: 3 });
+      expect(
+        (yield* eventsNamed(data, dashboardFailed, 2)).map(({ annotations }) => [
+          annotations.attempt,
+          annotations.failure,
+        ]),
+      ).toEqual([
+        [1, "ERR_BLOCKED_BY_CLIENT (-20)"],
+        [2, "ERR_BLOCKED_BY_CLIENT (-20)"],
+      ]);
+      expect(yield* failures).toHaveLength(2);
+
+      // When every load fails, the third failure in a row shows the dashboard's own recovery page
+      // with the failure, and no other server starts. The server runs, so it offers no reset.
+      // Restart joins the server and pairs the window.
+      const starts = yield* serverStarts(data);
+      yield* failDashboardLoads(electron, origin, "all");
+      yield* crashServer(second.pid);
+      const third = yield* nextServer([first.pid, second.pid]);
+      yield* recoveryHeading(page, "Executor could not load its dashboard");
+      yield* screenshot(page, "recovery-dashboard");
+      expect(
+        yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
+      ).toEqual(["Restart", "Show logs", "Quit"]);
+      expect(yield* driver("the failure", () => page.locator("pre").textContent())).toBe(
+        `The Executor window could not load the dashboard from ${origin} 3 times in a row. The last time: ERR_BLOCKED_BY_CLIENT (-20).`,
+      );
+      expect((yield* failures).slice(2).map(({ annotations }) => annotations.attempt)).toEqual([
+        1, 2, 3,
+      ]);
+      const [shown] = yield* eventsNamed(data, "Showing desktop recovery", 1);
+      expect(shown?.annotations.recovery).toEqual({ stage: "dashboard" });
+      expect(yield* dashboardLoads(electron)).toEqual({ failed: 5, links: 6 });
+      expect(yield* serverStarts(data)).toBe(starts + 1);
+      expect(yield* answersReady(third)).toBe(true);
+
+      yield* failDashboardLoads(electron, origin, 0);
+      yield* driver("restart from recovery", () =>
+        page.getByRole("button", { name: "Restart", exact: true }).click(),
+      );
+      yield* dashboard(page);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect(yield* serverStarts(data)).toBe(starts + 1);
+      expect((yield* eventsNamed(data, "Background Executor ready", 4))[3]?.annotations.pid).toBe(
+        third.pid,
+      );
+      expect(yield* failures).toHaveLength(5);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+it.live(
+  scenarios.desktopStarterDeadline.title,
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const { home, data, env, nextServer } = yield* desktopHome();
+        const electron = yield* launchDesktop({ cwd: home, env });
+        const page = yield* driver("desktop window", () => electron.firstWindow());
+        // The server starter stops answering once it has started a server: it and that start
+        // attempt hang until they are resumed.
+        const stalled = yield* stallStarter(electron);
+
+        // After its deadline the desktop stops waiting and says the server could not start.
+        yield* driver("start recovery after the starter's deadline", () =>
+          page
+            .getByRole("heading", {
+              name: "Executor could not start its local server",
+              exact: true,
+            })
+            .waitFor({ state: "visible", timeout: 240_000 }),
+        );
+        const [failed] = yield* eventsNamed(data, "Background Executor could not start", 1);
+        expect(failed?.annotations.detail).toContain(
+          "did not say whether the server started within 3 minutes",
+        );
+
+        // The hung starter is stopped, and the start attempt it left, which never served, is
+        // ended first, as the starter would have ended it.
+        const [ended] = yield* eventsNamed(
+          data,
+          "Ended a start attempt of a server starter that did not exit",
+          1,
+        );
+        expect(ended?.annotations.pid).toBe(stalled.attempt);
+        yield* stalled.resume;
+        yield* processAlive(stalled.attempt).pipe(
+          Effect.filterOrFail(
+            (alive) => !alive,
+            () => new Error("The start attempt the hung starter left still runs"),
+          ),
+          Effect.retry({ schedule: Schedule.spaced("100 millis"), times: 100 }),
+        );
+        expect(Option.isNone(yield* registeredServer(data))).toBe(true);
+
+        // Restart starts a server and pairs the window with it.
+        yield* driver("restart from recovery", () =>
+          page.getByRole("button", { name: "Restart", exact: true }).click(),
+        );
+        yield* nextServer([stalled.attempt]);
+        yield* dashboard(page);
+        expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+        expect(yield* serverStarts(data)).toBe(2);
+      }),
+    ).pipe(Effect.provide(services)),
+  300_000,
+);
+
+it.live(scenarios.desktopSharedService.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { home, data, env, origin, cli, nextServer } = yield* desktopHome({ keys: "file" });
+
+      // The desktop starts the data directory's background server, and the CLI uses that one.
+      const started = yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home, env });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* dashboard(page);
+          expect(new URL(page.url()).origin).toBe(origin);
+          const server = yield* nextServer([]);
+          const [ready] = yield* eventsNamed(data, "Background Executor ready", 1);
+          expect(ready?.annotations.pid).toBe(server.pid);
+          const status = yield* cli.run(["service", "status"]);
+          expect(status.code, status.stderr).toBe(0);
+          expect(status.stdout.trim()).toBe(statusLine(server));
+          const listed = yield* cli.run(["apps", "list"]);
+          expect(listed.code, listed.stderr).toBe(0);
+          expect(listed.stderr).not.toContain(startingInCli);
+          expect((yield* Schema.decodeUnknownEffect(Apps)(listed.stdout)).length).toBeGreaterThan(
+            0,
+          );
+          return server;
+        }),
+      );
+
+      // Quitting the desktop leaves the server running for the CLI and MCP clients.
+      expect(yield* answersReady(started)).toBe(true);
+      const after = yield* cli.run(["service", "status"]);
+      expect(after.stdout.trim()).toBe(statusLine(started));
+
+      // A server the CLI starts is the one the desktop joins: it starts none of its own.
+      const stopped = yield* cli.run(["service", "stop"]);
+      expect(stopped.code, stopped.stderr).toBe(0);
+      expect(yield* processAlive(started.pid)).toBe(false);
+      expect((yield* cli.run(["service", "status"])).stdout.trim()).toBe("stopped");
+      const begun = yield* cli.run(["service", "start"]);
+      expect(begun.code, begun.stderr).toBe(0);
+      expect(begun.stdout.trim()).toBe(origin);
+      const fromCli = yield* nextServer([started.pid]);
+      const starts = yield* serverStarts(data);
+      const electron = yield* launchDesktop({ cwd: home, env });
+      const page = yield* driver("desktop window", () => electron.firstWindow());
+      yield* dashboard(page);
+      expect(new URL(page.url()).origin).toBe(origin);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      const [, joined] = yield* eventsNamed(data, "Background Executor ready", 2);
+      expect(joined?.annotations.pid).toBe(fromCli.pid);
+      expect(yield* serverStarts(data)).toBe(starts);
+      expect((yield* cli.run(["service", "status"])).stdout.trim()).toBe(statusLine(fromCli));
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+/**
+ * Real data in `directory`, made the way a user's is: the CLI starts a background server there,
+ * which sets up its keys, storage and bundled app. Returns that server and the apps it lists.
+ */
+const seedData = (
+  cli: Effect.Success<ReturnType<typeof desktopCli>>,
+  directory: string,
+  port: number,
+) =>
+  Effect.gen(function* () {
+    const listed = yield* cli.run(
+      ["apps", "list"],
+      { EXECUTOR_DATA_DIR: directory, EXECUTOR_PORT: String(port) },
+      { source: true },
+    );
+    expect(listed.code, listed.stderr).toBe(0);
+    const apps = yield* Schema.decodeUnknownEffect(Apps)(listed.stdout);
+    expect(apps.length).toBeGreaterThan(0);
+    const server = yield* nextServer(directory, []);
+    return { server, apps };
+  });
+
+/** An older desktop's `desktop.json`, which chose its server's port. */
+const legacySettings = (directory: string, port: number) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    yield* fs.writeFileString(
+      path.join(directory, "desktop.json"),
+      JSON.stringify({ version: 1, port }),
+    );
+  });
+
+const MigrationRecord = Schema.fromJsonString(
+  Schema.Struct({
+    state: Schema.String,
+    result: Schema.optional(
+      Schema.Struct({
+        kind: Schema.String,
+        archived: Schema.optional(Schema.String),
+        backup: Schema.optional(Schema.String),
+      }),
+    ),
+  }),
+);
+
+it.live(scenarios.desktopMigrationMoved.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      // No EXECUTOR_PORT: the old desktop's saved port must carry over to the shared directory.
+      const { home, data, legacy, env, cli, nextServer } = yield* desktopHome({
+        keys: "file",
+        port: false,
+        legacy: true,
+      });
+      const backups = path.join(home, "backups");
+      const old = yield* seedData(cli, legacy, yield* freePort);
+      const desktopPort = yield* freePort;
+      yield* legacySettings(legacy, desktopPort);
+      const installation = yield* fs.readFileString(path.join(legacy, "installation.json"));
+      const keys = yield* fs.readFileString(path.join(legacy, "keys.json"));
+      // Older desktops created their data directory with the default mode, readable by others.
+      const posix = process.platform !== "win32";
+      if (posix) yield* fs.chmod(legacy, 0o755);
+
+      // While a server still uses the old data, nothing moves and no server starts: the window
+      // explains what to quit.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home, env });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* recoveryHeading(page, "Executor could not move its data");
+          expect(
+            yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
+          ).toEqual(["Restart", "Quit"]);
+          const said = yield* driver("the migration's message", () =>
+            page.locator("pre").textContent(),
+          );
+          expect(said).toContain(`(process ${old.server.pid}) is using ${legacy}`);
+          expect(said).toContain("Nothing was changed.");
+          yield* screenshot(page, "recovery-migration");
+        }),
+      );
+      expect(yield* fs.exists(data)).toBe(false);
+      expect(yield* fs.exists(path.join(home, "migration.json"))).toBe(false);
+      expect(yield* fs.readFileString(path.join(legacy, "installation.json"))).toBe(installation);
+      const stopped = yield* cli.run(
+        ["service", "stop"],
+        { EXECUTOR_DATA_DIR: legacy },
+        { source: true },
+      );
+      expect(stopped.code, stopped.stderr).toBe(0);
+
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home, env });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* dashboard(page);
+          // The server runs on the moved data, on the old desktop's port.
+          expect(new URL(page.url()).origin).toBe(`http://127.0.0.1:${desktopPort}`);
+          const server = yield* nextServer([old.server.pid]);
+          expect(server.url).toBe(`http://127.0.0.1:${desktopPort}`);
+          expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+        }),
+      );
+
+      const [moved] = yield* eventsNamed(data, "Moved the desktop's data", 1);
+      expect(moved?.annotations.kind).toBe("moved");
+      expect(moved?.annotations.archived).toBeUndefined();
+      const backup = moved?.annotations.backup ?? "";
+      expect(path.dirname(backup)).toBe(backups);
+      expect(path.basename(backup)).toMatch(/^desktop-data-\d{8}T\d{6}Z-[0-9a-f]{6}$/);
+      // The data moved whole and unchanged, keys included; the old directory became the backup.
+      expect(yield* fs.exists(legacy)).toBe(false);
+      expect(yield* fs.readFileString(path.join(data, "installation.json"))).toBe(installation);
+      expect(yield* fs.readFileString(path.join(data, "keys.json"))).toBe(keys);
+      expect(yield* fs.readFileString(path.join(backup, "installation.json"))).toBe(installation);
+      expect(JSON.parse(yield* fs.readFileString(path.join(data, "service.json")))).toMatchObject({
+        port: desktopPort,
+      });
+      // The shared directory is private, as the CLI creates it, whatever the old one's mode was.
+      if (posix) expect((yield* fs.stat(data)).mode & 0o777).toBe(0o700);
+      const listed = yield* cli.run(["apps", "list"]);
+      expect(listed.code, listed.stderr).toBe(0);
+      expect(listed.stderr).not.toContain(startingInCli);
+      expect(yield* Schema.decodeUnknownEffect(Apps)(listed.stdout)).toEqual(old.apps);
+      const record = yield* fs
+        .readFileString(path.join(home, "migration.json"))
+        .pipe(Effect.flatMap(Schema.decodeUnknownEffect(MigrationRecord)));
+      expect(record).toMatchObject({ state: "done", result: { kind: "moved", backup } });
+      const events = (yield* desktopEvents(data)).map((event) => event.message);
+      expect(events).not.toContain("Showing the moved data notice");
+      // Moving finished before the desktop first started a server.
+      expect(events.indexOf("Moved the desktop's data")).toBeLessThan(
+        events.indexOf("Starting the background Executor"),
+      );
+
+      // It moves once: an old directory that reappears later is left alone.
+      yield* fs.makeDirectory(legacy);
+      const stray = JSON.stringify({ version: 1, id: randomUUID(), state: "file" });
+      yield* fs.writeFileString(path.join(legacy, "installation.json"), stray);
+      const electron = yield* launchDesktop({ cwd: home, env });
+      const page = yield* driver("desktop window", () => electron.firstWindow());
+      yield* dashboard(page);
+      expect(yield* eventsNamed(data, "Executor desktop ready", 2)).toHaveLength(2);
+      expect(
+        (yield* desktopEvents(data)).filter(
+          (event) => event.message === "Moved the desktop's data",
+        ),
+      ).toHaveLength(1);
+      expect(yield* fs.readFileString(path.join(legacy, "installation.json"))).toBe(stray);
+      expect(yield* fs.readFileString(path.join(data, "installation.json"))).toBe(installation);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+/**
+ * A desktop home where the old desktop directory holds the desktop's data, with its saved port, and
+ * the shared directory holds the CLI's own data, whose background server is running: a machine
+ * that used both before the desktop shared the CLI's data.
+ */
+const replacedHome = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const home = yield* desktopHome({ keys: "file", port: false, legacy: true });
+  const desktopData = yield* seedData(home.cli, home.legacy, yield* freePort);
+  expect(
+    (yield* home.cli.run(["service", "stop"], { EXECUTOR_DATA_DIR: home.legacy }, { source: true }))
+      .code,
+  ).toBe(0);
+  const desktopPort = yield* freePort;
+  yield* legacySettings(home.legacy, desktopPort);
+  const desktopInstallation = yield* fs.readFileString(path.join(home.legacy, "installation.json"));
+  const cliData = yield* seedData(home.cli, home.data, yield* freePort);
+  const cliInstallation = yield* fs.readFileString(path.join(home.data, "installation.json"));
+  expect(cliInstallation).not.toBe(desktopInstallation);
+  expect(cliData.apps).not.toEqual(desktopData.apps);
+  return { ...home, desktopData, desktopPort, desktopInstallation, cliData, cliInstallation };
+});
+type ReplacedHome = Effect.Success<typeof replacedHome>;
+
+/**
+ * In a launch after the desktop's data replaced the CLI's: the server runs on the moved data, on the
+ * old desktop's port; the CLI's server was stopped and its data moved aside, whole; the desktop's
+ * data won. Returns where the CLI's data went.
+ */
+const replacedData = (home: ReplacedHome, page: Page) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    expect(new URL(page.url()).origin).toBe(`http://127.0.0.1:${home.desktopPort}`);
+    yield* home.nextServer([home.desktopData.server.pid, home.cliData.server.pid]);
+    expect(yield* processAlive(home.cliData.server.pid)).toBe(false);
+    const [replaced] = yield* eventsNamed(home.data, "Moved the desktop's data", 1);
+    expect(replaced?.annotations.kind).toBe("replaced");
+    const archived = replaced?.annotations.archived ?? "";
+    expect(path.dirname(archived)).toBe(path.join(home.home, "backups"));
+    expect(path.basename(archived)).toMatch(/^cli-data-\d{8}T\d{6}Z-[0-9a-f]{6}$/);
+    expect(yield* fs.readFileString(path.join(archived, "installation.json"))).toBe(
+      home.cliInstallation,
+    );
+    expect(yield* fs.readFileString(path.join(home.data, "installation.json"))).toBe(
+      home.desktopInstallation,
+    );
+    const listed = yield* home.cli.run(["apps", "list"]);
+    expect(listed.code, listed.stderr).toBe(0);
+    expect(yield* Schema.decodeUnknownEffect(Apps)(listed.stdout)).toEqual(home.desktopData.apps);
+    return archived;
+  });
+
+const movedNotice = "Executor now shares its data with the CLI";
+
+/** `electron`'s launch showed the notice that names where the CLI's data went. */
+const noticeNamed = (electron: ElectronApplication, data: string, archived: string) =>
+  Effect.gen(function* () {
+    const [notice] = yield* dialogsShown(electron, 1);
+    expect(notice?.title).toBe(movedNotice);
+    expect(notice?.detail).toContain(archived);
+    const [shown] = yield* eventsNamed(data, "Showing the moved data notice", 1);
+    expect(shown?.annotations.archived).toBe(archived);
+  });
+
+/** Once the notice has been answered, a later launch does not show it again. */
+const noticeShownOnce = (home: ReplacedHome) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const logged = (message: string) =>
+        Effect.map(
+          desktopEvents(home.data),
+          (events) => events.filter((event) => event.message === message).length,
+        );
+      const shown = yield* logged("Showing the moved data notice");
+      const ready = yield* logged("Executor desktop ready");
+      const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+      yield* answerDialogs(electron, {});
+      const page = yield* driver("desktop window", () => electron.firstWindow());
+      yield* dashboard(page);
+      yield* eventsNamed(home.data, "Executor desktop ready", ready + 1);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect(yield* answeredDialogs(electron)).toEqual([]);
+      expect(yield* logged("Showing the moved data notice")).toBe(shown);
+    }),
+  );
+
+it.live(scenarios.desktopMigrationReplaced.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const home = yield* replacedHome;
+
+      // The launch that moves the data starts the server on it and names where the CLI's data went.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+          // The notice shows once the window has settled; record it instead of waiting for a person.
+          yield* answerDialogs(electron, {});
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* dashboard(page);
+          expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+          const archived = yield* replacedData(home, page);
+          yield* noticeNamed(electron, home.data, archived);
+          // In that one launch the data moved before a server started, and the notice came once
+          // the window showed the dashboard.
+          const events = (yield* desktopEvents(home.data)).map((event) => event.message);
+          expect(events.filter((message) => message === "Starting Executor desktop")).toHaveLength(
+            1,
+          );
+          expect(events.indexOf("Moved the desktop's data")).toBeLessThan(
+            events.indexOf("Starting the background Executor"),
+          );
+          expect(events.indexOf("Executor desktop ready")).toBeLessThan(
+            events.indexOf("Showing the moved data notice"),
+          );
+          yield* screenshot(page, "migration-replaced");
+        }),
+      );
+
+      yield* noticeShownOnce(home);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+it.live(scenarios.desktopMigrationReplacedClosed.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const home = yield* replacedHome;
+      const recordPath = path.join(home.home, "migration.json");
+      /** Whether the migration record says the move is done; it only ever moves forward. */
+      const moveDone = Effect.gen(function* () {
+        if (!(yield* fs.exists(recordPath))) return false;
+        const record = yield* fs
+          .readFileString(recordPath)
+          .pipe(Effect.flatMap(Schema.decodeUnknownEffect(MigrationRecord)));
+        return record.state === "done";
+      });
+
+      // Closing the window while the data moves ends the app once the move is done. The move first
+      // stops the CLI's server, which is suspended: it waits seconds for it to answer and then to
+      // exit before it ends it, so the window closes long before the data has moved. Whether it
+      // did is read from the migration record before the server is resumed, and required, since
+      // the checks below hold only for a window closed during the move.
+      const closed = yield* Effect.scoped(
+        Effect.gen(function* () {
+          const held = yield* suspendProcess(home.cliData.server.pid);
+          const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+          // Resumed before the desktop is closed, which waits for the move.
+          yield* Effect.addFinalizer(() => held.resume);
+          // A notice this launch shows stays unanswered, so it is still due on the next launch.
+          yield* answerDialogs(electron, { [movedNotice]: "unanswered" });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* driver("the window says the data is moving", () =>
+            page
+              .getByRole("heading", { name: "Moving your Executor data…", exact: true })
+              .waitFor({ state: "visible", timeout: 60_000 }),
+          );
+          const menu = yield* menuBar(electron);
+          const quit = yield* driver("the desktop quits once the data has moved", () =>
+            electron.waitForEvent("close", { timeout: 120_000 }),
+          ).pipe(Effect.forkScoped({ startImmediately: true }));
+          yield* driver("close the window while the data moves", () =>
+            electron.evaluate(({ BrowserWindow }) => {
+              for (const window of BrowserWindow.getAllWindows()) window.close();
+            }),
+          );
+          // Electron quits as the last window closes, in the same step, so once no window is left
+          // the desktop has been asked to quit. It answers, so it still runs.
+          const windowless = driver("no desktop window is left", () =>
+            electron.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length),
+          ).pipe(
+            Effect.filterOrFail(
+              (windows) => windows === 0,
+              () => new Error("A desktop window is still open"),
+            ),
+            Effect.retry({ schedule: Schedule.spaced("50 millis"), times: 600 }),
+            Effect.as(true),
+          );
+          const running = yield* Effect.race(windowless, Effect.as(Fiber.join(quit), false));
+          const moved = yield* moveDone;
+          yield* held.resume;
+          yield* Fiber.join(quit);
+          return { running, moved, menu };
+        }),
+      );
+      expect(closed.running, "the desktop quit before its last window had closed").toBe(true);
+      expect(closed.moved, "the data had moved before the window closed").toBe(false);
+      const interrupted = (yield* desktopEvents(home.data)).map((event) => event.message);
+      expect(interrupted).toContain("Moved the desktop's data");
+      // The desktop quit once the move was done, before it started or joined a server, and so
+      // before the notice. Meanwhile its menu was its own, with none of its actions, which need
+      // the data: File, by its label, with only Quit (Close on macOS), and the standard Edit, View
+      // and Window menus. Electron's default menu has the same items, but builds File from its
+      // role.
+      expect(interrupted).not.toContain("Connecting to the background Executor");
+      expect(interrupted).not.toContain("Showing the moved data notice");
+      const darwin = process.platform === "darwin";
+      expect(closed.menu.map(({ menu }) => menu)).toEqual([
+        ...(darwin ? ["appmenu"] : []),
+        "File",
+        "editmenu",
+        "viewmenu",
+        "windowmenu",
+      ]);
+      expect(closed.menu.find(({ menu }) => menu === "File")?.items).toEqual([
+        darwin ? "close" : "quit",
+      ]);
+
+      // The next launch starts the server on the moved data and names where the CLI's data went.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+          yield* answerDialogs(electron, {});
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* dashboard(page);
+          expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+          const archived = yield* replacedData(home, page);
+          yield* noticeNamed(electron, home.data, archived);
+        }),
+      );
+
+      yield* noticeShownOnce(home);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+it.live(scenarios.desktopMigrationSettings.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const home = yield* desktopHome({ keys: "file", port: false, legacy: true });
+      const backups = path.join(home.home, "backups");
+      const recordPath = path.join(home.home, "migration.json");
+      const desktopData = yield* seedData(home.cli, home.legacy, yield* freePort);
+      const stopped = yield* home.cli.run(
+        ["service", "stop"],
+        { EXECUTOR_DATA_DIR: home.legacy },
+        { source: true },
+      );
+      expect(stopped.code, stopped.stderr).toBe(0);
+      const desktopPort = yield* freePort;
+      yield* legacySettings(home.legacy, desktopPort);
+      const setAll = (settings: ReadonlyArray<ReadonlyArray<string>>) =>
+        Effect.forEach(
+          settings,
+          (args) =>
+            home.cli
+              .run(args, {}, { source: true })
+              .pipe(Effect.tap((set) => Effect.sync(() => expect(set.code, set.stderr).toBe(0)))),
+          { discard: true },
+        );
+
+      // The CLI's directory holds only its settings, as `executor service set` leaves them before
+      // any server has run: its own port, a variable for its servers, how its keys are kept, and
+      // the service turned off.
+      yield* setAll([
+        ["service", "set", "port", String(yield* freePort)],
+        ["service", "set", "env", "EXECUTOR_E2E_CARRIED", "kept"],
+        ["service", "set", "env", "EXECUTOR_KEY_STORAGE", "file"],
+        ["service", "set", "disabled", "true"],
+      ]);
+      const firstSettings = yield* fs.readFileString(path.join(home.data, "service.json"));
+      expect(yield* fs.readDirectory(home.data)).toEqual(["service.json"]);
+
+      // The first launch copies the data but cannot move the old directory aside, so it keeps the
+      // verified copy for the next launch and changes nothing else. POSIX refuses a rename into a
+      // read-only folder; Windows ignores that, but refuses to rename a folder with a file open.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          if (process.platform === "win32")
+            yield* fs.open(path.join(home.legacy, "desktop.json"), { flag: "r" });
+          else yield* fs.makeDirectory(backups, { mode: 0o500 });
+          const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* recoveryHeading(page, "Executor could not move its data");
+          expect(
+            yield* driver("the migration's message", () => page.locator("pre").textContent()),
+          ).toContain("Executor continues moving your data the next time it starts.");
+        }),
+      );
+      if (process.platform !== "win32") {
+        expect(yield* fs.readDirectory(backups)).toEqual([]);
+        yield* fs.chmod(backups, 0o700);
+      }
+      const kept = yield* fs
+        .readFileString(recordPath)
+        .pipe(Effect.flatMap(Schema.decodeUnknownEffect(MigrationRecord)));
+      expect(kept.state).toBe("copied");
+      expect(yield* fs.readDirectory(home.data)).toEqual(["service.json"]);
+      expect(yield* fs.readFileString(path.join(home.data, "service.json"))).toBe(firstSettings);
+      expect(yield* fs.exists(home.legacy)).toBe(true);
+
+      // Meanwhile the CLI's settings change. The next launch moves the copy with them as they are
+      // then.
+      const cliPort = yield* freePort;
+      yield* setAll([
+        ["service", "set", "port", String(cliPort)],
+        ["service", "set", "env", "EXECUTOR_E2E_LATER", "later"],
+      ]);
+      const cliSettings = yield* fs.readFileString(path.join(home.data, "service.json"));
+
+      // The launch that moves the data names where the CLI's settings went and what changed.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const electron = yield* launchDesktop({ cwd: home.home, env: home.env });
+          yield* answerDialogs(electron, {});
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* dashboard(page);
+          expect(new URL(page.url()).origin).toBe(`http://127.0.0.1:${desktopPort}`);
+          const server = yield* home.nextServer([desktopData.server.pid]);
+          expect(server.url).toBe(`http://127.0.0.1:${desktopPort}`);
+          expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+          const [moved] = yield* eventsNamed(home.data, "Moved the desktop's data", 1);
+          expect(moved?.annotations.kind).toBe("moved");
+          expect(moved?.annotations.settings).toEqual({
+            port: { from: cliPort, to: desktopPort },
+            variables: ["EXECUTOR_KEY_STORAGE"],
+            removed: ["disabled"],
+          });
+          const archived = moved?.annotations.archived ?? "";
+          expect(path.dirname(archived)).toBe(backups);
+          expect(path.basename(archived)).toMatch(/^cli-data-\d{8}T\d{6}Z-[0-9a-f]{6}$/);
+          // The CLI's settings are kept there as they were.
+          expect(yield* fs.readFileString(path.join(archived, "service.json"))).toBe(cliSettings);
+          yield* noticeNamed(electron, home.data, archived);
+          const [notice] = yield* dialogsShown(electron, 1);
+          expect(notice?.detail).toContain(
+            `The background Executor now uses port ${desktopPort}, as the desktop did, instead of the CLI's port ${cliPort}.`,
+          );
+          expect(notice?.detail).toContain(
+            "These CLI env settings belonged to its previous data, so they stayed with it: EXECUTOR_KEY_STORAGE.",
+          );
+          expect(notice?.detail).toContain(
+            "The CLI's disabled setting was removed: the desktop runs the background Executor, so `executor` and `executor apps` use it too.",
+          );
+          expect(notice?.detail).not.toContain("EXECUTOR_E2E_CARRIED");
+          expect(notice?.detail).not.toContain("EXECUTOR_E2E_LATER");
+        }),
+      );
+
+      // The shared directory has the CLI's other settings as they were when the copy moved in,
+      // with the desktop's port and the service on, and is private.
+      expect(JSON.parse(yield* fs.readFileString(path.join(home.data, "service.json")))).toEqual({
+        env: { EXECUTOR_E2E_CARRIED: "kept", EXECUTOR_E2E_LATER: "later" },
+        port: desktopPort,
+      });
+      for (const [args, value] of [
+        [["service", "get", "disabled"], "false"],
+        [["service", "get", "env", "EXECUTOR_E2E_CARRIED"], "kept"],
+        [["service", "get", "env", "EXECUTOR_E2E_LATER"], "later"],
+        [["service", "get", "env", "EXECUTOR_KEY_STORAGE"], ""],
+        [["service", "get", "port"], String(desktopPort)],
+      ] as const) {
+        const read = yield* home.cli.run(args, {}, { source: true });
+        expect(read.code, read.stderr).toBe(0);
+        expect(read.stdout.trim()).toBe(value);
+      }
+      if (process.platform !== "win32")
+        expect((yield* fs.stat(home.data)).mode & 0o777).toBe(0o700);
+
+      // App commands use the background server the desktop left running, as they did not while
+      // the service was off.
+      const listed = yield* home.cli.run(["apps", "list"], {}, { source: true });
+      expect(listed.code, listed.stderr).toBe(0);
+      expect(listed.stderr).not.toContain(startingInCli);
+      expect(yield* Schema.decodeUnknownEffect(Apps)(listed.stdout)).toEqual(desktopData.apps);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
+it.live(scenarios.desktopSlowStop.title, () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { data, home, env, cli, nextServer } = yield* desktopHome();
+      const electron = yield* launchDesktop({ cwd: home, env });
+      const page = yield* driver("desktop window", () => electron.firstWindow());
+      yield* dashboard(page);
+      const server = yield* nextServer([]);
+      const starts = yield* serverStarts(data);
+
+      // The server is asked to stop and takes seconds to exit, keeping its registration until
+      // then and answering meanwhile that it is stopping. A real server's own shutdown takes a
+      // fraction of a second, so it is ended and a stand-in answers in its place, as it would.
+      yield* crashServer(server.pid);
+      yield* connectionRefused(Number(new URL(server.url).port)).pipe(
+        Effect.filterOrFail(
+          (refused) => refused,
+          () => new Error("The ended server's port still accepts connections"),
+        ),
+        Effect.retry({ schedule: Schedule.spaced("20 millis"), times: 500 }),
+      );
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const stopping = yield* stoppingServer(server);
+          // The desktop says the server was stopped, while it is still stopping.
+          yield* recoveryHeading(page, "The background Executor was stopped");
+          expect(
+            yield* driver("stopped page actions", () => page.getByRole("button").allTextContents()),
+          ).toEqual(["Start", "Quit"]);
+          const [lost] = yield* eventsNamed(data, lostServer, 1);
+          expect(lost?.annotations).toMatchObject({ pid: server.pid, loss: "stopped" });
+          // It waits on that page through more of the server's answers than the three missed
+          // checks after which a server that stopped answering counts as lost, starting none.
+          const seen = yield* stopping.answered;
+          yield* stopping.answered.pipe(
+            Effect.filterOrFail(
+              (answered) => answered >= seen + 5,
+              () => new Error("The desktop has stopped asking the stopping server"),
+            ),
+            Effect.retry({ schedule: Schedule.spaced("200 millis"), times: 100 }),
+          );
+          expect(yield* serverStarts(data)).toBe(starts);
+          yield* recoveryHeading(page, "The background Executor was stopped");
+          // The server's last step is removing its registration.
+          yield* fs.remove(path.join(data, "server.json"));
+        }),
+      );
+
+      // The stop was not counted as a crash: the server the CLI starts next is joined, and the
+      // desktop has started none of its own.
+      const begun = yield* cli.run(["service", "start"]);
+      expect(begun.code, begun.stderr).toBe(0);
+      expect(begun.stderr).toContain(startingInCli);
+      const fromCli = yield* nextServer([server.pid]);
+      yield* dashboard(page);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      expect((yield* eventsNamed(data, "Background Executor ready", 2))[1]?.annotations.pid).toBe(
+        fromCli.pid,
+      );
+      expect(yield* serverStarts(data)).toBe(starts);
+      expect(
+        (yield* desktopEvents(data))
+          .filter((event) => event.message === lostServer)
+          .map((event) => event.annotations.loss),
+      ).toEqual(["stopped"]);
+    }),
+  ).pipe(Effect.provide(services)),
+);
+
 it.live(scenarios.desktopClipboard.title, () =>
   Effect.scoped(
     Effect.gen(function* () {
@@ -248,7 +1144,12 @@ it.live(scenarios.desktopClipboard.title, () =>
       const electron = yield* launchDesktop({ cwd: home, env });
       const page = yield* driver("desktop window", () => electron.firstWindow());
       yield* dashboard(page);
-      yield* driver("open the custom app page", () => page.goto(`${origin}/apps/add/custom`));
+      yield* driver("open the From scratch dialog", () =>
+        page
+          .goto(`${origin}/apps`)
+          .then(() => page.getByRole("button", { name: "Add app", exact: true }).click())
+          .then(() => page.getByRole("menuitem", { name: /^From scratch/ }).click()),
+      );
       const copy = page.getByRole("button", { name: "Copy setup prompt" });
       yield* driver("copy the setup prompt", () => copy.click());
       yield* driver("the copy succeeds", () =>
@@ -257,7 +1158,7 @@ it.live(scenarios.desktopClipboard.title, () =>
       const copied = yield* driver("read the system clipboard", () =>
         electron.evaluate(({ clipboard }) => clipboard.readText()),
       );
-      expect(copied).toContain("Help me add a service to Executor as an app.");
+      expect(copied).toContain("Help me build a new Executor app.");
     }),
   ).pipe(Effect.provide(services)),
 );
@@ -267,7 +1168,7 @@ it.live(scenarios.desktopReset.title, () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const { home, data, env } = yield* desktopHome("file");
+      const { home, data, env, nextServer } = yield* desktopHome({ keys: "file" });
       const backups = path.join(home, "backups");
       // Data whose key file is gone: key setup refuses, and starting over can help.
       const original = randomUUID();
@@ -284,9 +1185,14 @@ it.live(scenarios.desktopReset.title, () =>
       expect(
         yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
       ).toEqual(["Restart", "Show logs", "Reset data…", "Quit"]);
-      // A configuration failure is not retried: one backend only.
-      const started = yield* backendPids(data);
-      expect(started).toHaveLength(1);
+      // The server said why it refused, and a configuration failure is not retried.
+      const [refused] = yield* eventsNamed(data, "Background Executor could not start", 1);
+      expect(refused?.annotations).toMatchObject({
+        stage: "configuration",
+        configuration: "credential-missing",
+      });
+      expect(yield* serverStarts(data)).toBe(1);
+      expect(Option.isNone(yield* registeredServer(data))).toBe(true);
 
       expect(yield* menuLabels(electron, "Help")).toEqual([
         "Show diagnostics folder",
@@ -305,7 +1211,7 @@ it.live(scenarios.desktopReset.title, () =>
         "synthetic retained data",
       );
 
-      // A move that fails leaves the data and its lock state in place and restarts the server.
+      // A move that fails leaves the data and its lock state in place and starts the server again.
       // POSIX refuses a rename into a read-only directory; Windows ignores that, so there the
       // backups folder cannot be created at all.
       if (process.platform === "win32") yield* fs.writeFileString(backups, "");
@@ -319,7 +1225,13 @@ it.live(scenarios.desktopReset.title, () =>
       expect(failure[1]?.message).toBe(
         "Executor could not reset its data. Your data was left in place.",
       );
-      yield* nextBackendPid(data, started);
+      yield* serverStarts(data).pipe(
+        Effect.filterOrFail(
+          (starts) => starts >= 2,
+          () => new Error("The desktop has not started the server again"),
+        ),
+        Effect.retry({ schedule: Schedule.spaced("100 millis"), times: 300 }),
+      );
       yield* recoveryHeading(page, "Executor's saved key is missing");
       expect(yield* fs.readFileString(path.join(data, "retained.txt"))).toBe(
         "synthetic retained data",
@@ -330,6 +1242,7 @@ it.live(scenarios.desktopReset.title, () =>
           .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Installation)))),
       ).toEqual({ version: 1, id: original, state: "file" });
       expect(yield* fs.exists(path.join(data, ".bootstrap.lock"))).toBe(false);
+      expect(yield* fs.exists(path.join(data, ".server.lock"))).toBe(false);
       if (process.platform === "win32") {
         yield* fs.remove(backups);
       } else {
@@ -344,6 +1257,7 @@ it.live(scenarios.desktopReset.title, () =>
       );
       const dialogs = yield* dialogsShown(electron, 2);
       yield* dashboard(page);
+      const fresh = yield* nextServer([]);
       expect(dialogs.map((box) => box.title)).toEqual([
         "Reset Executor data?",
         "Executor data reset",
@@ -358,6 +1272,7 @@ it.live(scenarios.desktopReset.title, () =>
         "synthetic retained data",
       );
       expect(yield* fs.exists(path.join(backup, ".bootstrap.lock"))).toBe(false);
+      expect(yield* fs.exists(path.join(backup, ".server.lock"))).toBe(false);
       const manifestText = yield* fs.readFileString(path.join(backup, "executor-backup.json"));
       const manifest = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))(
         manifestText,
@@ -370,11 +1285,11 @@ it.live(scenarios.desktopReset.title, () =>
         .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Installation))));
       expect(backedUp).toEqual({ version: 1, id: original, state: "file" });
 
-      const fresh = yield* fs
+      const created = yield* fs
         .readFileString(path.join(data, "installation.json"))
         .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(Installation))));
-      expect(fresh.id).not.toBe(original);
-      expect(fresh.state).toBe("file");
+      expect(created.id).not.toBe(original);
+      expect(created.state).toBe("file");
       const readKeys = (directory: string) =>
         fs
           .readFileString(path.join(directory, "keys.json"))
@@ -382,7 +1297,7 @@ it.live(scenarios.desktopReset.title, () =>
       const freshKeys = yield* readKeys(data);
       expect(yield* fs.exists(path.join(data, "retained.txt"))).toBe(false);
 
-      // Resetting a running server stops it on purpose: that stop is never reported as an exit.
+      // Resetting while the server runs stops it on purpose: the desktop never reports it lost.
       yield* answerDialogs(electron, { "Reset Executor data?": 0 });
       yield* clickMenuItem(electron, "Help", "Reset Executor data…");
       const again = yield* dialogsShown(electron, 2);
@@ -391,6 +1306,8 @@ it.live(scenarios.desktopReset.title, () =>
         "Executor data reset",
       ]);
       yield* dashboard(page);
+      const third = yield* nextServer([fresh.pid]);
+      expect(yield* processAlive(fresh.pid)).toBe(false);
       const second = (yield* fs.readDirectory(backups)).find((name) => name !== moved[0]);
       expect(second).toBeDefined();
       expect(again[1]?.detail).toContain(path.join(backups, second!));
@@ -403,16 +1320,14 @@ it.live(scenarios.desktopReset.title, () =>
       expect(
         (yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest))(secondManifest))
           .installation.id,
-      ).toBe(fresh.id);
+      ).toBe(created.id);
       expect(secondManifest).not.toContain(freshKeys.apiKey);
       expect(secondManifest).not.toContain(freshKeys.encryptionKey);
       const stoppedRun = yield* desktopEvents(secondBackup);
-      expect(stoppedRun.map((event) => event.message)).toContain("Desktop backend started");
+      expect(stoppedRun.map((event) => event.message)).toContain("Background Executor ready");
       expect(
         [...stoppedRun, ...(yield* desktopEvents(data))].filter(
-          (event) =>
-            event.message === "Desktop backend exited" ||
-            event.message === "Showing desktop recovery",
+          (event) => event.message === lostServer || event.message === "Showing desktop recovery",
         ),
       ).toEqual([]);
       // Lines logged before a move go with it: the first backup holds both reset attempts.
@@ -421,6 +1336,33 @@ it.live(scenarios.desktopReset.title, () =>
           (event) => event.message === "Resetting Executor data",
         ),
       ).toHaveLength(2);
+
+      // A server killed outright leaves its lock and registration behind. Reset, chosen before
+      // the desktop replaces it, takes that lock over as the next server would, and moves the
+      // data aside.
+      const startsBeforeCrash = yield* serverStarts(data);
+      yield* crashServer(third.pid);
+      yield* answerDialogs(electron, { "Reset Executor data?": 0 });
+      yield* clickMenuItem(electron, "Help", "Reset Executor data…");
+      const afterCrash = yield* dialogsShown(electron, 2);
+      expect(afterCrash.map((box) => box.title)).toEqual([
+        "Reset Executor data?",
+        "Executor data reset",
+      ]);
+      yield* dashboard(page);
+      yield* nextServer([fresh.pid, third.pid]);
+      expect(yield* pairedSession(page)).toEqual({ authenticated: true });
+      const crashedBackup = (yield* fs.readDirectory(backups)).find(
+        (name) => name !== moved[0] && name !== second,
+      );
+      expect(crashedBackup).toBeDefined();
+      expect(afterCrash[1]?.detail).toContain(path.join(backups, crashedBackup!));
+      const crashedData = path.join(backups, crashedBackup!);
+      expect(yield* fs.exists(path.join(crashedData, ".server.lock"))).toBe(false);
+      expect(yield* fs.exists(path.join(crashedData, "server.json"))).toBe(false);
+      expect(yield* fs.exists(path.join(crashedData, "installation.json"))).toBe(true);
+      // The desktop had started no replacement for the killed server before the reset ran.
+      expect(yield* serverStarts(crashedData)).toBe(startsBeforeCrash);
     }),
   ).pipe(Effect.provide(services)),
 );
@@ -431,26 +1373,102 @@ it.live(scenarios.desktopResetWithheld.title, () =>
     const path = yield* Path.Path;
     const noReset = ["Restart", "Show logs", "Quit"];
 
-    // Another process holds the bootstrap lock. Its future timestamp keeps it from going stale.
+    /** The server refused with `reason`, said so on its structured channel, and was not retried. */
+    const refusedOnce = (data: string, reason: string) =>
+      Effect.gen(function* () {
+        const [refused] = yield* eventsNamed(data, "Background Executor could not start", 1);
+        expect(refused?.annotations).toMatchObject({
+          stage: "configuration",
+          configuration: reason,
+        });
+        expect(yield* serverStarts(data)).toBe(1);
+        expect(Option.isNone(yield* registeredServer(data))).toBe(true);
+      });
+
+    // Another process holds the server lock, or the key setup lock, without being a running
+    // server. Its future timestamp keeps it from going stale.
+    for (const held of [".server.lock", ".bootstrap.lock"])
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const { home, data, env } = yield* desktopHome();
+          const lock = path.join(data, held);
+          yield* fs.makeDirectory(lock, { recursive: true });
+          const later = new Date(Date.now() + 60 * 60 * 1000);
+          yield* fs.utimes(lock, later, later);
+          const electron = yield* launchDesktop({ cwd: home, env });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* recoveryHeading(page, "Executor's data is in use");
+          expect(
+            yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
+          ).toEqual(noReset);
+          yield* refusedOnce(data, "locked");
+          expect(yield* fs.exists(lock)).toBe(true);
+        }),
+      );
+
+    // An Executor from before the background service runs on the data: it holds no lock, so only
+    // its server.json shows it, and the desktop cannot stop it. This test's own process stands in
+    // for it, with a listener that answers as that Executor did.
     yield* Effect.scoped(
       Effect.gen(function* () {
-        const { home, data, env } = yield* desktopHome();
-        const held = path.join(data, ".bootstrap.lock");
-        yield* fs.makeDirectory(held, { recursive: true });
-        const later = new Date(Date.now() + 60 * 60 * 1000);
-        yield* fs.utimes(held, later, later);
+        const { home, data, env } = yield* desktopHome({ keys: "file" });
+        const backups = path.join(home, "backups");
+        const session = HttpRouter.add(
+          "GET",
+          "/auth/session",
+          HttpServerResponse.json({ authenticated: false }),
+        );
+        const listening = yield* Layer.build(
+          HttpRouter.serve(session, { disableLogger: true, disableListenLog: true }).pipe(
+            Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
+          ),
+        );
+        const listener = yield* HttpServer.HttpServer.pipe(Effect.provideContext(listening));
+        if (!("port" in listener.address)) return yield* Effect.die("The listener must use TCP");
+        const earlier = `http://127.0.0.1:${listener.address.port}`;
+        const record = JSON.stringify({
+          pid: process.pid,
+          version: "2.0.0-beta.15",
+          url: earlier,
+          command: "executor serve",
+        });
+        yield* fs.makeDirectory(data, { recursive: true });
+        yield* fs.writeFileString(path.join(data, "server.json"), record);
         const electron = yield* launchDesktop({ cwd: home, env });
         const page = yield* driver("desktop window", () => electron.firstWindow());
         yield* recoveryHeading(page, "Executor's data is in use");
         expect(
           yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
         ).toEqual(noReset);
+        expect(yield* driver("the refusal", () => page.locator("pre").textContent())).toContain(
+          `An Executor from before the background service (process ${process.pid})`,
+        );
+        const [refused] = yield* eventsNamed(data, "Background Executor could not start", 1);
+        expect(refused?.annotations).toMatchObject({
+          stage: "configuration",
+          configuration: "locked",
+        });
+        expect(yield* serverStarts(data)).toBe(0);
+
+        // Reset from the menu refuses too, and leaves the data in place.
+        yield* answerDialogs(electron, { "Reset Executor data?": 0 });
+        yield* clickMenuItem(electron, "Help", "Reset Executor data…");
+        const failure = yield* dialogsShown(electron, 2);
+        expect(failure.map((box) => box.title)).toEqual(["Reset Executor data?", "Reset failed"]);
+        expect(failure[1]?.detail).toBe(
+          "Another Executor process is using the data directory. Quit it and try again.",
+        );
+        expect(yield* fs.exists(backups)).toBe(false);
+        expect(yield* fs.readFileString(path.join(data, "server.json"))).toBe(record);
+        yield* recoveryHeading(page, "Executor's data is in use");
+        expect(yield* serverStarts(data)).toBe(0);
       }),
     );
 
     /** Start on a directory whose record says `state`, and expect `heading` without reset. */
     const withheld = (options: {
       readonly heading: string;
+      readonly reason: string;
       readonly keys: "supplied" | "file" | "unreachable-store";
       readonly state: "ready" | "file";
       readonly env?: Readonly<Record<string, string>>;
@@ -458,7 +1476,7 @@ it.live(scenarios.desktopResetWithheld.title, () =>
     }) =>
       Effect.scoped(
         Effect.gen(function* () {
-          const { home, data, env } = yield* desktopHome(options.keys);
+          const { home, data, env } = yield* desktopHome({ keys: options.keys });
           yield* fs.makeDirectory(data, { recursive: true });
           const record = JSON.stringify({ version: 1, id: randomUUID(), state: options.state });
           yield* fs.writeFileString(path.join(data, "installation.json"), record);
@@ -470,7 +1488,7 @@ it.live(scenarios.desktopResetWithheld.title, () =>
             yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
           ).toEqual(noReset);
           // A configuration failure is not retried, and nothing was changed or written.
-          expect(yield* backendPids(data)).toHaveLength(1);
+          yield* refusedOnce(data, options.reason);
           expect(yield* fs.readFileString(path.join(data, "installation.json"))).toBe(record);
           expect(yield* fs.exists(path.join(data, "keys.json"))).toBe(false);
         }),
@@ -480,16 +1498,57 @@ it.live(scenarios.desktopResetWithheld.title, () =>
     // supplied keys on a directory that saves its own, and a key storage it does not use.
     yield* withheld({
       heading: "Executor's key settings do not match its data",
+      reason: "misconfigured",
       keys: "supplied",
       state: "ready",
       screenshot: "recovery-misconfigured",
     });
     yield* withheld({
       heading: "Executor's key settings do not match its data",
+      reason: "misconfigured",
       keys: "file",
       state: "ready",
     });
 
+    // An EXECUTOR_KEY_STORAGE the server cannot use is refused before anything is created, set in
+    // the desktop's environment or saved with `executor service set env`, which the servers a
+    // client starts run with. It is fixed by changing the setting, never by a reset.
+    for (const saved of [false, true])
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const { home, data, env, cli } = yield* desktopHome({ keys: "file" });
+          if (saved) {
+            const set = yield* cli.run(
+              ["service", "set", "env", "EXECUTOR_KEY_STORAGE", "keyring"],
+              {},
+              { source: true },
+            );
+            expect(set.code, set.stderr).toBe(0);
+          }
+          const electron = yield* launchDesktop({
+            cwd: home,
+            env: saved ? env : { ...env, EXECUTOR_KEY_STORAGE: "keyring" },
+          });
+          const page = yield* driver("desktop window", () => electron.firstWindow());
+          yield* recoveryHeading(page, "Executor's key settings do not match its data");
+          expect(
+            yield* driver("recovery actions", () => page.getByRole("button").allTextContents()),
+          ).toEqual(noReset);
+          yield* refusedOnce(data, "misconfigured");
+          const [refused] = yield* eventsNamed(data, "Background Executor could not start", 1);
+          expect(refused?.annotations.detail).toContain(
+            'EXECUTOR_KEY_STORAGE must be "file" (keep keys in keys.json) or "os" (OS credential store only), or unset.',
+          );
+          // The data directory holds only the desktop's own log, and the saved setting.
+          expect((yield* fs.readDirectory(data)).toSorted()).toEqual(
+            saved ? ["diagnostics", "service.json"] : ["diagnostics"],
+          );
+          expect(yield* fs.readDirectory(path.join(data, "diagnostics"))).toEqual([
+            "executor-desktop.jsonl",
+          ]);
+        }),
+      );
+
     // The data may be intact behind a store that is absent or refuses access, so it is never
     // offered for reset. The harness makes the store absent on Linux and refusing on macOS.
     if (process.platform === "win32") return;
@@ -497,12 +1556,14 @@ it.live(scenarios.desktopResetWithheld.title, () =>
       process.platform === "darwin"
         ? {
             heading: "Executor needs access to your keychain",
+            reason: "credential-denied",
             keys: "unreachable-store",
             state: "ready",
             screenshot: "recovery-credential-denied",
           }
         : {
             heading: "Executor cannot open the OS credential store",
+            reason: "credential-unavailable",
             keys: "unreachable-store",
             state: "ready",
             screenshot: "recovery-credential-unavailable",
diff --git a/e2e/tests/desktop-release.spec.ts b/e2e/tests/desktop-release.spec.ts
index 3b4ca6be26..75b8f77b1c 100644
--- a/e2e/tests/desktop-release.spec.ts
+++ b/e2e/tests/desktop-release.spec.ts
@@ -1,6 +1,17 @@
 import { expect, it } from "@effect/vitest";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { Config, Effect, FileSystem, Layer, Path, Redacted, Schedule, Schema } from "effect";
+import {
+  Cause,
+  Config,
+  Effect,
+  Exit,
+  FileSystem,
+  Layer,
+  Path,
+  Redacted,
+  Schedule,
+  Schema,
+} from "effect";
 import { FetchHttpClient } from "effect/http";
 import { _electron, chromium } from "playwright";
 import { randomBytes } from "node:crypto";
@@ -8,7 +19,12 @@ import { createServer } from "node:net";
 import { strFromU8, unzipSync } from "fflate";
 import { driver } from "../support/platform.ts";
 import { freePort } from "../support/ports.ts";
-import { requestBrowserPairing } from "../support/desktop.ts";
+import {
+  desktopCli,
+  requestBrowserPairing,
+  runnerSession,
+  stopBackgroundServers,
+} from "../support/desktop.ts";
 import { authorizeBrowserMcp } from "../support/mcp-oauth.ts";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -42,20 +58,9 @@ it.live("packaged desktop starts without the workspace and retains apps after re
         "v2",
         "compile-cache",
       );
+      const data = path.join(directory, "data");
       const env = {
-        ...Object.fromEntries(
-          [
-            "DISPLAY",
-            "XAUTHORITY",
-            "WAYLAND_DISPLAY",
-            "XDG_RUNTIME_DIR",
-            "XDG_SESSION_TYPE",
-            "DBUS_SESSION_BUS_ADDRESS",
-          ].flatMap((name) => {
-            const value = process.env[name];
-            return value === undefined ? [] : [[name, value] as const];
-          }),
-        ),
+        ...runnerSession(),
         PATH: runtimePath,
         HOME: process.platform === "darwin" ? cacheHome : (process.env.HOME ?? ""),
         ...(process.platform === "win32"
@@ -68,28 +73,39 @@ it.live("packaged desktop starts without the workspace and retains apps after re
         EXECUTOR_API_KEY: apiKey,
         EXECUTOR_ENCRYPTION_KEY: encryptionKey,
         EXECUTOR_PORT: String(port),
-        EXECUTOR_DESKTOP_DATA_DIR: path.join(directory, "data"),
+        EXECUTOR_DESKTOP_DATA_DIR: data,
         EXECUTOR_DESKTOP_PROFILE_DIR: path.join(directory, "profile"),
         EXECUTOR_NPM_REGISTRY: registry.url,
       };
+      // The background server outlives the desktop; the scope stops it before removing its data.
+      yield* Effect.addFinalizer(() => stopBackgroundServers(data, () => []));
+      // The CLI the desktop staged out of the app, on the desktop's data.
+      const cli = yield* desktopCli({ env: { ...env, EXECUTOR_DATA_DIR: data }, cwd: directory });
       let appId = "";
       let appSlug = "";
       let appUiUrl: string | undefined;
       let oauthToken: Redacted.Redacted<string> | undefined;
       const diagnostics: string[] = [];
+      /**
+       * The desktop's and its background server's logs, as last read on a failure. Every later
+       * write keeps them, since the data directory that holds them is removed with the scope.
+       */
+      let savedLogs: ReadonlyArray<string> = [];
+      const writeLog = Effect.suspend(() =>
+        fs.writeFileString(
+          ".local/releases/desktop-test.log",
+          [...diagnostics, ...savedLogs].join(""),
+          { mode: 0o600 },
+        ),
+      );
+      // Each checkpoint is saved at once, so a run that hangs still shows how far it got.
       const checkpoint = (stage: string) =>
         Effect.sync(() => {
           diagnostics.push(
             `${JSON.stringify({ checkpoint: stage, at: new Date().toISOString() })}\n`,
           );
-        });
-      yield* Effect.addFinalizer(() =>
-        fs
-          .writeFileString(".local/releases/desktop-test.log", diagnostics.join(""), {
-            mode: 0o600,
-          })
-          .pipe(Effect.orDie),
-      );
+        }).pipe(Effect.andThen(writeLog.pipe(Effect.ignore)));
+      yield* Effect.addFinalizer(() => writeLog.pipe(Effect.orDie));
       const browser = yield* Effect.acquireRelease(
         driver("launch an independent browser", () => chromium.launch()),
         (browser) => driver("close independent browser", () => browser.close()).pipe(Effect.orDie),
@@ -110,6 +126,36 @@ it.live("packaged desktop starts without the workspace and retains apps after re
             const capture = (chunk: Uint8Array) =>
               diagnostics.push(new TextDecoder().decode(chunk));
             electron.process().stderr?.on("data", capture);
+            // A launch that never pairs may hang its cleanup, so its logs are saved first: the
+            // desktop's and its background server's, which the release workflow uploads.
+            const saveLogs = fs.readDirectory(path.join(data, "diagnostics")).pipe(
+              Effect.flatMap((names) =>
+                Effect.forEach(
+                  names.filter((name) => name.endsWith(".jsonl") || name === "collector.json"),
+                  (name) =>
+                    fs
+                      .readFileString(path.join(data, "diagnostics", name))
+                      .pipe(Effect.map((text) => `--- ${name}\n${text.slice(-200_000)}`)),
+                ),
+              ),
+              Effect.catch((error) => Effect.succeed([`--- diagnostics unreadable: ${error}\n`])),
+              Effect.flatMap((logs) =>
+                Effect.sync(() => {
+                  savedLogs = logs;
+                }),
+              ),
+              Effect.andThen(writeLog),
+              Effect.ignore,
+            );
+            // Closing the desktop is the last step, after this one, so a close that hangs still
+            // leaves the failure and the logs behind.
+            yield* Effect.addFinalizer((exit) =>
+              Exit.isFailure(exit)
+                ? Effect.sync(() =>
+                    diagnostics.push(`--- failure\n${Cause.pretty(exit.cause)}\n`),
+                  ).pipe(Effect.andThen(saveLogs))
+                : Effect.void,
+            );
             const page = yield* driver("desktop window", () => electron.firstWindow());
             yield* driver("desktop opens while its server starts", () =>
               page.getByRole("heading", { name: "Starting Executor", exact: true }).waitFor(),
@@ -122,7 +168,7 @@ it.live("packaged desktop starts without the workspace and retains apps after re
               page
                 .getByRole("heading", { name: /^Apps/ })
                 .waitFor({ state: "visible", timeout: 60_000 }),
-            );
+            ).pipe(Effect.tapError(() => saveLogs));
             expect(new URL(page.url()).origin).toBe(origin);
             yield* checkpoint("Desktop dashboard ready");
             // Each page owns a fresh context, so restart still proves pairing from no session.
@@ -384,14 +430,24 @@ createRoot(root).render(<App />);`,
             }).pipe(
               Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
               Effect.timeout("20 seconds"),
+              Effect.tapError(() => saveLogs),
             );
             yield* checkpoint("Tool-call trace delivered");
           }),
         );
         yield* checkpoint("Desktop closed");
         if (first) {
-          // The backend wrote its compiled code to the user's cache directory once the runtime
-          // loaded, even though Windows terminates it without an orderly exit.
+          // Quitting leaves the background server running for the CLI and MCP clients. Stopping
+          // it with the CLI the desktop staged makes the next launch start one on the same data.
+          const status = yield* cli.run(["service", "status"]);
+          expect(status.code, status.stderr).toBe(0);
+          expect(status.stdout).toContain(`${origin} (version `);
+          const stopped = yield* cli.run(["service", "stop"]);
+          expect(stopped.code, stopped.stderr).toBe(0);
+          expect((yield* cli.run(["service", "status"])).stdout.trim()).toBe("stopped");
+          yield* checkpoint("Background server stopped");
+          // The server wrote its compiled code to the user's cache directory once the runtime
+          // loaded, before any orderly exit.
           const entries = (yield* fs.exists(cache))
             ? yield* fs.readDirectory(cache, { recursive: true })
             : [];
@@ -413,161 +469,167 @@ createRoot(root).render(<App />);`,
   ).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer))),
 );
 
-it.live("packaged desktop uses its saved port and exports redacted diagnostics", () =>
-  Effect.scoped(
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const executablePath = yield* Config.String("EXECUTOR_E2E_DESKTOP_EXECUTABLE");
-      const directory = yield* fs.makeTempDirectoryScoped({ prefix: "executor-desktop-settings-" });
-      const apiKey = randomBytes(32).toString("hex");
-      const encryptionKey = randomBytes(32).toString("hex");
-      const runtimePath = yield* Config.String("EXECUTOR_E2E_RUNTIME_PATH").pipe(
-        Config.withDefault(process.env.PATH ?? ""),
-      );
-      const registry = yield* localNpmRegistry;
-      const port = yield* freePort;
-      const origin = `http://127.0.0.1:${port}`;
-      const data = path.join(directory, "data");
-      const downloads = path.join(directory, "downloads");
-      yield* fs.makeDirectory(data, { recursive: true });
-      yield* fs.makeDirectory(downloads);
-      // No EXECUTOR_PORT: the saved desktop setting chooses the listener.
-      yield* fs.writeFileString(
-        path.join(data, "desktop.json"),
-        JSON.stringify({ version: 1, port }),
-      );
-      const env = {
-        ...Object.fromEntries(
-          [
-            "DISPLAY",
-            "XAUTHORITY",
-            "WAYLAND_DISPLAY",
-            "XDG_RUNTIME_DIR",
-            "XDG_SESSION_TYPE",
-            "DBUS_SESSION_BUS_ADDRESS",
-          ].flatMap((name) => {
-            const value = process.env[name];
-            return value === undefined ? [] : [[name, value] as const];
-          }),
-        ),
-        PATH: runtimePath,
-        HOME: process.env.HOME ?? "",
-        // Release scenarios never send product analytics, even from a build with a baked key.
-        DO_NOT_TRACK: "1",
-        EXECUTOR_API_KEY: apiKey,
-        EXECUTOR_ENCRYPTION_KEY: encryptionKey,
-        EXECUTOR_DESKTOP_DATA_DIR: data,
-        EXECUTOR_DESKTOP_PROFILE_DIR: path.join(directory, "profile"),
-        EXECUTOR_NPM_REGISTRY: registry.url,
-      };
-      const electron = yield* Effect.acquireRelease(
-        driver("launch packaged desktop", () =>
-          _electron.launch({ executablePath, cwd: directory, env, args: ["--disable-gpu"] }),
-        ),
-        (electron) => driver("close packaged desktop", () => electron.close()).pipe(Effect.orDie),
-      );
-      const page = yield* driver("desktop window", () => electron.firstWindow());
-      yield* driver("paired dashboard", () =>
-        page.getByRole("heading", { name: /^Apps/ }).waitFor({ state: "visible", timeout: 60_000 }),
-      );
-      expect(new URL(page.url()).origin).toBe(origin);
-
-      const click = (menu: string, label: string) =>
-        driver(`choose ${menu} → ${label}`, () =>
-          electron.evaluate(
-            ({ Menu }, [menu, label]) => {
-              const item = Menu.getApplicationMenu()
-                ?.items.find((entry) => entry.label === menu)
-                ?.submenu?.items.find((entry) => entry.label === label);
-              if (item === undefined) return false;
-              item.click();
-              return true;
-            },
-            [menu, label] as const,
+it.live(
+  "packaged desktop uses the background service's saved port and exports redacted diagnostics",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const executablePath = yield* Config.String("EXECUTOR_E2E_DESKTOP_EXECUTABLE");
+        const directory = yield* fs.makeTempDirectoryScoped({
+          prefix: "executor-desktop-settings-",
+        });
+        const apiKey = randomBytes(32).toString("hex");
+        const encryptionKey = randomBytes(32).toString("hex");
+        const runtimePath = yield* Config.String("EXECUTOR_E2E_RUNTIME_PATH").pipe(
+          Config.withDefault(process.env.PATH ?? ""),
+        );
+        const registry = yield* localNpmRegistry;
+        const port = yield* freePort;
+        const origin = `http://127.0.0.1:${port}`;
+        const data = path.join(directory, "data");
+        const downloads = path.join(directory, "downloads");
+        // The OS per-user cache directory, which holds the backend's compile cache and the
+        // updater's downloads, is this scenario's own, as in the scenario above.
+        const cacheHome = path.join(directory, "cache-home");
+        yield* fs.makeDirectory(data, { recursive: true });
+        yield* fs.makeDirectory(downloads);
+        // No EXECUTOR_PORT: the background service's saved setting chooses the listener.
+        yield* fs.writeFileString(path.join(data, "service.json"), JSON.stringify({ port }));
+        const env = {
+          ...runnerSession(),
+          PATH: runtimePath,
+          HOME: process.platform === "darwin" ? cacheHome : (process.env.HOME ?? ""),
+          ...(process.platform === "win32"
+            ? { LOCALAPPDATA: cacheHome }
+            : process.platform === "darwin"
+              ? {}
+              : { XDG_CACHE_HOME: cacheHome }),
+          // Release scenarios never send product analytics, even from a build with a baked key.
+          DO_NOT_TRACK: "1",
+          EXECUTOR_API_KEY: apiKey,
+          EXECUTOR_ENCRYPTION_KEY: encryptionKey,
+          EXECUTOR_DESKTOP_DATA_DIR: data,
+          EXECUTOR_DESKTOP_PROFILE_DIR: path.join(directory, "profile"),
+          EXECUTOR_NPM_REGISTRY: registry.url,
+        };
+        yield* Effect.addFinalizer(() => stopBackgroundServers(data, () => []));
+        const electron = yield* Effect.acquireRelease(
+          driver("launch packaged desktop", () =>
+            _electron.launch({ executablePath, cwd: directory, env, args: ["--disable-gpu"] }),
           ),
-        ).pipe(Effect.map((found) => expect(found).toBe(true)));
+          (electron) => driver("close packaged desktop", () => electron.close()).pipe(Effect.orDie),
+        );
+        const page = yield* driver("desktop window", () => electron.firstWindow());
+        yield* driver("paired dashboard", () =>
+          page
+            .getByRole("heading", { name: /^Apps/ })
+            .waitFor({ state: "visible", timeout: 60_000 }),
+        );
+        expect(new URL(page.url()).origin).toBe(origin);
 
-      // The port form shows the saved port and refuses one another program holds.
-      const opened = electron.waitForEvent("window");
-      yield* click("File", "Server port…");
-      const form = yield* driver("port form", () => opened);
-      yield* driver("port form heading", () =>
-        form.getByRole("heading", { name: "Local server port" }).waitFor(),
-      );
-      expect(yield* driver("current port", () => form.getByLabel("Port").inputValue())).toBe(
-        String(port),
-      );
-      expect(
-        yield* driver("MCP address note", () => form.getByText(`http://127.0.0.1:${port}`).count()),
-      ).toBe(1);
-      const busyPort = yield* freePort;
-      const busy = yield* Effect.acquireRelease(
-        driver("hold another port", () => {
-          const server = createServer();
-          return new Promise<typeof server>((resolve) =>
-            server.listen(busyPort, "127.0.0.1", () => resolve(server)),
-          );
-        }),
-        (server) => Effect.sync(() => server.close()),
-      );
-      expect(busy.listening).toBe(true);
-      yield* driver("enter a busy port", () => form.getByLabel("Port").fill(String(busyPort)));
-      yield* driver("submit with Enter", () => form.getByLabel("Port").press("Enter"));
-      const alert = yield* driver("busy port refusal", () => form.getByRole("alert").textContent());
-      expect(alert).toBe(`Port ${busyPort} is in use by another program. Choose another port.`);
-      expect(
-        yield* fs
-          .readFileString(path.join(data, "desktop.json"))
-          .pipe(Effect.map((text) => JSON.parse(text))),
-      ).toEqual({ version: 1, port });
-      yield* driver("cancel closes the port form", () =>
-        Promise.all([
-          form.waitForEvent("close"),
-          form.getByRole("button", { name: "Cancel" }).click(),
-        ]),
-      );
+        const click = (menu: string, label: string) =>
+          driver(`choose ${menu} → ${label}`, () =>
+            electron.evaluate(
+              ({ Menu }, [menu, label]) => {
+                const item = Menu.getApplicationMenu()
+                  ?.items.find((entry) => entry.label === menu)
+                  ?.submenu?.items.find((entry) => entry.label === label);
+                if (item === undefined) return false;
+                item.click();
+                return true;
+              },
+              [menu, label] as const,
+            ),
+          ).pipe(Effect.map((found) => expect(found).toBe(true)));
 
-      // Diagnostics export writes one zip with logs and a manifest, and no key or token values.
-      yield* driver("redirect downloads", () =>
-        electron.evaluate(({ app }, downloads) => app.setPath("downloads", downloads), downloads),
-      );
-      yield* click("Help", "Export diagnostics…");
-      const zip = yield* fs.readDirectory(downloads).pipe(
-        Effect.flatMap((names) => {
-          const name = names.find((entry) =>
-            /^executor-diagnostics-\d{8}T\d{6}Z\.zip$/.test(entry),
-          );
-          return name === undefined
-            ? Effect.fail(new Error("No diagnostics zip yet"))
-            : Effect.succeed(name);
-        }),
-        Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 80 }),
-      );
-      const entries = unzipSync(yield* fs.readFile(path.join(downloads, zip)));
-      const names = Object.keys(entries).sort();
-      expect(names).toContain("manifest.json");
-      expect(names).toContain("diagnostics/executor-desktop.jsonl");
-      expect(names).toContain("diagnostics/executor-local.jsonl");
-      expect(
-        names.every((name) => name === "manifest.json" || name.startsWith("diagnostics/")),
-      ).toBe(true);
-      const manifest = yield* Schema.decodeUnknownEffect(
-        Schema.fromJsonString(
-          Schema.Struct({
-            server: Schema.Struct({ origin: Schema.String, portSource: Schema.String }),
-            files: Schema.Array(Schema.String),
+        // The port form shows the saved port and refuses one another program holds.
+        const opened = electron.waitForEvent("window");
+        yield* click("File", "Server port…");
+        const form = yield* driver("port form", () => opened);
+        yield* driver("port form heading", () =>
+          form.getByRole("heading", { name: "Local server port" }).waitFor(),
+        );
+        expect(yield* driver("current port", () => form.getByLabel("Port").inputValue())).toBe(
+          String(port),
+        );
+        expect(
+          yield* driver("MCP address note", () =>
+            form.getByText(`http://127.0.0.1:${port}`).count(),
+          ),
+        ).toBe(1);
+        const busyPort = yield* freePort;
+        const busy = yield* Effect.acquireRelease(
+          driver("hold another port", () => {
+            const server = createServer();
+            return new Promise<typeof server>((resolve) =>
+              server.listen(busyPort, "127.0.0.1", () => resolve(server)),
+            );
           }),
-        ),
-      )(strFromU8(yield* Effect.fromNullishOr(entries["manifest.json"])));
-      expect(manifest.server).toEqual({ origin, portSource: "setting" });
-      expect([...manifest.files].sort()).toEqual(names.filter((name) => name !== "manifest.json"));
-      for (const [name, bytes] of Object.entries(entries)) {
-        const text = strFromU8(bytes);
-        expect(text, name).not.toContain(apiKey);
-        expect(text, name).not.toContain(encryptionKey);
-        expect(text, name).not.toMatch(/#pair=[0-9a-f]/);
-      }
-    }),
-  ).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer))),
+          (server) => Effect.sync(() => server.close()),
+        );
+        expect(busy.listening).toBe(true);
+        yield* driver("enter a busy port", () => form.getByLabel("Port").fill(String(busyPort)));
+        yield* driver("submit with Enter", () => form.getByLabel("Port").press("Enter"));
+        const alert = yield* driver("busy port refusal", () =>
+          form.getByRole("alert").textContent(),
+        );
+        expect(alert).toBe(`Port ${busyPort} is in use by another program. Choose another port.`);
+        expect(
+          yield* fs
+            .readFileString(path.join(data, "service.json"))
+            .pipe(Effect.map((text) => JSON.parse(text))),
+        ).toEqual({ port });
+        yield* driver("cancel closes the port form", () =>
+          Promise.all([
+            form.waitForEvent("close"),
+            form.getByRole("button", { name: "Cancel" }).click(),
+          ]),
+        );
+
+        // Diagnostics export writes one zip with logs and a manifest, and no key or token values.
+        yield* driver("redirect downloads", () =>
+          electron.evaluate(({ app }, downloads) => app.setPath("downloads", downloads), downloads),
+        );
+        yield* click("Help", "Export diagnostics…");
+        const zip = yield* fs.readDirectory(downloads).pipe(
+          Effect.flatMap((names) => {
+            const name = names.find((entry) =>
+              /^executor-diagnostics-\d{8}T\d{6}Z\.zip$/.test(entry),
+            );
+            return name === undefined
+              ? Effect.fail(new Error("No diagnostics zip yet"))
+              : Effect.succeed(name);
+          }),
+          Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 80 }),
+        );
+        const entries = unzipSync(yield* fs.readFile(path.join(downloads, zip)));
+        const names = Object.keys(entries).sort();
+        expect(names).toContain("manifest.json");
+        expect(names).toContain("diagnostics/executor-desktop.jsonl");
+        expect(names).toContain("diagnostics/executor-local.jsonl");
+        expect(
+          names.every((name) => name === "manifest.json" || name.startsWith("diagnostics/")),
+        ).toBe(true);
+        const manifest = yield* Schema.decodeUnknownEffect(
+          Schema.fromJsonString(
+            Schema.Struct({
+              server: Schema.Struct({ origin: Schema.String, portSource: Schema.String }),
+              files: Schema.Array(Schema.String),
+            }),
+          ),
+        )(strFromU8(yield* Effect.fromNullishOr(entries["manifest.json"])));
+        expect(manifest.server).toEqual({ origin, portSource: "setting" });
+        expect([...manifest.files].sort()).toEqual(
+          names.filter((name) => name !== "manifest.json"),
+        );
+        for (const [name, bytes] of Object.entries(entries)) {
+          const text = strFromU8(bytes);
+          expect(text, name).not.toContain(apiKey);
+          expect(text, name).not.toContain(encryptionKey);
+          expect(text, name).not.toMatch(/#pair=[0-9a-f]/);
+        }
+      }),
+    ).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer))),
 );
diff --git a/e2e/tests/docker-release-executor-api.spec.ts b/e2e/tests/docker-release-executor-api.spec.ts
new file mode 100644
index 0000000000..59cd5bacc3
--- /dev/null
+++ b/e2e/tests/docker-release-executor-api.spec.ts
@@ -0,0 +1,286 @@
+/**
+ * The built-in Executor app reads the server's own API through its app cache, and agents find its
+ * tools through kept listings. Replacing the image with one whose API changed must not leave either
+ * serving the previous API: after #2951 removed profiles, upgraded servers kept listing
+ * `profiles.*`, which failed as unknown tools, and hid the new `appAccounts.*` tools for up to a day.
+ * The same holds for an Executor app that owns a database, as after an operator adds a migration to
+ * it: the upgrade keeps edited source, so its build stays the same and only the API's revision can
+ * start its listing afresh.
+ *
+ * `EXECUTOR_E2E_DOCKER_UPGRADE_FROM_IMAGE` names the published image the server starts on, which
+ * must serve a different API from `EXECUTOR_E2E_DOCKER_IMAGE`: without that difference the scenario
+ * proves nothing, so it fails rather than replacing an image with itself.
+ */
+import { expect, it } from "@effect/vitest";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Config, Console, Effect, Exit, Schedule, Schema } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:net";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { driver } from "../support/platform.ts";
+
+const Document = Schema.Struct({
+  paths: Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Unknown)),
+});
+const Operation = Schema.Struct({ operationId: Schema.String });
+const SearchInput = Schema.Record(Schema.String, Schema.Json);
+const SearchPage = Schema.Struct({
+  items: Schema.Array(Schema.Struct({ path: Schema.String })),
+  next: Schema.NullOr(SearchInput),
+});
+
+const Source = Schema.Struct({
+  files: Schema.Array(Schema.Struct({ path: Schema.String, content: Schema.String })),
+});
+
+/** Start on the previous image, warm the Executor app, replace the image and list its tools. */
+const upgrade = (database: boolean) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const image = yield* Config.String("EXECUTOR_E2E_DOCKER_IMAGE");
+      const previous = yield* Config.NonEmptyString("EXECUTOR_E2E_DOCKER_UPGRADE_FROM_IMAGE");
+      const id = `executor-release-api-${randomBytes(8).toString("hex")}`;
+      const run = (args: readonly string[]) =>
+        processes.string(ChildProcess.make("docker", args, { extendEnv: true }));
+      const port = yield* driver(
+        "allocate port",
+        () =>
+          new Promise<number>((resolve, reject) => {
+            const listener = createServer();
+            listener.once("error", reject);
+            listener.listen(0, "127.0.0.1", () => {
+              const address = listener.address();
+              listener.close(() =>
+                address === null || typeof address === "string"
+                  ? reject(new Error("No test port"))
+                  : resolve(address.port),
+              );
+            });
+          }),
+      );
+      const address = `http://127.0.0.1:${port}`;
+      // The server and the Executor app inside it reach the API at the container's own port.
+      const origin = "http://localhost:8080";
+      yield* Effect.acquireRelease(run(["volume", "create", id]), () =>
+        run(["volume", "rm", id]).pipe(Effect.orDie),
+      );
+      const start = (tag: string) =>
+        run([
+          "run",
+          "--detach",
+          "--name",
+          id,
+          "--init",
+          "--publish",
+          `127.0.0.1:${port}:8080`,
+          "--volume",
+          `${id}:/app/data`,
+          "--env",
+          "DO_NOT_TRACK=1",
+          "--env",
+          "PORT=8080",
+          "--env",
+          `EXECUTOR_APP_UI_BASE_URL=${origin}`,
+          tag,
+        ]);
+      const stop = run(["rm", "--force", id]).pipe(Effect.orDie);
+      yield* Effect.addFinalizer((exit) =>
+        (Exit.isFailure(exit)
+          ? run(["logs", "--tail", "80", id]).pipe(Effect.flatMap(Console.error), Effect.ignore)
+          : Effect.void
+        ).pipe(Effect.andThen(stop)),
+      );
+      const request = (route: string, data?: unknown, cookie?: string) =>
+        driver(`image ${route}`, () =>
+          fetch(`${address}${route}`, {
+            method: data === undefined ? "GET" : "POST",
+            headers: {
+              origin,
+              "content-type": "application/json",
+              ...(cookie === undefined ? {} : { cookie }),
+            },
+            ...(data === undefined ? {} : { body: JSON.stringify(data) }),
+          }),
+        );
+      const ready = request("/health").pipe(
+        Effect.flatMap((response) =>
+          response.status === 200 ? Effect.void : Effect.fail("not ready"),
+        ),
+        Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 240 }),
+      );
+      /** The operations of the API document the running image serves, which the Executor app reads. */
+      const operations = request("/openapi.json").pipe(
+        Effect.flatMap((response) => driver("API document", () => response.json())),
+        Effect.flatMap(Schema.decodeUnknownEffect(Document)),
+        Effect.map(
+          (document) =>
+            new Set(
+              Object.values(document.paths).flatMap((methods) =>
+                Object.values(methods).flatMap((operation) =>
+                  Schema.is(Operation)(operation) ? [operation.operationId] : [],
+                ),
+              ),
+            ),
+        ),
+      );
+      const connect = (key: string, organization: string) =>
+        Effect.acquireRelease(
+          Effect.gen(function* () {
+            const client = new Client({ name: "release-executor-api", version: "1" });
+            const transport: Omit<StreamableHTTPClientTransport, "sessionId"> =
+              new StreamableHTTPClientTransport(new URL(`${address}/mcp`), {
+                requestInit: {
+                  headers: {
+                    authorization: `Bearer ${key}`,
+                    "x-executor-organization": organization,
+                  },
+                },
+              });
+            yield* driver("connect over MCP", () => client.connect(transport));
+            return client;
+          }),
+          (client) => driver("close MCP client", () => client.close()).pipe(Effect.orDie),
+        );
+
+      yield* start(previous);
+      yield* ready;
+      const setup = yield* request("/api/auth/self-host/setup", {
+        name: "Release Owner",
+        email: "release-api@example.test",
+        password: "Synthetic-release-password-123!",
+        organizationName: "Release API lab",
+      });
+      expect(setup.status).toBe(200);
+      const cookie = setup.headers
+        .getSetCookie()
+        .map((part) => part.split(";")[0])
+        .join("; ");
+      const [organization] = yield* request("/api/auth/organization/list", undefined, cookie).pipe(
+        Effect.flatMap((response) => driver("organizations", () => response.json())),
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(Schema.NonEmptyArray(Schema.Struct({ id: Schema.String }))),
+        ),
+      );
+      // Setup installs the Executor app in the background.
+      const executor = yield* request(
+        `/api/organizations/${organization.id}/inventory`,
+        undefined,
+        cookie,
+      ).pipe(
+        Effect.flatMap((response) => driver("inventory", () => response.json())),
+        Effect.flatMap(
+          Schema.decodeUnknownEffect(
+            Schema.Struct({
+              apps: Schema.Array(Schema.Struct({ id: Schema.String, slug: Schema.String })),
+            }),
+          ),
+        ),
+        Effect.flatMap(({ apps }) => {
+          const app = apps.find((app) => app.slug === "executor");
+          return app === undefined ? Effect.fail("Executor app pending") : Effect.succeed(app);
+        }),
+        Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 120 }),
+      );
+      if (database) {
+        // The operator's edit: its version owns a database, and its tool calls run in a facet.
+        const app = `/api/organizations/${organization.id}/apps/${executor.id}`;
+        const source = yield* request(`${app}/source`, undefined, cookie).pipe(
+          Effect.flatMap((response) => driver("app source", () => response.json())),
+          Effect.flatMap(Schema.decodeUnknownEffect(Source)),
+        );
+        const deployed = yield* request(
+          `${app}/deploy`,
+          {
+            files: [
+              ...source.files,
+              {
+                path: "migrations/0001_release_check.sql",
+                content: "CREATE TABLE release_check (id TEXT PRIMARY KEY);",
+              },
+            ],
+          },
+          cookie,
+        );
+        expect(deployed.status, yield* driver("deployed", () => deployed.text())).toBe(200);
+      }
+      const { key } = yield* request(
+        "/api/auth/api-key/create",
+        { name: "Release API" },
+        cookie,
+      ).pipe(
+        Effect.flatMap((response) => driver("API key", () => response.json())),
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ key: Schema.String }))),
+      );
+      const before = yield* operations;
+      // An agent's search on the previous image keeps the Executor app's listing and document.
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const client = yield* connect(key, organization.id);
+          const warmed = yield* driver("search on the previous image", (signal) =>
+            client.callTool(
+              {
+                name: "execute",
+                arguments: { code: 'return await tools.search({ query: "list" });' },
+              },
+              undefined,
+              { signal },
+            ),
+          );
+          expect(warmed.isError, JSON.stringify(warmed.content)).not.toBe(true);
+        }),
+      );
+
+      yield* stop;
+      yield* start(image);
+      yield* ready;
+      const after = yield* operations;
+      // The upgrade must change the API, or the listing checks below hold for a stale listing too.
+      expect(
+        [...before].filter((operation) => !after.has(operation)).length +
+          [...after].filter((operation) => !before.has(operation)).length,
+        `${previous} and ${image} serve the same API`,
+      ).toBeGreaterThan(0);
+      const listed = yield* Effect.scoped(
+        Effect.gen(function* () {
+          const client = yield* connect(key, organization.id);
+          const paths: string[] = [];
+          let input: typeof SearchInput.Type = { namespace: "executor", limit: 50 };
+          for (;;) {
+            const page = yield* driver("list the Executor app's tools", (signal) =>
+              client.callTool({ name: "search", arguments: input }, undefined, { signal }),
+            ).pipe(
+              Effect.flatMap((result) =>
+                Schema.decodeUnknownEffect(SearchPage)(result.structuredContent),
+              ),
+            );
+            paths.push(...page.items.map((item) => item.path));
+            if (page.next === null) return paths;
+            input = page.next;
+          }
+        }),
+      );
+      const tools = new Set(listed.map((path) => path.replace(/^tools\.executor\./, "")));
+      expect(tools.size).toBeGreaterThan(0);
+      // Every listed tool is an operation of the API now served, so none of them is a removed one.
+      expect([...tools].filter((tool) => !after.has(tool))).toEqual([]);
+      // Every operation the replacement added is listed.
+      expect(
+        [...after].filter((operation) => !before.has(operation) && !tools.has(operation)),
+      ).toEqual([]);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer));
+
+it.live(
+  "replacing the image leaves the Executor app listing the new image's API",
+  () => upgrade(false),
+  300_000,
+);
+
+it.live(
+  "replacing the image leaves an Executor app that owns a database listing the new image's API",
+  () => upgrade(true),
+  300_000,
+);
diff --git a/e2e/tests/docker-release.spec.ts b/e2e/tests/docker-release.spec.ts
index 9cb2ef0629..989072739a 100644
--- a/e2e/tests/docker-release.spec.ts
+++ b/e2e/tests/docker-release.spec.ts
@@ -26,6 +26,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { appsManifest, withApps } from "../support/apps-release.ts";
 import { containerNpmRegistry } from "../support/npm-registry.ts";
 import { connectionsPath } from "../support/app-accounts.ts";
+import { currentClient } from "../support/api.ts";
 
 /**
  * `workerd --version` prints the release date of the workerd the checkout pins, which the image
@@ -1902,11 +1903,19 @@ it.live("released image serves management tools at a tailnet origin with private
             }),
         );
       };
-      const request = (route: string, data?: unknown, cookie?: string) =>
+      // Like the dashboard, each request states the wire revision this release reads, unless it
+      // stands in for a client released before revisions, which sends none.
+      const request = (
+        route: string,
+        data?: unknown,
+        cookie?: string,
+        client: Record<string, string> = currentClient,
+      ) =>
         driver("tailnet image HTTP request", () =>
           hostFetch(`${origin}${route}`, {
             method: data === undefined ? "GET" : "POST",
             headers: {
+              ...client,
               origin,
               "content-type": "application/json",
               ...(cookie === undefined ? {} : { cookie }),
diff --git a/e2e/tests/durable-evaluated-results.spec.ts b/e2e/tests/durable-evaluated-results.spec.ts
index ed3673ed2d..e0ca0cafaf 100644
--- a/e2e/tests/durable-evaluated-results.spec.ts
+++ b/e2e/tests/durable-evaluated-results.spec.ts
@@ -19,9 +19,13 @@ import { Evidence, Telemetry } from "../support/evidence.ts";
  * A listing over the isolate store's 2 MB entry bound: 1,500 tools with 800-character
  * descriptions. The isolate never keeps it, so every read after the first tests the supervisor.
  * The revision tool is named after a value kept in the app cache, so an invalidation renames it.
+ * Evaluating it first waits `delayMs`.
  */
-const source = `import { defineApp, query, object, router, string } from "apps";
+const listingSource = (
+  delayMs: number,
+) => `import { defineApp, query, object, router, string } from "apps";
 export default defineApp({}, async (ctx) => {
+  await new Promise((resolve) => setTimeout(resolve, ${delayMs}));
   const revision = await ctx.cache.get({
     key: "revision",
     schema: string(),
@@ -137,7 +141,7 @@ export default defineApp({}, {
 const Listing = Schema.Struct({ items: Schema.Array(Schema.Struct({ name: Schema.String })) });
 
 /** Deploy a listing app and read its tool listing with the spans of each request. */
-const listingApp = (files: string = source) =>
+const listingApp = (files: string = listingSource(0)) =>
   Effect.gen(function* () {
     const api = yield* Api,
       actors = yield* Actors,
@@ -200,15 +204,18 @@ const listingApp = (files: string = source) =>
   });
 
 const listed = (names: ReadonlyArray<string>) => names.includes("sdk.tools.listing");
-/** A read that evaluated, and kept its result in the supervisor after responding. */
-const written = (names: ReadonlyArray<string>) =>
-  listed(names) && names.includes("storage.evaluated.write");
 /**
  * A read that evaluated. The evaluation ends after the response, so its spans can reach Motel
  * before the request's own: the read waits for the listing span, which holds the cache outcome.
  */
 const evaluates = (names: ReadonlyArray<string>) =>
   listed(names) && names.includes("sdk.tools.listing.evaluate");
+/**
+ * A read that evaluated, and kept its result in the supervisor after responding. The supervisor
+ * write ends before the evaluation, which then writes search rows, so both are waited for.
+ */
+const written = (names: ReadonlyArray<string>) =>
+  evaluates(names) && names.includes("storage.evaluated.write");
 
 layer(HostedLive, { excludeTestServices: true })("Durable evaluated results", (it) => {
   it.effect(scenarios.durableEvaluatedResults.title, (context) =>
@@ -259,7 +266,11 @@ layer(HostedLive, { excludeTestServices: true })("Durable evaluated results", (i
       withHostedCase(
         context,
         Effect.gen(function* () {
-          const { read } = yield* listingApp();
+          // A read that misses the isolate waits 100 ms for the supervisor's copy, then evaluates
+          // beside it and serves whichever arrives first; the supervisor read gives up after 2 s.
+          // The supervisor wakes after the wait below, sometimes slower than a fast app evaluates.
+          // An app slower than both is served the copy whenever the supervisor answers.
+          const { read } = yield* listingApp(listingSource(3_000));
           const first = yield* read("first-listing", written);
           expect(first.cache).toBe("miss");
 
@@ -268,10 +279,7 @@ layer(HostedLive, { excludeTestServices: true })("Durable evaluated results", (i
           // must still keep its result in the supervisor.
           yield* Effect.sleep("31 seconds");
           // The refresh's spans can arrive before the request's own, which say where it was served.
-          const stale = yield* read(
-            "stale-listing",
-            (names) => evaluates(names) && names.includes("storage.evaluated.write"),
-          );
+          const stale = yield* read("stale-listing", written);
           expect(stale.source).toBe("durable");
           expect(stale.cache).toBe("stale");
           expect(stale.age).toBeGreaterThanOrEqual(30_000);
diff --git a/e2e/tests/empty-states.spec.ts b/e2e/tests/empty-states.spec.ts
index 8775921485..a3d8a2c5ef 100644
--- a/e2e/tests/empty-states.spec.ts
+++ b/e2e/tests/empty-states.spec.ts
@@ -104,7 +104,7 @@ layer(HostedLive, { excludeTestServices: true })("Empty states", (it) => {
             yield* browser.use("The next action is visible", (page) =>
               page
                 .locator(".empty-state")
-                .getByRole(section === "tokens" ? "button" : "link", {
+                .getByRole(section === "tokens" || section === "apps" ? "button" : "link", {
                   name:
                     section === "apps"
                       ? "Add app"
@@ -185,8 +185,13 @@ layer(HostedLive, { excludeTestServices: true })("Empty states", (it) => {
           "Open Add app during the failure",
           `/org/${actors.organization.slug}/apps/add`,
         );
+        // Read alone, the aborted read is a lost connection. Batched with another read that starts
+        // with it, such as Cloud's v1 import notice, its batch ends without answering it.
         yield* browser.use("The catalog error is visible", (page) =>
-          page.getByText("Unable to complete this request", { exact: true }).first().waitFor(),
+          page
+            .getByText(/^(Can’t reach Executor|Unable to complete this request)$/)
+            .first()
+            .waitFor(),
         );
         expect(
           yield* browser.use("Failure is not a search result", (page) =>
diff --git a/e2e/tests/executor-key-account.spec.ts b/e2e/tests/executor-key-account.spec.ts
index 718c32aa21..b45e83b8b9 100644
--- a/e2e/tests/executor-key-account.spec.ts
+++ b/e2e/tests/executor-key-account.spec.ts
@@ -17,6 +17,10 @@ import {
 } from "../support/app-accounts.ts";
 import { saveAndDeploy } from "../support/app-authoring.ts";
 import { managementApp } from "../support/management-app.ts";
+import { legacyStorage } from "../support/legacy-storage.ts";
+import { Resource } from "../support/contracts.ts";
+import { randomUUID } from "node:crypto";
+import { serverControl } from "../support/server-control.ts";
 import { openThroughBrowser } from "../support/in-app-navigation.ts";
 import { advanceToReconciliation, installBrowserClock } from "../support/query-transition.ts";
 const App = Schema.Struct({
@@ -252,7 +256,7 @@ layer(HostedLive, { excludeTestServices: true })("Executor API-key account", (it
               ),
             ).toBe(0);
             yield* browser.use("Team controls stay available", (page) =>
-              page.getByRole("link", { name: "Add app", exact: true }).waitFor(),
+              page.getByRole("button", { name: "Add app", exact: true }).waitFor(),
             );
             yield* browser.checkpoint("One app skeleton while team installation runs");
             yield* held.stop;
@@ -580,4 +584,79 @@ layer(HostedLive, { excludeTestServices: true })("Executor API-key account", (it
       }),
     ),
   );
+  it.effect(scenarios.executorAppSetupLeavesVersion.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const organization = actors.organization.id;
+        const prefix = `/api/organizations/${organization}`;
+        const { app, account } = yield* managementApp(actors.owner);
+        const path = `${prefix}/apps/${app.id}`;
+        const Version = Schema.Struct({ activeVersion: Schema.String });
+        const Source = Schema.Struct({
+          files: Schema.Array(Schema.Struct({ path: Schema.String, content: Schema.String })),
+        });
+        const source = api.request(actors.owner, "GET", `${path}/source`).pipe(
+          Effect.flatMap((response) => body(Source, response)),
+          Effect.map(({ files }) => ({
+            files: files.toSorted((left, right) => left.path.localeCompare(right.path)),
+          })),
+        );
+        // A version whose files differ from this host's template, as an earlier template's do.
+        const earlier = (yield* source).files.map((file) =>
+          file.path === "index.ts"
+            ? { ...file, content: `${file.content}\n// Synthetic earlier template\n` }
+            : file,
+        );
+        const deployed = yield* saveAndDeploy(actors.owner, path, { files: earlier });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const version = (yield* body(Schema.Struct({ app: Version }), deployed)).app.activeVersion;
+        // Record it as the version Executor installed, then start the current server over it.
+        yield* legacyStorage([
+          {
+            sql: `UPDATE "organization" SET metadata = jsonb_set(coalesce(metadata::jsonb, '{}'::jsonb), '{executorDefaults}', jsonb_build_object('installed', true, 'app', $2::text, 'deployment', $3::text))::text WHERE id = $1`,
+            params: [organization, app.id, version],
+          },
+        ]);
+        yield* serverControl("start");
+        // A new admin joins, and member setup mints and links their key.
+        const email = `joining-admin-${randomUUID().slice(0, 8)}@example.test`;
+        const invitation = yield* body(
+          Resource,
+          yield* api.request(actors.owner, "POST", "/api/auth/organization/invite-member", {
+            organizationId: organization,
+            email,
+            role: "admin",
+          }),
+        );
+        const joining = yield* api.session();
+        expect(
+          (yield* api.request(joining, "POST", "/api/auth/self-host/register", {
+            invitation: invitation.id,
+            name: "Joining Admin",
+            email,
+            password: "password1234",
+          })).status,
+        ).toBe(200);
+        const joined = yield* managementApp(joining);
+        expect(joined.app.id).toBe(app.id);
+        expect(joined.account).not.toBe(account);
+        // Setup left the organization's version, and the keys that fit it, as they were.
+        expect(
+          (yield* body(Version, yield* api.request(actors.owner, "GET", path))).activeVersion,
+        ).toBe(version);
+        expect((yield* source).files).toEqual(earlier);
+        // The owner's key still fits the app, so calls keep running with it.
+        expect(yield* linkedAccountIds(actors.owner, path)).toEqual([account]);
+        const call = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
+          tool: "context.get",
+          kind: "query",
+          input: {},
+        });
+        expect(call.status, JSON.stringify(call.body)).toBe(200);
+      }),
+    ),
+  );
 });
diff --git a/e2e/tests/graphql-errors.spec.ts b/e2e/tests/graphql-errors.spec.ts
new file mode 100644
index 0000000000..1b043fea06
--- /dev/null
+++ b/e2e/tests/graphql-errors.spec.ts
@@ -0,0 +1,492 @@
+/** The errors a GraphQL server states reach the app's caller as that server's words. */
+import { expect, layer } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Clock, Effect, Layer, Ref, Schema, Stream } from "effect";
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App, Resource } from "../support/contracts.ts";
+import { Evidence } from "../support/evidence.ts";
+import { frameworkSession } from "../support/framework.ts";
+import { McpOAuth } from "../support/mcp-oauth.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { authoredAppFiles } from "../support/authored-templates.ts";
+import { connectionsPath } from "../support/app-accounts.ts";
+import { expectUnknownOutcome } from "../support/write-outcome.ts";
+
+/**
+ * The account's token; the fixture server repeats it in errors, as a careless server can. Its
+ * quote and backslash change how it reads once quoted, so its marker must not appear in any form.
+ */
+const token = 'synthetic-"quoted\\graphql-keymarker';
+const tokenMarker = "keymarker";
+/** A value the fixture server puts in a nested `extensions` entry, which is never carried. */
+const stackMarker = "synthetic-stack-frame";
+
+/** What the fixture server answers to the next tool call or introspection. */
+type Mode =
+  | "ok"
+  | "introspection"
+  | "validation"
+  | "execution"
+  | "echo"
+  | "many"
+  | "html"
+  | "huge"
+  | "wide"
+  | "stalled";
+
+const fixture = Effect.gen(function* () {
+  const mode = yield* Ref.make<Mode>("ok");
+  const scalar = (name: string) => ({ kind: "SCALAR", name, ofType: null });
+  const required = (type: Schema.Json) => ({ kind: "NON_NULL", name: null, ofType: type });
+  const argument = (name: string, type: Schema.Json) => ({
+    name,
+    type,
+    description: null,
+    defaultValue: null,
+  });
+  const type = (kind: string, name: string, extra: Record<string, Schema.Json> = {}) => ({
+    kind,
+    name,
+    fields: null,
+    inputFields: null,
+    enumValues: null,
+    ...extra,
+  });
+  const field = (name: string, args: readonly Schema.Json[], output: Schema.Json) => ({
+    name,
+    description: null,
+    args,
+    type: output,
+  });
+  const schema = {
+    __schema: {
+      queryType: { name: "Query" },
+      mutationType: { name: "Mutation" },
+      types: [
+        type("OBJECT", "Query", { fields: [field("viewer", [], scalar("String"))] }),
+        type("OBJECT", "Mutation", {
+          fields: [
+            field(
+              "projectCreate",
+              [
+                argument(
+                  "input",
+                  required({ kind: "INPUT_OBJECT", name: "ProjectCreateInput", ofType: null }),
+                ),
+              ],
+              { kind: "OBJECT", name: "Project", ofType: null },
+            ),
+          ],
+        }),
+        type("OBJECT", "Project", {
+          fields: [field("id", [], scalar("String")), field("name", [], scalar("String"))],
+        }),
+        type("INPUT_OBJECT", "ProjectCreateInput", {
+          inputFields: [
+            argument("name", required(scalar("String"))),
+            argument("description", scalar("String")),
+          ],
+        }),
+        type("SCALAR", "String"),
+      ],
+    },
+  };
+  const routes = HttpRouter.add(
+    "POST",
+    "/graphql",
+    Effect.gen(function* () {
+      const request = yield* HttpServerRequest.HttpServerRequest;
+      const message = yield* request.json.pipe(
+        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ query: Schema.String }))),
+      );
+      const current = yield* Ref.get(mode);
+      if (message.query.includes("__schema"))
+        return current === "introspection"
+          ? yield* HttpServerResponse.json({
+              errors: [
+                {
+                  message: "Introspection is disabled for this API key",
+                  extensions: { code: "INTROSPECTION_DISABLED" },
+                },
+              ],
+            })
+          : yield* HttpServerResponse.json({ data: schema });
+      const presented = request.headers.authorization?.replace(/^Bearer /u, "") ?? "";
+      switch (current) {
+        // A request the server refuses before running it, answered with a client error status.
+        case "validation":
+          return yield* HttpServerResponse.json(
+            {
+              errors: [
+                {
+                  message: "Argument Validation Error",
+                  locations: [{ line: 1, column: 12 }],
+                  path: ["projectCreate"],
+                  extensions: {
+                    code: "INVALID_INPUT",
+                    type: "invalid input",
+                    userPresentableMessage:
+                      "description must be shorter than or equal to 255 characters",
+                    exception: { stacktrace: [stackMarker] },
+                  },
+                },
+              ],
+            },
+            { status: 400 },
+          );
+        // A field error while running the operation, as a GraphQL response with data.
+        case "execution":
+          return yield* HttpServerResponse.json({
+            data: null,
+            errors: [
+              {
+                message: `A project with this name already exists for key ${presented}`,
+                path: ["projectCreate", "input", "name"],
+                extensions: { code: "CONFLICT", retryable: false },
+              },
+              // A server's claim about the outcome, which Executor cannot check.
+              { message: "Nothing was changed. Retry this request.", extensions: { code: "SAFE" } },
+            ],
+          });
+        // The token in every field a failure quotes: the message, a path segment and an extension.
+        case "echo":
+          return yield* HttpServerResponse.json(
+            {
+              errors: [
+                {
+                  message: `Refused for key ${presented}`,
+                  path: ["projectCreate", presented],
+                  extensions: { code: "DENIED", key: presented },
+                },
+              ],
+            },
+            { status: 400 },
+          );
+        case "many":
+          return yield* HttpServerResponse.json({
+            data: null,
+            errors: [
+              { message: `Long ${"x".repeat(5_000)}`, path: ["projectCreate", 0] },
+              ...Array.from({ length: 6 }, (_, index) => ({
+                message: `Error ${index + 2}`,
+                path: ["projectCreate", "items", index, "label-text"],
+              })),
+            ],
+          });
+        // A proxy's error page, which states no GraphQL errors.
+        case "html":
+          return HttpServerResponse.text("<html><body>Bad Request</body></html>", {
+            status: 400,
+            contentType: "text/html",
+          });
+        // A 24 MiB error message, sent in chunks without a declared length.
+        case "huge": {
+          const chunk = "x".repeat(1_048_576);
+          return HttpServerResponse.stream(
+            Stream.fromIterable([
+              '{"errors":[{"message":"',
+              ...Array.from({ length: 24 }, () => chunk),
+              '"}]}',
+            ]).pipe(Stream.encodeText),
+            { status: 400, contentType: "application/json" },
+          );
+        }
+        case "wide":
+          return yield* HttpServerResponse.json(
+            {
+              errors: Array.from({ length: 30_000 }, (_, index) => ({ message: `Error ${index}` })),
+            },
+            { status: 400 },
+          );
+        // The status and the start of a body that never finishes.
+        case "stalled":
+          return HttpServerResponse.stream(
+            Stream.concat(Stream.make(new TextEncoder().encode('{"errors":[')), Stream.never),
+            { status: 400, contentType: "application/json" },
+          );
+        default:
+          return yield* HttpServerResponse.json({
+            data: { projectCreate: { id: "project-1", name: "Synthetic" } },
+          });
+      }
+    }),
+  );
+  const services = yield* Layer.build(
+    HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+      Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 })),
+    ),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Expected TCP fixture");
+  return {
+    origin: `http://127.0.0.1:${server.address.port}`,
+    answer: (next: Mode) => Ref.set(mode, next),
+  };
+});
+
+const ServiceFailure = Schema.Struct({
+  _tag: Schema.String,
+  reason: Schema.String,
+  failure: Schema.Struct({
+    source: Schema.Literal("service"),
+    errorName: Schema.Literal("GraphqlError"),
+    code: Schema.String,
+    message: Schema.String,
+  }),
+});
+const ExecutionFailed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Literal(false),
+    error: Schema.Struct({
+      message: Schema.String,
+      response: Schema.Struct({
+        code: Schema.String,
+        message: Schema.String,
+        recovery: Schema.optional(
+          Schema.Struct({ action: Schema.String, instructions: Schema.String }),
+        ),
+        retryable: Schema.Boolean,
+        phase: Schema.Literal("call"),
+        reference: Schema.String.check(Schema.isPattern(/^[0-9a-f]{32}$/u)),
+      }),
+    }),
+  }),
+});
+
+layer(HostedLive, { excludeTestServices: true })("GraphQL errors", (it) => {
+  it.effect(scenarios.graphqlStatedErrors.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          evidence = yield* Evidence;
+        const upstream = yield* fixture;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `GraphQL errors ${randomUUID().slice(0, 8)}`,
+          files: authoredAppFiles("graphql", upstream.origin, "apiKey", "GraphQL errors"),
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed),
+          path = `${prefix}/apps/${app.id}`;
+        const accounts: string[] = [];
+        const apps = [path];
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            for (const deployedPath of apps)
+              yield* api.request(actors.owner, "DELETE", deployedPath);
+            for (const account of accounts)
+              yield* api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`);
+          }).pipe(Effect.orDie),
+        );
+        const connection = yield* body(
+          Resource,
+          yield* api.request(actors.owner, "POST", connectionsPath(path, "user", "service"), {}),
+        );
+        const saved = yield* api.request(
+          actors.owner,
+          "POST",
+          `${prefix}/connections/${connection.id}/submit`,
+          { method: "apiKey", label: "work", fields: { token } },
+        );
+        expect(saved.status, JSON.stringify(saved.body)).toBe(200);
+        const account = (yield* body(Resource, saved)).id;
+        accounts.push(account);
+
+        // Reading the schema: the server's refusal is named, not only its status.
+        yield* upstream.answer("introspection");
+        const listing = yield* api.request(actors.owner, "GET", `${path}/tools`);
+        yield* evidence.json("graphql-discovery-failure.json", listing.body);
+        expect(listing.status, JSON.stringify(listing.body)).toBe(502);
+        expect(yield* body(ServiceFailure, listing)).toMatchObject({
+          _tag: "AppEvaluationFailed",
+          failure: {
+            code: "execution",
+            message:
+              'The GraphQL server answered HTTP 200 with errors while Executor read its schema. It stated: "Introspection is disabled for this API key" (code: "INTROSPECTION_DISABLED").',
+          },
+        });
+        yield* upstream.answer("ok");
+        const listed = yield* api.request(actors.owner, "GET", `${path}/tools`);
+        expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+
+        const input = (description: string) => ({
+          accountId: account,
+          input: { arguments: { input: { name: "Synthetic", description } } },
+        });
+        const call = (mode: Mode) =>
+          Effect.gen(function* () {
+            yield* upstream.answer(mode);
+            const response = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
+              tool: "mutation_projectCreate",
+              kind: "mutation",
+              input: input("d".repeat(300)),
+            });
+            yield* evidence.json(`graphql-${mode}-failure.json`, response.body);
+            expect(response.status, JSON.stringify(response.body)).toBe(502);
+            const failure = yield* body(ServiceFailure, response);
+            expect(failure._tag).toBe("ToolCallFailed");
+            expect(failure.reason).toBe(`The app's API call failed: ${failure.failure.message}`);
+            expect(JSON.stringify(response.body)).not.toContain(token);
+            expect(JSON.stringify(response.body)).not.toContain(tokenMarker);
+            // The server's words never decide whether the mutation may be repeated.
+            const presented = yield* body(
+              Schema.Struct({
+                recovery: Schema.Struct({ action: Schema.String, instructions: Schema.String }),
+              }),
+              response,
+            );
+            expectUnknownOutcome(presented.recovery);
+            return failure.failure;
+          });
+
+        // A validation error, answered with HTTP 400: the server's message, path and scalar
+        // extensions, such as the limit it states, reach the caller; nested values do not.
+        const refused = yield* call("validation");
+        expect(refused).toEqual({
+          source: "service",
+          errorName: "GraphqlError",
+          code: "request",
+          message:
+            'The GraphQL server answered HTTP 400 to this tool call. It stated: "Argument Validation Error" at projectCreate (code: "INVALID_INPUT", type: "invalid input", userPresentableMessage: "description must be shorter than or equal to 255 characters").',
+        });
+        expect(refused.message).not.toContain(stackMarker);
+
+        // A field error during execution, answered with HTTP 200. The account's key, which the
+        // server repeated, is replaced.
+        expect(yield* call("execution")).toMatchObject({
+          code: "execution",
+          message:
+            'The GraphQL server answered HTTP 200 with errors to this tool call. It stated 2 errors: "A project with this name already exists for key [redacted]" at projectCreate.input.name (code: "CONFLICT", retryable: false); "Nothing was changed. Retry this request." (code: "SAFE").',
+        });
+
+        // The token the server repeated is replaced in its message, path and extensions before
+        // they are quoted, so its quote and backslash cannot change how it reads.
+        expect(yield* call("echo")).toMatchObject({
+          code: "request",
+          message:
+            'The GraphQL server answered HTTP 400 to this tool call. It stated: "Refused for key [redacted]" at projectCreate["[redacted]"] (code: "DENIED", key: "[redacted]").',
+        });
+
+        // Many or long errors stay within the message bound and say how many were left out.
+        const many = (yield* call("many")).message;
+        expect(many.length).toBeLessThanOrEqual(2048);
+        expect(many).toMatch(
+          /^The GraphQL server answered HTTP 200 with errors to this tool call\. It stated 7 errors: "Long x+…" at projectCreate\[0\]; "Error 2" at projectCreate\.items\[0\]\["label-text"\]; /u,
+        );
+        expect(many).toContain("2 more errors are not shown.");
+
+        // A body that states no GraphQL errors still names the status, not a missing message.
+        expect(yield* call("html")).toMatchObject({
+          code: "request",
+          message: "The GraphQL server answered HTTP 400 to this tool call.",
+        });
+
+        // A refused request's body is read within error-body bounds. One too large or too slow to
+        // read is left unread, promptly, and the failure keeps the status the server answered.
+        const promptly = (mode: Mode) =>
+          Effect.gen(function* () {
+            const started = yield* Clock.currentTimeMillis;
+            const failure = yield* call(mode);
+            const elapsed = (yield* Clock.currentTimeMillis) - started;
+            yield* evidence.json(`graphql-${mode}-elapsed.json`, { elapsed });
+            expect(elapsed).toBeLessThan(10_000);
+            return failure;
+          });
+        const tooLarge =
+          "The GraphQL server answered HTTP 400 to this tool call. Executor did not read its response body, which was larger than 64 KiB.";
+        const incomplete =
+          "The GraphQL server answered HTTP 400 to this tool call. Executor did not read its response body, which did not arrive in time.";
+        expect(yield* promptly("huge")).toMatchObject({ code: "request", message: tooLarge });
+        expect(yield* promptly("wide")).toMatchObject({ code: "request", message: tooLarge });
+        expect(yield* promptly("stalled")).toMatchObject({ code: "request", message: incomplete });
+
+        // An app's own deadline shorter than the body's read keeps the status too.
+        const files = authoredAppFiles(
+          "graphql",
+          upstream.origin,
+          "public",
+          "GraphQL errors deadline",
+        ).map((file) =>
+          file.path === "index.ts"
+            ? {
+                ...file,
+                content: file.content.replace(
+                  "\n    cache,",
+                  "\n    cache,\n    timeoutMs: 1_000,",
+                ),
+              }
+            : file,
+        );
+        expect(files.find((file) => file.path === "index.ts")?.content).toContain(
+          "timeoutMs: 1_000,",
+        );
+        const short = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `GraphQL errors deadline ${randomUUID().slice(0, 8)}`,
+          files,
+        });
+        expect(short.status, JSON.stringify(short.body)).toBe(200);
+        const shortPath = `${prefix}/apps/${(yield* body(App, short)).id}`;
+        apps.push(shortPath);
+        yield* upstream.answer("stalled");
+        const started = yield* Clock.currentTimeMillis;
+        const deadline = yield* api.request(actors.owner, "POST", `${shortPath}/tools/call`, {
+          tool: "mutation_projectCreate",
+          kind: "mutation",
+          input: { arguments: { input: { name: "Synthetic" } } },
+        });
+        const elapsed = (yield* Clock.currentTimeMillis) - started;
+        yield* evidence.json("graphql-deadline-failure.json", { elapsed, body: deadline.body });
+        expect(elapsed).toBeLessThan(10_000);
+        expect(deadline.status, JSON.stringify(deadline.body)).toBe(502);
+        expect((yield* body(ServiceFailure, deadline)).failure).toMatchObject({
+          code: "request",
+          message: incomplete,
+        });
+
+        // An agent calling the mutation through MCP reads the server's words, under Executor's
+        // instruction not to repeat a call that may have changed data.
+        yield* upstream.answer("validation");
+        const { client } = yield* frameworkSession;
+        const executed = yield* client.use("Call the refused mutation", (client, signal) =>
+          client.callTool(
+            {
+              name: "execute",
+              arguments: {
+                code: `return await tools[${JSON.stringify(app.slug)}].mutation_projectCreate(${JSON.stringify(input("d".repeat(300)))});`,
+              },
+            },
+            undefined,
+            { signal },
+          ),
+        );
+        yield* evidence.json("mcp-graphql-validation-failure.json", executed.structuredContent);
+        const failure = (yield* Schema.decodeUnknownEffect(ExecutionFailed)(
+          executed.structuredContent,
+        )).execution.error;
+        expect(failure.response.code).toBe("ToolCallFailed");
+        expect(failure.response.message).toBe(`The app's API call failed: ${refused.message}`);
+        expect(failure.response.retryable).toBe(false);
+        expectUnknownOutcome(failure.response.recovery);
+        expect(failure.response.recovery?.instructions).toContain(
+          "They are the server's words, which Executor does not check.",
+        );
+        expect(failure.message).toContain(
+          "description must be shorter than or equal to 255 characters",
+        );
+        expect(failure.message).not.toContain("thrown without a message");
+        expect(failure.message).toBe(
+          `ToolCallFailed (HTTP 502): ${failure.response.message} Recovery: ${failure.response.recovery?.action} Retryable (unchanged call): no. Phase: call. Reference: ${failure.response.reference}.`,
+        );
+      }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
+    ),
+  );
+});
diff --git a/e2e/tests/grouped-resources.spec.ts b/e2e/tests/grouped-resources.spec.ts
index c1dfdddef1..f9bf4a6990 100644
--- a/e2e/tests/grouped-resources.spec.ts
+++ b/e2e/tests/grouped-resources.spec.ts
@@ -23,14 +23,21 @@ import {
 import { scenarios } from "../test-plan.ts";
 import { appsManifest } from "../support/apps-release.ts";
 
-const fixture = `import {defineApp,defineProvider,secrets,query,workflow,object,string, router} from "apps";
-const service=defineProvider({name:"Resources fixture",auth:{key:secrets({label:"Key",fields:object({token:string()})})}});
+// Each fixture's `service` requirement is plain, so the caller links one account and a new link
+// replaces it.
+const provider = `const service=defineProvider({name:"Resources fixture",auth:{key:secrets({label:"Key",fields:object({token:string()})})}});`;
+const identity = `tools: router({
+  identity:query({input:object({})},async ctx=>ctx.user.accounts.service.id),
+})`;
+const workflowsFixture = `import {defineApp,defineProvider,secrets,query,workflow,object,string, router} from "apps";
+${provider}
 const capture=workflow({input:object({body:string()})},async(ctx,input)=>ctx.step.do("capture",async step=>({account:step.user.accounts.service.id,body:input.body})));
 const hold=workflow({input:object({})},async ctx=>{await ctx.step.sleep("hold","5 minutes");return "done";});
+export default defineApp({user: { accounts:{service} }},{${identity},workflows:{capture,hold}});`;
+const webhooksFixture = `import {defineApp,defineProvider,secrets,query,object,string, router} from "apps";
+${provider}
 const incoming={account:{ user: "service" },config:object({channel:string()}),state:object({}),register:async()=>({}),unregister:async()=>{},handle:async()=>new Response(null,{status:204})};
-export default defineApp({user: { accounts:{service} }},{tools: router({
-  identity:query({input:object({})},async ctx=>ctx.user.accounts.service.id),
-}),workflows:{capture,hold},webhooks:{incoming}});`;
+export default defineApp({user: { accounts:{service} }},{${identity},webhooks:{incoming}});`;
 const Run = Schema.Struct({
   id: Schema.String,
   workflow: Schema.String,
@@ -38,6 +45,66 @@ const Run = Schema.Struct({
   output: Schema.optional(Schema.Unknown),
 });
 
+/**
+ * Deploy `fixture` as a new app and connect accounts to its `service` requirement. Cleanup unlinks
+ * them, removes the app once its webhooks have stopped and deletes the accounts. Workflows and
+ * webhook sources are separate cases, each with its own app. On a deployed Cloud stage, each
+ * workflow run waits seconds for its instance to start, and each webhook source change waits for
+ * background registration; together they took up to 56 of the 60 seconds.
+ */
+const linkedApp = (fixture: string) =>
+  Effect.gen(function* () {
+    const api = yield* Api,
+      actors = yield* Actors;
+    const prefix = `/api/organizations/${actors.organization.id}`;
+    const app = yield* body(
+      App,
+      yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+        name: `Resources ${randomUUID().slice(0, 8)}`,
+        files: [{ path: "index.ts", content: fixture }, appsManifest],
+      }),
+    );
+    const path = `${prefix}/apps/${app.id}`;
+    const created: string[] = [];
+    yield* Effect.addFinalizer(() =>
+      Effect.gen(function* () {
+        for (const account of created)
+          yield* unlinkAccountResponse(actors.owner, path, "service", account);
+        yield* removeAppWhenStopped(actors.owner, path);
+        for (const account of created)
+          yield* api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`);
+      }).pipe(Effect.orDie),
+    );
+    const connect = (label: string) =>
+      Effect.gen(function* () {
+        const connection = yield* body(
+          Resource,
+          yield* api.request(actors.owner, "POST", connectionsPath(path, "user", "service"), {}),
+        );
+        const account = yield* body(
+          Resource,
+          yield* api.request(
+            actors.owner,
+            "POST",
+            `${prefix}/connections/${connection.id}/submit`,
+            {
+              method: "key",
+              label,
+              fields: { token: "synthetic-resource-token" },
+            },
+          ),
+        );
+        created.push(account.id);
+        return account.id;
+      });
+    const accountStatus = (account: string) =>
+      Effect.map(
+        api.request(actors.owner, "GET", `${prefix}/accounts/${account}`),
+        (response) => response.status,
+      );
+    return { app, path, connect, accountStatus };
+  });
+
 layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
   it.effect(scenarios.groupedResources.title, (context) =>
     withHostedCase(
@@ -46,57 +113,9 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
         const api = yield* Api,
           actors = yield* Actors,
           browser = yield* Browser;
-        const prefix = `/api/organizations/${actors.organization.id}`;
-        const app = yield* body(
-          App,
-          yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
-            name: `Resources ${randomUUID().slice(0, 8)}`,
-            files: [{ path: "index.ts", content: fixture }, appsManifest],
-          }),
-        );
-        const path = `${prefix}/apps/${app.id}`;
-        const created: string[] = [];
-        yield* Effect.addFinalizer(() =>
-          Effect.gen(function* () {
-            for (const account of created)
-              yield* unlinkAccountResponse(actors.owner, path, "service", account);
-            yield* removeAppWhenStopped(actors.owner, path);
-            for (const account of created)
-              yield* api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`);
-          }).pipe(Effect.orDie),
-        );
-        const connect = (label: string) =>
-          Effect.gen(function* () {
-            const connection = yield* body(
-              Resource,
-              yield* api.request(
-                actors.owner,
-                "POST",
-                connectionsPath(path, "user", "service"),
-                {},
-              ),
-            );
-            const account = yield* body(
-              Resource,
-              yield* api.request(
-                actors.owner,
-                "POST",
-                `${prefix}/connections/${connection.id}/submit`,
-                { method: "key", label, fields: { token: "synthetic-resource-token" } },
-              ),
-            );
-            created.push(account.id);
-            return account.id;
-          });
+        const { app, path, connect, accountStatus } = yield* linkedApp(workflowsFixture);
         const personal = yield* connect("Personal");
         expect(yield* linkedAccountIds(actors.owner, path)).toEqual([personal]);
-        const settle = (expected: Parameters<typeof sourcesAre>[0]) =>
-          settleWebhookSources(actors.owner, path, sourcesAre(expected));
-        const subscriptions = webhookSubscriptions(actors.owner, path);
-        // The linked account becomes the app's webhook source; registration waits for configuration.
-        const needsConfiguration = { status: "needs-setup", failure: "configuration" };
-        const ready = { status: "ready", failure: null };
-        yield* settle({ [personal]: needsConfiguration });
         const waitForRun = (id: string) =>
           Effect.gen(function* () {
             const deadline = (yield* Clock.currentTimeMillis) + 30000;
@@ -117,10 +136,9 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
             key: randomUUID(),
             ...extra,
           });
+        const workflows = `/org/${actors.organization.slug}/apps/${app.id}?view=workflows`;
         yield* browser.login(actors.owner);
-        yield* browser.use("Open workflows", (page) =>
-          page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=workflows`),
-        );
+        yield* browser.use("Open workflows", (page) => page.goto(workflows));
         yield* browser.use("Open the capture workflow", (page) =>
           page.getByRole("button", { name: "capture", exact: true }).click(),
         );
@@ -181,11 +199,81 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
         yield* browser.checkpoint(
           "Workflow starts, results and termination with the linked account",
         );
-        yield* browser.use("Open webhooks", (page) =>
+        // Connecting Work replaces Personal in the app, and Personal stays saved.
+        const work = yield* connect("Work");
+        expect(yield* linkedAccountIds(actors.owner, path)).toEqual([work]);
+        expect(yield* accountStatus(personal)).toBe(200);
+        // Starts run with the linked account. An `accounts` field chooses nothing: the start still
+        // runs as Work, never as the unlinked Personal account.
+        const workCapture = yield* startCapture("work", { accounts: { service: [personal] } });
+        expect(workCapture.status, JSON.stringify(workCapture.body)).toBe(200);
+        expect(yield* waitForRun((yield* body(Run, workCapture)).id)).toMatchObject({
+          status: "complete",
+          output: { account: work, body: "work" },
+        });
+        // Runs started with the replaced Personal account stay in the history.
+        yield* browser.use("Open workflow history after replacing", (page) => page.goto(workflows));
+        yield* browser.use("Terminated history survives replacing", (page) =>
+          page.getByRole("button", { name: "View hold run: Terminated", exact: true }).waitFor(),
+        );
+        yield* browser.use("Completed history survives replacing", (page) =>
+          page
+            .getByRole("button", { name: "View capture run: Complete", exact: true })
+            .first()
+            .waitFor(),
+        );
+        yield* browser.checkpoint("Replaced account keeps resource history");
+        const runs = Effect.gen(function* () {
+          const listed = yield* api.request(actors.owner, "GET", `${path}/workflow-runs`);
+          expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+          return (yield* body(Schema.Struct({ items: Schema.Array(Run) }), listed)).items;
+        });
+        const history = (yield* runs).map((run) => [run.workflow, run.status]).sort();
+        expect(history).toEqual(
+          [
+            ["capture", "complete"],
+            ["capture", "complete"],
+            ["hold", "terminated"],
+          ].sort(),
+        );
+        // Unlinking keeps the account and its history; starts then need an account linked again.
+        yield* unlinkAccount(actors.owner, path, "service", work);
+        expect(yield* accountStatus(work)).toBe(200);
+        const unlinkedStart = yield* startCapture("unlinked");
+        expect(unlinkedStart.status, JSON.stringify(unlinkedStart.body)).toBe(409);
+        expect(unlinkedStart.body).toMatchObject({ _tag: "AccountRequired", slot: "service" });
+        expect((yield* runs).map((run) => [run.workflow, run.status]).sort()).toEqual(history);
+        // The unlink happened through the API, so the open page reloads to read the links again.
+        yield* browser.use("Open workflows after unlinking", (page) => page.goto(workflows));
+        yield* browser.use("Workflows ask for an account to be linked", (page) =>
           page
-            .getByRole("navigation", { name: "App navigation" })
-            .getByRole("link", { name: "Webhooks", exact: true })
-            .click(),
+            .getByText("Link an account in Accounts to start using this app.", { exact: true })
+            .waitFor(),
+        );
+        yield* browser.checkpoint("Unlinked app asks for an account");
+      }),
+    ),
+  );
+
+  it.effect(scenarios.groupedWebhookSources.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const actors = yield* Actors,
+          browser = yield* Browser;
+        const { app, path, connect, accountStatus } = yield* linkedApp(webhooksFixture);
+        const personal = yield* connect("Personal");
+        expect(yield* linkedAccountIds(actors.owner, path)).toEqual([personal]);
+        const settle = (expected: Parameters<typeof sourcesAre>[0]) =>
+          settleWebhookSources(actors.owner, path, sourcesAre(expected));
+        const subscriptions = webhookSubscriptions(actors.owner, path);
+        // The linked account becomes the app's webhook source; registration waits for configuration.
+        const needsConfiguration = { status: "needs-setup", failure: "configuration" };
+        const ready = { status: "ready", failure: null };
+        yield* settle({ [personal]: needsConfiguration });
+        yield* browser.login(actors.owner);
+        yield* browser.use("Open webhooks", (page) =>
+          page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=webhooks`),
         );
         const configure = (label: string, config: string) =>
           Effect.gen(function* () {
@@ -221,26 +309,16 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
             .map((hook) => [hook.name, hook.sourceAccount]),
         ).toEqual([["incoming", personal]]);
         yield* browser.checkpoint("The linked account configures its own webhook");
-        // The service requirement is plain, so connecting Work replaces Personal in the app.
-        // Personal stays saved; its webhook source stops and Work's waits for configuration.
+        // Connecting Work replaces Personal in the app. Personal stays saved; its webhook source
+        // stops and Work's waits for configuration.
         const work = yield* connect("Work");
         expect(yield* linkedAccountIds(actors.owner, path)).toEqual([work]);
-        expect(
-          (yield* api.request(actors.owner, "GET", `${prefix}/accounts/${personal}`)).status,
-        ).toBe(200);
+        expect(yield* accountStatus(personal)).toBe(200);
         yield* settle({ [work]: needsConfiguration });
         const replaced = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
           hooks.every((hook) => hook.sourceAccount !== personal || hook.status === "stopped"),
         );
         expect(replaced.filter((hook) => hook.status === "active")).toEqual([]);
-        // Starts run with the linked account. An `accounts` field chooses nothing: the start still
-        // runs as Work, never as the unlinked Personal account.
-        const workCapture = yield* startCapture("work", { accounts: { service: [personal] } });
-        expect(workCapture.status, JSON.stringify(workCapture.body)).toBe(200);
-        expect(yield* waitForRun((yield* body(Run, workCapture)).id)).toMatchObject({
-          status: "complete",
-          output: { account: work, body: "work" },
-        });
         yield* browser.use("Reload webhooks for the new link", (page) => page.reload());
         yield* configure("Work", '{"incoming":{"channel":"changed"}}');
         yield* settle({ [work]: ready });
@@ -255,38 +333,7 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
           ),
         ).toBe(0);
         yield* browser.checkpoint("The replacing account configures its own webhook");
-        // Runs started with the replaced Personal account stay in the history.
-        yield* browser.use("Open workflow history after replacing", (page) =>
-          page
-            .getByRole("navigation", { name: "App navigation" })
-            .getByRole("link", { name: "Workflows", exact: true })
-            .click(),
-        );
-        yield* browser.use("Terminated history survives replacing", (page) =>
-          page.getByRole("button", { name: "View hold run: Terminated", exact: true }).waitFor(),
-        );
-        yield* browser.use("Completed history survives replacing", (page) =>
-          page
-            .getByRole("button", { name: "View capture run: Complete", exact: true })
-            .first()
-            .waitFor(),
-        );
-        yield* browser.checkpoint("Replaced account keeps resource history");
-        const runs = Effect.gen(function* () {
-          const listed = yield* api.request(actors.owner, "GET", `${path}/workflow-runs`);
-          expect(listed.status, JSON.stringify(listed.body)).toBe(200);
-          return (yield* body(Schema.Struct({ items: Schema.Array(Run) }), listed)).items;
-        });
-        const history = (yield* runs).map((run) => [run.workflow, run.status]).sort();
-        expect(history).toEqual(
-          [
-            ["capture", "complete"],
-            ["capture", "complete"],
-            ["hold", "terminated"],
-          ].sort(),
-        );
-        // Unlinking keeps the account and its history but stops its webhook source; starts then
-        // need an account linked again.
+        // Unlinking keeps the account but stops its webhook source.
         yield* unlinkAccount(actors.owner, path, "service", work);
         yield* settle({});
         const after = yield* settleWebhookSubscriptions(actors.owner, path, (hooks) =>
@@ -295,23 +342,7 @@ layer(HostedLive, { excludeTestServices: true })("Grouped resources", (it) => {
         expect([...new Set(after.map((hook) => hook.sourceAccount))].sort()).toEqual(
           [personal, work].sort(),
         );
-        expect((yield* api.request(actors.owner, "GET", `${prefix}/accounts/${work}`)).status).toBe(
-          200,
-        );
-        const unlinkedStart = yield* startCapture("unlinked");
-        expect(unlinkedStart.status, JSON.stringify(unlinkedStart.body)).toBe(409);
-        expect(unlinkedStart.body).toMatchObject({ _tag: "AccountRequired", slot: "service" });
-        expect((yield* runs).map((run) => [run.workflow, run.status]).sort()).toEqual(history);
-        // The unlink happened through the API, so the open page reloads to read the links again.
-        yield* browser.use("Open workflows after unlinking", (page) =>
-          page.goto(`/org/${actors.organization.slug}/apps/${app.id}?view=workflows`),
-        );
-        yield* browser.use("Workflows ask for an account to be linked", (page) =>
-          page
-            .getByText("Link an account in Accounts to start using this app.", { exact: true })
-            .waitFor(),
-        );
-        yield* browser.checkpoint("Unlinked app asks for an account");
+        expect(yield* accountStatus(work)).toBe(200);
       }),
     ),
   );
diff --git a/e2e/tests/host-api-revision.spec.ts b/e2e/tests/host-api-revision.spec.ts
new file mode 100644
index 0000000000..1dbd4cb315
--- /dev/null
+++ b/e2e/tests/host-api-revision.spec.ts
@@ -0,0 +1,228 @@
+/**
+ * The Executor app reads this server's API through an app cache and kept tool listings named by
+ * the API's revision, the SHA-256 of the document the server generated. While a deployment rolls
+ * out, the API can serve another revision to the Workers that call apps, in either order: after a
+ * Cloud deploy, a new MCP Worker read the previous API's document and kept its tools under the new
+ * revision for a day. The app's network refuses a document whose SHA-256 is not the bound revision,
+ * so nothing is kept under the wrong name, the agent is told to retry shortly, and the next read
+ * fetches the document again.
+ *
+ * Only the self-host test entry point serves another revision, while its fixture is armed (see
+ * `apps/hosted/testing/api-document-fixture.ts`); the product binds the revision it generated. The
+ * scenario checks the app Worker's read during discovery, then, once the Executor app owns a
+ * database, the read of a tool call, which runs in the app's data facet.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Layer, Schedule, Schema } from "effect";
+import { scenarios } from "../test-plan.ts";
+import { Api, body, SessionClients } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Inventory } from "../support/contracts.ts";
+import { startDevelopmentServer } from "../support/managed-server.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { Target } from "../support/platform.ts";
+
+/** The test host's fixture; see `apps/hosted/testing/api-document-fixture.ts`. */
+const apiDocument = "/api/devtools/api-document";
+/** The suffix every operation of the fixture's revision carries. */
+const otherRevisionSuffix = "OtherRevision";
+/** What an agent is told while the app's network refuses the document. */
+const changing =
+  "The app reported that Executor’s API is changing (a deploy is in progress), so it could not load its tools.";
+
+const Users = Schema.Struct({
+  users: Schema.Array(Schema.Struct({ id: Schema.String, email: Schema.String })),
+});
+const Organizations = Schema.Array(Schema.Struct({ id: Schema.String }));
+const SearchInput = Schema.Record(Schema.String, Schema.Json);
+const SearchPage = Schema.Struct({
+  items: Schema.Array(Schema.Struct({ path: Schema.String })),
+  next: Schema.NullOr(SearchInput),
+  unavailableApps: Schema.Array(Schema.Struct({ app: Schema.String, reason: Schema.String })),
+});
+const Document = Schema.Struct({
+  paths: Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Unknown)),
+});
+const Operation = Schema.Struct({ operationId: Schema.String });
+const Source = Schema.Struct({
+  files: Schema.Array(Schema.Struct({ path: Schema.String, content: Schema.String })),
+});
+/** An unavailable app's reason, as MCP reports it to the agent. */
+const Reason = Schema.fromJsonString(
+  Schema.Struct({
+    code: Schema.String,
+    message: Schema.String,
+    recovery: Schema.Struct({ action: Schema.String }),
+    retryable: Schema.Boolean,
+  }),
+);
+const CallFailure = Schema.Struct({
+  _tag: Schema.String,
+  failure: Schema.Struct({ code: Schema.optional(Schema.String) }),
+  message: Schema.String,
+  recovery: Schema.Struct({ action: Schema.String }),
+});
+
+layer(HostedLive, { excludeTestServices: true })("Host API revision", (it) => {
+  it.effect(scenarios.hostApiRevision.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          mcp = yield* McpClient;
+        const origin = yield* startDevelopmentServer(target);
+        const api = yield* Api.pipe(
+          Effect.provide(Layer.fresh(Api.layer)),
+          Effect.provide(Layer.fresh(SessionClients.layer)),
+          Effect.provideService(Target, { ...target, metadata: { ...target.metadata, origin } }),
+        );
+        const owner = yield* api.session(),
+          headers = { origin };
+        const send = (method: "GET" | "POST" | "DELETE", path: string, payload?: unknown) =>
+          api.request(owner, method, `${origin}${path}`, payload, headers);
+        expect((yield* send("POST", "/api/devtools/operator", {})).status).toBe(200);
+        const directory = yield* body(Users, yield* send("GET", "/api/auth/admin/list-users"));
+        const developer = directory.users.find((user) => user.email === "agent-agent@example.test");
+        if (!developer) return yield* Effect.die("Development owner is missing");
+        expect(
+          (yield* send("POST", "/api/auth/admin/impersonate-user", { userId: developer.id }))
+            .status,
+        ).toBe(200);
+        const organization = (yield* body(
+          Organizations,
+          yield* send("GET", "/api/auth/organization/list"),
+        ))[0];
+        if (!organization) return yield* Effect.die("Development organization is missing");
+        const prefix = `/api/organizations/${organization.id}`;
+        // The organization's Executor app and its key are provisioned in the background.
+        const executor = yield* Effect.gen(function* () {
+          const inventory = yield* body(Inventory, yield* send("GET", `${prefix}/inventory`));
+          const app = inventory.apps.find((app) => app.slug === "executor");
+          if (app === undefined || !inventory.links.some((link) => link.app === app.id))
+            return yield* Effect.fail(new Error("Executor app provisioning is pending"));
+          return app;
+        }).pipe(Effect.retry({ times: 40, schedule: Schedule.spaced("250 millis") }));
+        const serve = (other: boolean) =>
+          send(other ? "POST" : "DELETE", apiDocument).pipe(
+            Effect.map((response) => expect(response.status).toBe(200)),
+          );
+        // A failed assertion must not leave the other revision served.
+        yield* Effect.addFinalizer(() => serve(false).pipe(Effect.orDie));
+        const key = yield* body(
+          Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
+          yield* send("POST", "/api/auth/api-key/create", { name: "Host API revision" }),
+        );
+        const client = yield* mcp.connect(key.key, "host-api-revision", {
+          organization: organization.id,
+          origin,
+        });
+        /** Every tool the Executor app lists, and the apps search could not load. */
+        const list = (label: string) =>
+          Effect.gen(function* () {
+            const paths: string[] = [];
+            const unavailable: { app: string; reason: string }[] = [];
+            let input: typeof SearchInput.Type = { namespace: "executor", limit: 50 };
+            for (;;) {
+              const page = yield* client
+                .use(label, (client, signal) =>
+                  client.callTool({ name: "search", arguments: input }, undefined, { signal }),
+                )
+                .pipe(
+                  Effect.flatMap((result) =>
+                    Schema.decodeUnknownEffect(SearchPage)(result.structuredContent),
+                  ),
+                );
+              paths.push(...page.items.map((item) => item.path));
+              unavailable.push(...page.unavailableApps);
+              if (page.next === null) return { paths, unavailable };
+              input = page.next;
+            }
+          });
+        const otherRevision = (paths: ReadonlyArray<string>) =>
+          paths.filter((path) => path.endsWith(otherRevisionSuffix));
+
+        // Served another revision from the first read, the app's document load is refused: it
+        // lists none of that revision's tools and the agent is told to retry shortly.
+        yield* serve(true);
+        const refused = yield* list("List the Executor app while another revision is served");
+        expect(refused.paths, JSON.stringify(refused)).toEqual([]);
+        expect(
+          refused.unavailable.map((entry) => entry.app),
+          JSON.stringify(refused),
+        ).toEqual([executor.id]);
+        const reason = yield* Schema.decodeUnknownEffect(Reason)(refused.unavailable[0]?.reason);
+        expect(reason).toEqual({
+          code: "AppEvaluationFailed",
+          message: changing,
+          recovery: { action: "Retry shortly." },
+          retryable: true,
+        });
+
+        // Served its own revision, the first read lists the API's tools and none of the other
+        // revision's: the refused read kept nothing that stands in for them.
+        yield* serve(false);
+        const listed = yield* list("List the Executor app while its own revision is served");
+        expect(listed.unavailable, JSON.stringify(listed)).toEqual([]);
+        expect(listed.paths, JSON.stringify(listed)).toEqual(
+          expect.arrayContaining([expect.stringMatching(/^tools\.executor\.appAccounts\./)]),
+        );
+        expect(otherRevision(listed.paths)).toEqual([]);
+
+        // An Executor app that owns a database runs its tool calls in its data facet, whose network
+        // is bound to the revision as the app Worker's is.
+        const appPath = `${prefix}/apps/${executor.id}`;
+        const source = yield* body(Source, yield* send("GET", `${appPath}/source`));
+        const deployed = yield* send("POST", `${appPath}/deploy`, {
+          files: [
+            ...source.files,
+            {
+              path: "migrations/0001_host_api_revision.sql",
+              content: "CREATE TABLE host_api_revision (id TEXT PRIMARY KEY);",
+            },
+          ],
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        // A read the served document declares, which the app lists as a query.
+        const document = yield* body(Document, yield* send("GET", "/openapi.json"));
+        const reads = new Set(
+          Object.values(document.paths).flatMap((methods) =>
+            Schema.is(Operation)(methods.get) ? [methods.get.operationId] : [],
+          ),
+        );
+        const tool = listed.paths
+          .map((path) => path.replace(/^tools\.executor\./, ""))
+          .find((name) => reads.has(name));
+        if (tool === undefined) return yield* Effect.die("The Executor app lists no read");
+
+        // Its new version's cache is empty, so the call's facet reads the document, and refuses
+        // the other revision. No kept listing confirms the tool only reads, so the call may have
+        // written before it failed: it says the API is changing but is not offered as a retry.
+        yield* serve(true);
+        const call = yield* send("POST", `${appPath}/tools/call`, {
+          tool,
+          kind: "query",
+          input: {},
+        });
+        expect(call.status, JSON.stringify(call.body)).toBe(502);
+        expect(yield* body(CallFailure, call)).toEqual({
+          _tag: "AppEvaluationFailed",
+          failure: { code: "EXECUTOR_API_CHANGING" },
+          message: changing,
+          recovery: {
+            action:
+              "Do not automatically repeat this call or duplicate its change. Executor could not confirm its outcome.",
+          },
+        });
+
+        // The facet kept nothing either: the first listing of its own revision is the API's.
+        yield* serve(false);
+        const after = yield* list("List the database-owning Executor app");
+        expect(after.unavailable, JSON.stringify(after)).toEqual([]);
+        expect(after.paths, JSON.stringify(after)).toEqual(
+          expect.arrayContaining([expect.stringMatching(/^tools\.executor\.appAccounts\./)]),
+        );
+        expect(otherRevision(after.paths)).toEqual([]);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+});
diff --git a/e2e/tests/hosted-app-accounts.spec.ts b/e2e/tests/hosted-app-accounts.spec.ts
index 7ec7cace0f..1267662fbb 100644
--- a/e2e/tests/hosted-app-accounts.spec.ts
+++ b/e2e/tests/hosted-app-accounts.spec.ts
@@ -28,6 +28,12 @@ import {
 } from "../support/hosted-app-accounts.ts";
 import { scenarios } from "../test-plan.ts";
 import { McpClient } from "../support/mcp-client.ts";
+import { siteless } from "../support/failure-site.ts";
+
+/** A tool result's text content. */
+const TextContent = Schema.Array(
+  Schema.Struct({ type: Schema.Literal("text"), text: Schema.String }),
+);
 
 const Failure = Schema.Struct({ _tag: Schema.String });
 const AccountDetail = Schema.Struct({ account: Resource });
@@ -613,7 +619,12 @@ export default defineApp({ user: { accounts: { other } } }, {});`,
           const refused = yield* skills(step, input);
           expect(refused.isError, JSON.stringify(refused)).toBe(true);
           // The skills tool's error text names AccountChoiceUnsupported's code and status.
-          expect(refused.content).toEqual([{ type: "text", text: accountChoiceUnsupported }]);
+          expect(
+            Schema.decodeUnknownSync(TextContent)(refused.content).map((item) => ({
+              ...item,
+              text: siteless(item.text),
+            })),
+          ).toEqual([{ type: "text", text: accountChoiceUnsupported }]);
         }
         const listed = yield* skills("List the app's skills", { app: app.slug });
         expect(listed.isError, JSON.stringify(listed)).not.toBe(true);
diff --git a/e2e/tests/hosted-shared.spec.ts b/e2e/tests/hosted-shared.spec.ts
index 68a8dc1ae8..24f09881ad 100644
--- a/e2e/tests/hosted-shared.spec.ts
+++ b/e2e/tests/hosted-shared.spec.ts
@@ -164,7 +164,7 @@ layer(HostedLive, { excludeTestServices: true })("Hosted parity", (it) => {
           page.goto(`/org/${actors.organization.slug}/apps`),
         );
         yield* browser.use("Owner can add apps", (page) =>
-          page.getByRole("link", { name: "Add app", exact: true }).waitFor({ state: "visible" }),
+          page.getByRole("button", { name: "Add app", exact: true }).waitFor({ state: "visible" }),
         );
         yield* evidence.step(
           "Signed-out requests cannot read the organization",
@@ -292,7 +292,9 @@ layer(HostedLive, { excludeTestServices: true })("Hosted parity", (it) => {
               .waitFor({ state: "visible" }),
           );
           yield* browser.use(`${role} has the correct Add permission`, (page) =>
-            page.getByRole("link", { name: "Add app", exact: true }).waitFor({ state: "visible" }),
+            page
+              .getByRole("button", { name: "Add app", exact: true })
+              .waitFor({ state: "visible" }),
           );
           yield* browser.checkpoint(`${role} dashboard on the hosted target`);
         }
diff --git a/e2e/tests/hosted.spec.ts b/e2e/tests/hosted.spec.ts
index 4f2a6d00b9..282c538604 100644
--- a/e2e/tests/hosted.spec.ts
+++ b/e2e/tests/hosted.spec.ts
@@ -69,7 +69,9 @@ layer(HostedLive, { excludeTestServices: true })("Self-host", (it) => {
             page.waitForURL(`**/org/${actors.organization.slug}/apps`),
           );
           yield* browser.use(`${role} has the correct Add permission`, (page) =>
-            page.getByRole("link", { name: "Add app", exact: true }).waitFor({ state: "visible" }),
+            page
+              .getByRole("button", { name: "Add app", exact: true })
+              .waitFor({ state: "visible" }),
           );
           yield* browser.checkpoint(`${role} signed in through self-host password login`);
         }
diff --git a/e2e/tests/idle-poll-traces.spec.ts b/e2e/tests/idle-poll-traces.spec.ts
new file mode 100644
index 0000000000..71a227a4a4
--- /dev/null
+++ b/e2e/tests/idle-poll-traces.spec.ts
@@ -0,0 +1,300 @@
+/**
+ * An idle server's frequent polls export nothing; a job a poll finds is still traced, and so is a
+ * poll that fails, with the statement that failed.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Clock, Effect, FileSystem, Layer, Schedule, Schema } from "effect";
+import { HttpClient } from "effect/http";
+import { Api, SessionClients } from "../support/api.ts";
+import { TestLive, withCase } from "../support/case.ts";
+import { SpanQuery } from "../support/contracts.ts";
+import { startControlledSelfHost, startFreshSelfHost } from "../support/managed-server.ts";
+import { serveOtlpCollector } from "../support/otlp-collector.ts";
+import { Target } from "../support/platform.ts";
+import { Evidence } from "../support/evidence.ts";
+import { legacyStorage } from "../support/legacy-storage.ts";
+import { serverControl } from "../support/server-control.ts";
+import { scenarios } from "../test-plan.ts";
+
+/** The scheduler and provisioning poll every second and event delivery every two. */
+const idleWindow = "10 seconds";
+/** The product exports spans every second. */
+const exportDelay = "3 seconds";
+/** Tables only these polls read while nobody calls the server. */
+const polled = [
+  "executor_scheduled_runs",
+  "executor_schedules",
+  "hosted_provisioning",
+  "executor_event_deliveries",
+  "executor_event_subscriptions",
+];
+/** Spans only the event delivery pass starts. */
+const passes = new Set(["events.dispatch", "sdk.events.deliver"]);
+
+/** Spans in `collector` that started in [from, to), newest first; Motel answers at most 500 a search. */
+const exported = (collector: string, from: number, to: number, operation?: string) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    return yield* Effect.scoped(
+      Effect.gen(function* () {
+        const url = new URL("/api/spans/search", collector);
+        if (operation !== undefined) url.searchParams.set("operation", operation);
+        url.searchParams.set("lookback", "1h");
+        url.searchParams.set("limit", "10000");
+        const response = yield* http.get(url.href);
+        return yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SpanQuery)));
+      }),
+    ).pipe(
+      Effect.map(({ data }) =>
+        data.filter(({ span }) => {
+          const at = Date.parse(span.startTime);
+          return at >= from && at < to;
+        }),
+      ),
+    );
+  });
+
+/** What a root records beside its failure: the statement that failed. */
+const detail = (tags: Readonly<Record<string, string>>) =>
+  Object.fromEntries(Object.entries(tags).filter(([key]) => key.startsWith("executor.storage.")));
+/** Each failing poll's own trace: a root span, failed, with the failure it recorded. */
+const failedRoots = (spans: typeof SpanQuery.Type.data) =>
+  spans
+    .filter(({ span }) => span.parentSpanId === null && span.status === "error")
+    .map(({ span }) => ({
+      operation: span.operationName,
+      exception: span.events.find(({ name }) => name === "exception")?.attributes ?? {},
+      detail: detail(span.tags),
+    }));
+/** The failure type each failing poll's root recorded, by its operation. */
+const failureTypes = (roots: ReturnType<typeof failedRoots>) =>
+  Object.fromEntries(
+    roots.map(({ operation, exception }) => [operation, exception["exception.type"]]),
+  );
+/** The roots `operation` exported, oldest first. */
+const of = <A extends { readonly operation: string }>(roots: ReadonlyArray<A>, operation: string) =>
+  roots.filter((root) => root.operation === operation).reverse();
+
+layer(TestLive, { excludeTestServices: true })("Idle poll traces", (it) => {
+  it.effect(scenarios.idlePollTraces.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          fs = yield* FileSystem.FileSystem,
+          evidence = yield* Evidence;
+        // The server's only collector, so every span in it is the server's.
+        const directory = yield* fs.makeTempDirectory({
+          directory: target.directory,
+          prefix: "collector",
+        });
+        const collector = yield* serveOtlpCollector(directory);
+        const origin = yield* startFreshSelfHost(target, {
+          OTEL_EXPORTER_OTLP_ENDPOINT: collector,
+        });
+        const spans = (from: number, to: number, operation?: string) =>
+          exported(collector, from, to, operation);
+
+        // Startup's one-off steps finish first; then nothing is due and no one calls.
+        yield* Effect.sleep("5 seconds");
+        const idleFrom = yield* Clock.currentTimeMillis;
+        yield* Effect.sleep(idleWindow);
+        const idleTo = yield* Clock.currentTimeMillis;
+        yield* Effect.sleep(exportDelay);
+        const idle = yield* spans(idleFrom, idleTo);
+        const polls = idle.filter(
+          ({ span }) =>
+            passes.has(span.operationName) ||
+            polled.some((table) => (span.tags["db.query.text"] ?? "").includes(table)),
+        );
+        yield* evidence.json(
+          "idle-poll-spans.json",
+          polls.map(({ traceId, span }) => ({
+            traceId,
+            operation: span.operationName,
+            query: span.tags["db.query.text"],
+          })),
+        );
+        expect(
+          new Set(polls.map(({ traceId }) => traceId)).size,
+          "Idle polls for due runs, queued jobs and event deliveries export no traces",
+        ).toBe(0);
+
+        // First-admin setup queues the owner's member setup. The poll that finds the job records
+        // nothing of its own, so the job's trace is a root.
+        const api = yield* Api.pipe(
+          Effect.provide(Layer.fresh(Api.layer)),
+          Effect.provide(Layer.fresh(SessionClients.layer)),
+          Effect.provideService(Target, { ...target, metadata: { ...target.metadata, origin } }),
+        );
+        const owner = yield* api.session();
+        const setupFrom = yield* Clock.currentTimeMillis;
+        expect(
+          (yield* api.request(owner, "POST", "/api/auth/self-host/setup", {
+            name: "Idle Owner",
+            email: "idle-owner@example.test",
+            password: "Synthetic-idle-password-123!",
+            organizationName: "Idle lab",
+          })).status,
+        ).toBe(200);
+        const jobs = yield* spans(setupFrom, Number.MAX_SAFE_INTEGER, "hosted.provision").pipe(
+          Effect.map((found) => found.filter(({ span }) => span.parentSpanId === null)),
+          Effect.filterOrFail(
+            (found) => found.length > 0,
+            () => new Error("No provisioning job the poll found has been exported yet"),
+          ),
+          Effect.retry({ schedule: Schedule.spaced("1 second"), times: 20 }),
+        );
+        yield* evidence.json(
+          "polled-jobs.json",
+          jobs.map(({ traceId, span }) => ({ traceId, tags: span.tags })),
+        );
+      }),
+    ),
+  );
+
+  it.effect(scenarios.failedPollTraces.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          fs = yield* FileSystem.FileSystem,
+          evidence = yield* Evidence;
+        const directory = yield* fs.makeTempDirectory({
+          directory: target.directory,
+          prefix: "collector",
+        });
+        const collector = yield* serveOtlpCollector(directory);
+        const instance = yield* startControlledSelfHost(target, {
+          OTEL_EXPORTER_OTLP_ENDPOINT: collector,
+        });
+        /** Restart the stopped instance over `statements` and return the failed roots it exports. */
+        const failingAfter = (
+          statements: Parameters<typeof legacyStorage>[0],
+          expected: Readonly<Record<string, string>>,
+        ) =>
+          Effect.gen(function* () {
+            yield* legacyStorage(statements);
+            const from = yield* Clock.currentTimeMillis;
+            yield* serverControl("start");
+            // Each poll runs every one or two seconds and the product exports every second.
+            return yield* exported(collector, from, Number.MAX_SAFE_INTEGER).pipe(
+              Effect.map(failedRoots),
+              Effect.repeat({
+                schedule: Schedule.spaced("1 second"),
+                until: (found) =>
+                  Object.keys(expected).every((name) => name in failureTypes(found)),
+                times: 20,
+              }),
+            );
+          }).pipe(Effect.provideService(Target, instance));
+
+        // Each poll reads a column that is no longer there.
+        const polls = {
+          "events.dispatch": "StorageError",
+          "schedule.dispatch": "StorageError",
+          "hosted.provisioning.poll": "SqlError",
+        };
+        const broken = yield* failingAfter(
+          [
+            {
+              sql: "ALTER TABLE executor_event_subscriptions RENAME COLUMN expires_at TO broken_expires_at",
+            },
+            { sql: "ALTER TABLE executor_schedules RENAME COLUMN next_at TO broken_next_at" },
+            {
+              sql: "ALTER TABLE hosted_provisioning RENAME COLUMN available_at TO broken_available_at",
+            },
+          ],
+          polls,
+        );
+        expect(
+          failureTypes(broken),
+          "Each failing poll exports its failure as a root span",
+        ).toMatchObject(polls);
+        yield* evidence.json("failed-polls.json", broken);
+        // The root says which statement failed and how, though the poll only sees a StorageError.
+        const subscriptions = of(broken, "events.dispatch")[0]?.detail;
+        expect(subscriptions, "The event poll names its failed statement").toMatchObject({
+          "executor.storage.operation": "findMany",
+          "executor.storage.table": "eventSubscriptions",
+          "executor.storage.reason": "SqlSyntaxError",
+        });
+        expect(of(broken, "schedule.dispatch")[0]?.detail).toMatchObject({
+          "executor.storage.operation": "findMany",
+          "executor.storage.table": "schedules",
+          "executor.storage.reason": "SqlSyntaxError",
+        });
+
+        // A different statement of the same poll fails: its root says which.
+        const deliveries = yield* failingAfter(
+          [
+            {
+              sql: "ALTER TABLE executor_event_subscriptions RENAME COLUMN broken_expires_at TO expires_at",
+            },
+            {
+              sql: "ALTER TABLE executor_event_deliveries RENAME COLUMN next_at TO broken_next_at",
+            },
+          ],
+          { "events.dispatch": "StorageError" },
+        );
+        const due = of(deliveries, "events.dispatch")[0]?.detail;
+        yield* evidence.json("failed-statements.json", { subscriptions, due });
+        expect(due, "The event poll names the other failed statement").toMatchObject({
+          "executor.storage.operation": "findMany",
+          "executor.storage.table": "eventDeliveries",
+          "executor.storage.reason": "SqlSyntaxError",
+        });
+        expect(due).not.toEqual(subscriptions);
+
+        // Event delivery reads again, but claiming a due delivery and retention both fail. Both
+        // are caught inside a pass that otherwise succeeds.
+        const steps = {
+          "sdk.events.claim": "StorageError",
+          "sdk.events.retention": "StorageError",
+        };
+        const caught = yield* failingAfter(
+          [
+            {
+              sql: "ALTER TABLE executor_event_deliveries RENAME COLUMN broken_next_at TO next_at",
+            },
+            {
+              sql: `INSERT INTO executor_event_deliveries
+                (id, subscription, event, status, attempts, next_at, lease, lease_until, created_at)
+                VALUES ('due-delivery', 'synthetic-subscription', 'synthetic-event', 'pending', 0, now(), NULL, '1970-01-01', now())`,
+            },
+            {
+              sql: `CREATE FUNCTION refuse_claim() RETURNS trigger LANGUAGE plpgsql AS $$
+                BEGIN IF NEW.lease IS NOT NULL THEN RAISE EXCEPTION 'synthetic claim failure'; END IF; RETURN NEW; END $$`,
+            },
+            {
+              sql: "CREATE TRIGGER refuse_claim BEFORE UPDATE ON executor_event_deliveries FOR EACH ROW EXECUTE FUNCTION refuse_claim()",
+            },
+            {
+              sql: `CREATE FUNCTION refuse_retention() RETURNS trigger LANGUAGE plpgsql AS $$
+                BEGIN RAISE EXCEPTION 'synthetic retention failure'; END $$`,
+            },
+            {
+              sql: "CREATE TRIGGER refuse_retention BEFORE DELETE ON executor_events FOR EACH STATEMENT EXECUTE FUNCTION refuse_retention()",
+            },
+          ],
+          steps,
+        );
+        expect(
+          failureTypes(caught),
+          "A failing claim and retention each export a root span",
+        ).toMatchObject(steps);
+        yield* evidence.json("failed-steps.json", caught);
+        expect(of(caught, "sdk.events.claim")[0]?.detail).toMatchObject({
+          "executor.storage.operation": "updateMany",
+          "executor.storage.table": "eventDeliveries",
+          "executor.storage.reason": "UnknownError",
+        });
+        expect(of(caught, "sdk.events.retention")[0]?.detail).toMatchObject({
+          "executor.storage.operation": "deleteMany",
+          "executor.storage.table": "events",
+          "executor.storage.reason": "UnknownError",
+        });
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/large-openapi-app.spec.ts b/e2e/tests/large-openapi-app.spec.ts
index 1ce630a67f..693bfea72a 100644
--- a/e2e/tests/large-openapi-app.spec.ts
+++ b/e2e/tests/large-openapi-app.spec.ts
@@ -110,150 +110,164 @@ const ownDefinitions = (schema: typeof JsonSchemaDocument.Type | undefined) => {
 };
 
 layer(HostedLive, { excludeTestServices: true })("Large OpenAPI app", (it) => {
-  it.effect(scenarios.largeOpenapiExpandableApp.title, (context) =>
-    withHostedCase(
-      context,
-      Effect.gen(function* () {
-        const api = yield* Api,
-          actors = yield* Actors,
-          evidence = yield* Evidence,
-          mcp = yield* McpClient;
-        const origin = (yield* Target).metadata.origin;
-        const configuration = JSON.stringify({
-          source: {
-            document: expandableOpenapiDocument(origin, expandableResources, expandableOperations),
-          },
-          allowedOrigin: origin,
-          securitySchemes: {},
-          methods: {},
-          oauth: [],
-        });
-        yield* evidence.json("expandable-openapi-source.json", { bytes: configuration.length });
+  it.effect(
+    scenarios.largeOpenapiExpandableApp.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors,
+            evidence = yield* Evidence,
+            mcp = yield* McpClient;
+          const origin = (yield* Target).metadata.origin;
+          const configuration = JSON.stringify({
+            source: {
+              document: expandableOpenapiDocument(
+                origin,
+                expandableResources,
+                expandableOperations,
+              ),
+            },
+            allowedOrigin: origin,
+            securitySchemes: {},
+            methods: {},
+            oauth: [],
+          });
+          yield* evidence.json("expandable-openapi-source.json", { bytes: configuration.length });
 
-        const prefix = `/api/organizations/${actors.organization.id}/apps`;
-        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/deploy`, {
-          name: `Expandable OpenAPI ${randomUUID().slice(0, 8)}`,
-          files: [
-            { path: "index.ts", content: index },
-            { path: "openapi.json", content: configuration },
-            appsManifest,
-          ],
-        });
-        expect(deployed.status, JSON.stringify(deployed.body).slice(0, 2000)).toBe(200);
-        const app = yield* body(App, deployed);
-        const path = `${prefix}/${app.id}`;
-        yield* Effect.addFinalizer(() =>
-          api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
-        );
+          const prefix = `/api/organizations/${actors.organization.id}/apps`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/deploy`, {
+            name: `Expandable OpenAPI ${randomUUID().slice(0, 8)}`,
+            files: [
+              { path: "index.ts", content: index },
+              { path: "openapi.json", content: configuration },
+              appsManifest,
+            ],
+          });
+          expect(deployed.status, JSON.stringify(deployed.body).slice(0, 2000)).toBe(200);
+          const app = yield* body(App, deployed);
+          const path = `${prefix}/${app.id}`;
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
+          );
 
-        // The listing evaluates the whole catalog. Each page stays within the page bound, and
-        // each tool's schemas are complete on their own, as an agent reads them.
-        const first = yield* api.request(actors.owner, "GET", `${path}/tools`);
-        yield* evidence.json("expandable-openapi-first-page.json", {
-          status: first.status,
-          characters: JSON.stringify(first.body).length,
-          body: first.status === 200 ? undefined : first.body,
-        });
-        expect(first.status, JSON.stringify(first.body).slice(0, 2000)).toBe(200);
-        // The body as sent: the server writes it as `JSON.stringify` does, so encoding the parsed
-        // body again gives back its text.
-        expect(JSON.stringify(first.body).length).toBeLessThanOrEqual(pageChars);
-        const page = yield* body(ToolPage, first);
-        expect(page.items.length).toBeGreaterThan(1);
-        expect(page.items.length).toBeLessThan(expandableOperations);
-        expect(page.next).toBeDefined();
-        const resources = page.items.filter((tool) => tool.name.startsWith("resources."));
-        expect(resources.length).toBeGreaterThan(0);
-        for (const tool of resources)
-          expect(ownDefinitions(tool.outputSchema)).toHaveLength(expandableResources);
+          // The listing evaluates the whole catalog. Each page stays within the page bound, and
+          // each tool's schemas are complete on their own, as an agent reads them.
+          const first = yield* api.request(actors.owner, "GET", `${path}/tools`);
+          // The body as sent: the server writes it as `JSON.stringify` does, so encoding the parsed
+          // body again gives back its text. Each page is encoded once: at 16 MB, another encoding
+          // adds about a tenth to the walk.
+          const firstText = JSON.stringify(first.body);
+          yield* evidence.json("expandable-openapi-first-page.json", {
+            status: first.status,
+            characters: firstText.length,
+            body: first.status === 200 ? undefined : first.body,
+          });
+          expect(first.status, firstText.slice(0, 2000)).toBe(200);
+          expect(firstText.length).toBeLessThanOrEqual(pageChars);
+          const page = yield* body(ToolPage, first);
+          expect(page.items.length).toBeGreaterThan(1);
+          expect(page.items.length).toBeLessThan(expandableOperations);
+          expect(page.next).toBeDefined();
+          const resources = page.items.filter((tool) => tool.name.startsWith("resources."));
+          expect(resources.length).toBeGreaterThan(0);
+          for (const tool of resources)
+            expect(ownDefinitions(tool.outputSchema)).toHaveLength(expandableResources);
 
-        // The index names every tool.
-        const listed = yield* body(
-          ToolIndex,
-          yield* api.request(actors.owner, "GET", `${path}/tools/index`),
-        );
-        expect(listed.items).toHaveLength(expandableOperations + 1);
+          // The index names every tool.
+          const listed = yield* body(
+            ToolIndex,
+            yield* api.request(actors.owner, "GET", `${path}/tools/index`),
+          );
+          expect(listed.items).toHaveLength(expandableOperations + 1);
+
+          // Following `next` to the end lists every tool once, each page within the bound and
+          // continuing after the page before it.
+          const last = page.items.at(-1)?.name ?? "";
+          const paged = page.items.map((tool) => tool.name);
+          let next = page.next;
+          while (next !== undefined) {
+            expect(paged.length).toBeLessThanOrEqual(expandableOperations + 1);
+            const response = yield* api.request(
+              actors.owner,
+              "GET",
+              `${path}/tools?cursor=${encodeURIComponent(next)}`,
+            );
+            const text = JSON.stringify(response.body);
+            expect(response.status, text.slice(0, 2000)).toBe(200);
+            expect(text.length).toBeLessThanOrEqual(pageChars);
+            const following = yield* body(ToolPage, response);
+            expect(following.items.length).toBeGreaterThan(0);
+            const previous = paged.at(-1) ?? "";
+            for (const tool of following.items) expect(tool.name > previous).toBe(true);
+            paged.push(...following.items.map((tool) => tool.name));
+            next = following.next;
+          }
+          yield* evidence.json("expandable-openapi-pages.json", { tools: paged.length });
+          expect(new Set(paged).size).toBe(paged.length);
+          expect([...paged].sort()).toEqual(listed.items.map((tool) => tool.name).sort());
 
-        // Following `next` to the end lists every tool once, each page within the bound and
-        // continuing after the page before it.
-        const last = page.items.at(-1)?.name ?? "";
-        const paged = page.items.map((tool) => tool.name);
-        let next = page.next;
-        while (next !== undefined) {
-          expect(paged.length).toBeLessThanOrEqual(expandableOperations + 1);
-          const response = yield* api.request(
+          // The last tool reads with its whole schema.
+          const lastTool =
+            listed.items
+              .map((tool) => tool.name)
+              .filter((name) => name.startsWith("resources."))
+              .sort()
+              .at(-1) ?? "";
+          expect(lastTool > last).toBe(true);
+          const described = yield* api.request(
             actors.owner,
             "GET",
-            `${path}/tools?cursor=${encodeURIComponent(next)}`,
+            `${path}/tools/${encodeURIComponent(lastTool)}`,
+          );
+          expect(described.status, JSON.stringify(described.body).slice(0, 2000)).toBe(200);
+          expect(ownDefinitions((yield* body(ListedTool, described)).outputSchema)).toHaveLength(
+            expandableResources,
           );
-          expect(response.status, JSON.stringify(response.body).slice(0, 2000)).toBe(200);
-          expect(JSON.stringify(response.body).length).toBeLessThanOrEqual(pageChars);
-          const following = yield* body(ToolPage, response);
-          expect(following.items.length).toBeGreaterThan(0);
-          const previous = paged.at(-1) ?? "";
-          for (const tool of following.items) expect(tool.name > previous).toBe(true);
-          paged.push(...following.items.map((tool) => tool.name));
-          next = following.next;
-        }
-        yield* evidence.json("expandable-openapi-pages.json", { tools: paged.length });
-        expect(new Set(paged).size).toBe(paged.length);
-        expect([...paged].sort()).toEqual(listed.items.map((tool) => tool.name).sort());
-
-        // The last tool reads with its whole schema.
-        const lastTool =
-          listed.items
-            .map((tool) => tool.name)
-            .filter((name) => name.startsWith("resources."))
-            .sort()
-            .at(-1) ?? "";
-        expect(lastTool > last).toBe(true);
-        const described = yield* api.request(
-          actors.owner,
-          "GET",
-          `${path}/tools/${encodeURIComponent(lastTool)}`,
-        );
-        expect(described.status, JSON.stringify(described.body).slice(0, 2000)).toBe(200);
-        expect(ownDefinitions((yield* body(ListedTool, described)).outputSchema)).toHaveLength(
-          expandableResources,
-        );
 
-        // MCP search ranks the app's tools rather than reporting the app unavailable.
-        const key = yield* body(
-          Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
-          yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
-            name: "Expandable OpenAPI",
-          }),
-        );
-        yield* Effect.addFinalizer(() =>
-          api
-            .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id })
-            .pipe(Effect.orDie),
-        );
-        const client = yield* mcp.connect(key.key, "expandable-openapi", {
-          organization: actors.organization.id,
-        });
-        const searched = yield* client.use("Search the expandable app", (client, signal) =>
-          client.callTool(
-            {
-              name: "search",
-              arguments: { namespace: app.slug, query: "getResource137View1" },
-            },
-            undefined,
-            { signal },
-          ),
-        );
-        yield* evidence.json("expandable-openapi-search.json", searched.structuredContent);
-        const found = yield* Schema.decodeUnknownEffect(SearchResult)(searched.structuredContent);
-        expect(
-          found.items.some(
-            (item) =>
-              item.path.includes(JSON.stringify(app.slug)) &&
-              item.path.endsWith(".getResource137View1"),
-          ),
-          JSON.stringify(found.items.map((item) => item.path)),
-        ).toBe(true);
-      }).pipe(Effect.provide(McpClient.layer)),
-    ),
+          // MCP search ranks the app's tools rather than reporting the app unavailable.
+          const key = yield* body(
+            Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
+            yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+              name: "Expandable OpenAPI",
+            }),
+          );
+          yield* Effect.addFinalizer(() =>
+            api
+              .request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+              .pipe(Effect.orDie),
+          );
+          const client = yield* mcp.connect(key.key, "expandable-openapi", {
+            organization: actors.organization.id,
+          });
+          const searched = yield* client.use("Search the expandable app", (client, signal) =>
+            client.callTool(
+              {
+                name: "search",
+                arguments: { namespace: app.slug, query: "getResource137View1" },
+              },
+              undefined,
+              { signal },
+            ),
+          );
+          yield* evidence.json("expandable-openapi-search.json", searched.structuredContent);
+          const found = yield* Schema.decodeUnknownEffect(SearchResult)(searched.structuredContent);
+          expect(
+            found.items.some(
+              (item) =>
+                item.path.includes(JSON.stringify(app.slug)) &&
+                item.path.endsWith(".getResource137View1"),
+            ),
+            JSON.stringify(found.items.map((item) => item.path)),
+          ).toBe(true);
+        }).pipe(Effect.provide(McpClient.layer)),
+      ),
+    // Following `next` reads about 140 pages of 16 MB, one after another. Self-host CI runs the
+    // scenario in 25 to 58 seconds, but a busy runner took 0.68 seconds a page, about 110 seconds
+    // in all. A deployed stage answers a page in 1.1 to 2.1 seconds, 1.55 at the median of 55 runs,
+    // so the walk alone takes 2.5 to 5 minutes there.
+    { timeout: 360_000 },
   );
 
   it.effect(scenarios.largeOpenapiApp.title, (context) =>
diff --git a/e2e/tests/legacy-profile-schedules.spec.ts b/e2e/tests/legacy-profile-schedules.spec.ts
index 84599ee6d0..ec29a03692 100644
--- a/e2e/tests/legacy-profile-schedules.spec.ts
+++ b/e2e/tests/legacy-profile-schedules.spec.ts
@@ -628,7 +628,7 @@ layer(HostedLive, { excludeTestServices: true })("Legacy profile schedules", (it
           { sql: "SELECT id, status FROM executor_profile_app_copies ORDER BY id" },
         ]);
         expect(ledger).toEqual([{ name: "app_account_links" }]);
-        expect(version).toEqual([{ value: "4.0.15" }]);
+        expect(version).toEqual([{ value: "4.0.16" }]);
         expect(plans).toEqual(
           [copies.work, copies.bobOld].toSorted().map((copy) => ({ id: copy, status: "copied" })),
         );
diff --git a/e2e/tests/legacy-targetless-connections.spec.ts b/e2e/tests/legacy-targetless-connections.spec.ts
index c1e9767386..4ee05fa5fd 100644
--- a/e2e/tests/legacy-targetless-connections.spec.ts
+++ b/e2e/tests/legacy-targetless-connections.spec.ts
@@ -132,7 +132,7 @@ const expectUpgraded = (
   ids: Ids,
 ) => {
   expect(column).toEqual([{ is_nullable: "NO", column_default: null }]);
-  expect(version).toEqual([{ value: "4.0.15" }]);
+  expect(version).toEqual([{ value: "4.0.16" }]);
   // Only the connection with a target is left, and only the sign-in no connection pointed at.
   expect(connections).toEqual([{ id: template, target: "object" }]);
   expect(attempts).toEqual([{ id: ids.unrelatedAttempt }]);
diff --git a/e2e/tests/live-openapi-import.spec.ts b/e2e/tests/live-openapi-import.spec.ts
index 914b792b9b..e94f08bbb2 100644
--- a/e2e/tests/live-openapi-import.spec.ts
+++ b/e2e/tests/live-openapi-import.spec.ts
@@ -13,7 +13,9 @@ import {
   malformedSwaggerDocument,
   openapi32Upstream,
   otherHostDocument,
+  requestEchoUpstream,
   unsupportedAuthDocument,
+  v1Document,
 } from "../support/openapi-import.ts";
 import { scenarios } from "../test-plan.ts";
 
@@ -111,7 +113,10 @@ const unnamedDocument = {
 /**
  * An operation, then a sibling the API adds later whose name normalizes to the same one: another
  * version of the path, the path without its parameter, and an operationId equal to a refined name.
+ * In `taken`, the sibling collides with `/forks` and its refined name is one `/starred` already
+ * holds by its own operationId.
  */
+const repos = (operationId: string) => ({ ...ok, operationId, tags: ["repos"] });
 const collisions = {
   version: [{ "/v1/items": { get: ok } }, { "/v2/items": { get: ok } }],
   parameter: [
@@ -122,6 +127,10 @@ const collisions = {
     { "/items/{id}": { parameters: pathParameters("id"), get: ok } },
     { "/items/lookup": { get: { ...ok, operationId: "getItemsById" } } },
   ],
+  taken: [
+    { "/forks": { get: repos("list") }, "/starred": { get: repos("listStars") } },
+    { "/stars": { get: repos("list") } },
+  ],
 };
 const itemsDocument = (paths: Record<string, unknown>) => ({
   openapi: "3.0.3",
@@ -637,6 +646,125 @@ export default defineApp({}, async ({ cache, fetch, signal }) => ({
     ),
   );
 
+  it.effect(scenarios.liveOpenapiV1Documents.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const upstream = yield* requestEchoUpstream;
+        const app = yield* deployPublicApp(`import { defineApp, object, query, router } from "apps";
+import { liveOpenapiRouter, openapiToolNames } from "apps/openapi";
+const options = {
+  source: { document: ${JSON.stringify(v1Document(upstream.origin))} },
+  allowedOrigin: ${JSON.stringify(upstream.origin)},
+  securitySchemes: {}, methods: {}, oauth: [],
+};
+export default defineApp({}, async ({ cache, fetch, signal }) => ({
+  tools: router({
+    api: liveOpenapiRouter({ ...options, cache, fetch, signal }),
+    names: query({ description: "Tool names", input: object({}) }, () =>
+      openapiToolNames({ ...options, signal }),
+    ),
+  }),
+}));
+`);
+        // Every operation v1 imported is a tool. Only the one that answers with nothing but an
+        // event stream is not: a tool cannot return a stream.
+        const listing = yield* app.call("names", "query", {});
+        expect(listing.status, JSON.stringify(listing.body)).toBe(200);
+        const { tools, skipped } = yield* body(OpenapiToolNames, listing);
+        expect(skipped).toEqual([]);
+        expect(tools.map((tool) => [tool.name, tool.method, tool.path])).toEqual([
+          ["items.createItem", "POST", "/items"],
+          ["items.copyItem", "POST", "/items/copy"],
+          ["items.streamItems", "GET", "/items/stream"],
+          ["search.searchItems", "GET", "/search?type=items"],
+          ["items.getItems", "GET", "/items/{id}?view=full"],
+          // Their names differ only in the stable hash of the whole path.
+          ["docs.readDocsGet00jgt2p1", "GET", "/docs#latest"],
+          ["docs.readDocsGet00ru2ttw", "GET", "/docs#archive"],
+          ["legacy.postLegacy", "POST", "/legacy"],
+        ]);
+
+        const Echo = Schema.Struct({
+          method: Schema.String,
+          url: Schema.String,
+          accept: Schema.NullOr(Schema.String),
+          body: Schema.String,
+        });
+        const call = (tool: string, kind: "query" | "mutation", input: unknown) =>
+          app.call(`api.${tool}`, kind, input).pipe(
+            Effect.tap((response) =>
+              Effect.sync(() => expect(response.status, JSON.stringify(response.body)).toBe(200)),
+            ),
+            Effect.flatMap((response) => body(Echo, response)),
+          );
+        const rejected = (tool: string, kind: "query" | "mutation", input: unknown) =>
+          app
+            .call(`api.${tool}`, kind, input)
+            .pipe(
+              Effect.tap((response) =>
+                Effect.sync(() =>
+                  expect(response.status, `${tool}: ${JSON.stringify(response.body)}`).not.toBe(
+                    200,
+                  ),
+                ),
+              ),
+            );
+
+        // A reference into another component's properties validates the input as its target.
+        expect(
+          yield* call("items.createItem", "mutation", { body: { owner: { name: "Ada" } } }),
+        ).toMatchObject({ method: "POST", url: "/items", body: '{"owner":{"name":"Ada"}}' });
+        yield* rejected("items.createItem", "mutation", { body: { owner: {} } });
+        // So do a request body that reuses another operation's schema and a parameter schema
+        // that points into a Parameter Object.
+        expect(
+          yield* call("items.copyItem", "mutation", {
+            query: { max: 2 },
+            body: { owner: { name: "Ada" } },
+          }),
+        ).toMatchObject({ method: "POST", url: "/items/copy?max=2" });
+        yield* rejected("items.copyItem", "mutation", {
+          query: { max: 0 },
+          body: { owner: { name: "Ada" } },
+        });
+        yield* rejected("items.copyItem", "mutation", { body: { owner: { title: "Ada" } } });
+        // The response refers to a component whose name is not URI-encoded; its schema is read.
+        const described = yield* app.tool("api.items.createItem");
+        expect(described.status, JSON.stringify(described.body)).toBe(200);
+        expect(JSON.stringify(described.body)).toContain('"required":["id"]');
+
+        // The operation that can also answer with JSON asks for JSON only.
+        expect(yield* call("items.streamItems", "query", {})).toEqual({
+          method: "GET",
+          url: "/items/stream",
+          accept: "application/json",
+          body: "",
+        });
+        // A path's fixed query is sent with the operation's own; its fragment is not sent.
+        expect(yield* call("search.searchItems", "query", { query: { q: "lamp" } })).toMatchObject({
+          method: "GET",
+          url: "/search?type=items&q=lamp",
+        });
+        expect(yield* call("items.getItems", "query", { path: { id: "a1" } })).toMatchObject({
+          method: "GET",
+          url: "/items/a1?view=full",
+        });
+        for (const docs of ["docs.readDocsGet00jgt2p1", "docs.readDocsGet00ru2ttw"])
+          expect(yield* call(docs, "query", {})).toMatchObject({ method: "GET", url: "/docs" });
+        // An empty operationId is no operationId. The parameter in `body` and the request body
+        // without media types are not inputs, as v1 dropped them.
+        expect(yield* call("legacy.postLegacy", "mutation", { query: { q: "old" } })).toEqual({
+          method: "POST",
+          url: "/legacy?q=old",
+          accept: "application/json",
+          body: "",
+        });
+        yield* rejected("legacy.postLegacy", "mutation", { body: {} });
+      }),
+    ),
+  );
+
   it.effect(scenarios.liveOpenapiNaming.title, (context) =>
     withHostedCase(
       context,
@@ -716,10 +844,19 @@ export default defineApp({}, async ({ cache, fetch, signal }) => ({
             "GET /items/{id} items.getItems",
             ["GET /items/lookup items.getItemsById", "GET /items/{id} items.getItems"],
           ],
+          // `repos.listStars` keeps calling `/starred`; the sibling is refined past the held name.
+          taken: [
+            ["GET /forks repos.list", "GET /starred repos.listStars"],
+            [
+              "GET /forks repos.listForks",
+              "GET /starred repos.listStars",
+              "GET /stars repos.listGet",
+            ],
+          ],
         } as const;
         const expected: Record<string, readonly string[]> = {};
         for (const [name, [alone, added]] of Object.entries(released)) {
-          expected[`${name} alone`] = [alone, status].sort();
+          expected[`${name} alone`] = [...[alone].flat(), status].sort();
           expected[`${name} added`] = [status, ...added].sort();
           expected[`${name} reordered`] = [status, ...added].sort();
         }
diff --git a/e2e/tests/local-account-choice.spec.ts b/e2e/tests/local-account-choice.spec.ts
index 275bd0cc91..f786d47bbf 100644
--- a/e2e/tests/local-account-choice.spec.ts
+++ b/e2e/tests/local-account-choice.spec.ts
@@ -323,7 +323,8 @@ layer(TestLive, { excludeTestServices: true })("Local account links", (it) => {
           expect(refused.status, JSON.stringify(refused.body)).toBe(400);
           expect(refused.body).toEqual(called.body);
         }
-        // Another request the routes do not accept, naming no accounts, is invalid input.
+        // Another request the routes do not accept, naming no accounts, is invalid input. It names
+        // where the request did not match and what is expected there, never the submitted value.
         const invalid = yield* agent.send("POST", "/v1/tools/call", {
           app: one.id,
           tool: 42,
@@ -333,8 +334,15 @@ layer(TestLive, { excludeTestServices: true })("Local account links", (it) => {
         expect(invalid.status, JSON.stringify(invalid.body)).toBe(400);
         expect(invalid.body).toEqual({
           _tag: "RequestInvalid",
+          part: "body",
+          issues: [{ path: "$.tool", expected: "Expected string" }],
           message:
-            "Executor could not accept this request's input. Check it against the operation's schema; submitted values are not repeated here.",
+            "Executor rejected this request's body because it does not match the operation's schema: $.tool: Expected string.",
+          recovery: {
+            action: "Correct the input and send the request again.",
+            instructions:
+              "Read each listed path and what the operation's schema expects there, correct those values, and send the corrected request. Read the operation's input schema for the full shape. Sending the same input again fails the same way.",
+          },
         });
 
         // Code mode refuses `$accounts` before running the tool.
diff --git a/e2e/tests/local-account-owners.spec.ts b/e2e/tests/local-account-owners.spec.ts
index 8080c8c794..f4bc509cc0 100644
--- a/e2e/tests/local-account-owners.spec.ts
+++ b/e2e/tests/local-account-owners.spec.ts
@@ -139,15 +139,21 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({ too
         expect(yield* providers(elsewhere)).toEqual([]);
 
         // Listing never spans owners: a read without one is refused with `RequestInvalid`, as every
-        // SDK route refuses a request its schema rejects, and the Executor app's tools name the
-        // missing owner to the agent.
+        // SDK route refuses a request its schema rejects, naming the missing owner.
         for (const path of ["/v1/accounts", "/v1/providers"])
           expect(yield* agent.send("GET", path)).toEqual({
             status: 400,
             body: {
               _tag: "RequestInvalid",
+              part: "query",
+              issues: [{ path: "$.owner", expected: "Missing key" }],
               message:
-                "Executor could not accept this request's input. Check it against the operation's schema; submitted values are not repeated here.",
+                "Executor rejected this request's query because it does not match the operation's schema: $.owner: Missing key.",
+              recovery: {
+                action: "Correct the input and send the request again.",
+                instructions:
+                  "Read each listed path and what the operation's schema expects there, correct those values, and send the corrected request. Read the operation's input schema for the full shape. Sending the same input again fails the same way.",
+              },
             },
           });
         const client = yield* mcp.connect(target.apiKey, "local-account-owners");
diff --git a/e2e/tests/local-app-launch.spec.ts b/e2e/tests/local-app-launch.spec.ts
index 07267e838a..203b24683e 100644
--- a/e2e/tests/local-app-launch.spec.ts
+++ b/e2e/tests/local-app-launch.spec.ts
@@ -217,7 +217,9 @@ layer(TestLive, { excludeTestServices: true })("Local app launch", (it) => {
         const [rejectedPage, rejectedFix, rejectedApp] = yield* blocked(
           "Open the app with a rejected linked account",
         );
-        expect(rejectedPage).toContain("Rejected (Launch fixture): sign-in rejected at last check");
+        expect(rejectedPage).toContain(
+          "Rejected (Launch fixture): credentials not working at last check",
+        );
         expect(rejectedFix).toContain(`/apps/${app.id}?view=accounts`);
         expect(rejectedApp).toBe(0);
         yield* browser.checkpoint("Blocked accounts explain why the app cannot open");
diff --git a/e2e/tests/local-apps-cli.spec.ts b/e2e/tests/local-apps-cli.spec.ts
index 23b526f394..b0def766df 100644
--- a/e2e/tests/local-apps-cli.spec.ts
+++ b/e2e/tests/local-apps-cli.spec.ts
@@ -13,6 +13,7 @@ import { Evidence } from "../support/evidence.ts";
 import { Workspace, helloIndex, helloPackage } from "../support/app-authoring.ts";
 import { appsVersion, declaredApps } from "../support/apps-release.ts";
 import { localEntryCommand } from "../support/local-entry.ts";
+import { throughPipe } from "../support/pipe-readers.ts";
 
 const Catalogs = Schema.fromJsonString(
   Schema.Struct({
@@ -81,11 +82,20 @@ const cli = Effect.gen(function* () {
   );
   const home = yield* fs.makeTempDirectoryScoped({ prefix: "executor-apps-cli-" });
   const origin = target.metadata.origin;
+  const environment = (signedIn: boolean, extra: Record<string, string> = {}) => ({
+    PATH: process.env.PATH ?? "",
+    HOME: home,
+    // Release scenarios never send product analytics, even from a build with a baked key.
+    DO_NOT_TRACK: "1",
+    ...(signedIn ? { EXECUTOR_API_KEY: Redacted.value(target.apiKey) } : {}),
+    ...extra,
+  });
   const run = (
     args: readonly string[],
     signedIn: boolean,
     cwd?: string,
     extra: Record<string, string> = {},
+    slowReader = false,
   ) =>
     evidence.step(
       `executor apps ${args.join(" ")}`,
@@ -98,20 +108,16 @@ const cli = Effect.gen(function* () {
               {
                 cwd,
                 extendEnv: false,
-                env: {
-                  PATH: process.env.PATH ?? "",
-                  HOME: home,
-                  // Release scenarios never send product analytics, even from a build with a baked key.
-                  DO_NOT_TRACK: "1",
-                  ...(signedIn ? { EXECUTOR_API_KEY: Redacted.value(target.apiKey) } : {}),
-                  ...extra,
-                },
+                env: environment(signedIn, extra),
                 stdout: "pipe",
                 stderr: "pipe",
                 forceKillAfter: "3 seconds",
               },
             ),
           );
+          // A slow reader takes nothing until the CLI exits or has waited a second for the
+          // pipe, which holds 64 KiB.
+          if (slowReader) yield* child.exitCode.pipe(Effect.timeoutOption("1 second"));
           const [code, stdout, stderr] = yield* Effect.all(
             [
               child.exitCode,
@@ -124,7 +130,7 @@ const cli = Effect.gen(function* () {
         }),
       ),
     );
-  return { run, origin, fs };
+  return { run, origin, fs, entry, environment };
 });
 
 layer(TestLive, { excludeTestServices: true })("Local apps CLI", (it) => {
@@ -144,7 +150,7 @@ layer(TestLive, { excludeTestServices: true })("Local apps CLI", (it) => {
           "run executor apps login --host https://api.executor.sh and pass the same --host",
         );
         expect(signedOut.stderr).toContain(
-          "For a local server (default http://127.0.0.1:4312), set EXECUTOR_API_KEY",
+          "Without --host or EXECUTOR_HOST, commands use the local background Executor; for a local server at --host, set EXECUTOR_API_KEY to its API key.",
         );
 
         const listed = yield* run(["skills", "--host", origin], true);
@@ -294,6 +300,75 @@ layer(TestLive, { excludeTestServices: true })("Local apps CLI", (it) => {
       }),
     ),
   );
+  it.effect(scenarios.localAppsCliPipedOutput.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          evidence = yield* Evidence,
+          api = yield* Api;
+        const { run, origin, fs, entry, environment } = yield* cli;
+        const session = yield* api.session();
+        // About 2 MiB, thirty times what a pipe holds; numbered lines show where a cut fell.
+        const notes = Array.from(
+          { length: 40_000 },
+          (_, line) => `line ${line} ${"x".repeat(40)}\n`,
+        ).join("");
+        const source = yield* fs.makeTempDirectoryScoped({ prefix: "executor-apps-piped-" });
+        yield* fs.writeFileString(`${source}/index.ts`, helloIndex);
+        yield* fs.writeFileString(`${source}/package.json`, `${helloPackage(appsVersion)}\n`);
+        yield* fs.writeFileString(`${source}/notes.txt`, notes);
+        const created = yield* run(
+          ["create", "--host", origin, "--name", "CLI piped source", "--files", source],
+          true,
+        );
+        expect(created.code, created.stderr).toBe(0);
+        const app = yield* Schema.decodeUnknownEffect(Created)(created.stdout);
+        yield* Effect.addFinalizer(() =>
+          session
+            .send("DELETE", `/v1/apps/${app.id}`, undefined, {
+              authorization: `Bearer ${Redacted.value(target.apiKey)}`,
+            })
+            .pipe(Effect.orDie),
+        );
+
+        // The release executable's output stopped at the 65,536 bytes the pipe took first, with
+        // exit code 0, and a program parsing it read JSON cut mid-string.
+        const read = yield* run(
+          ["source", "--host", origin, "--app", app.id],
+          true,
+          undefined,
+          {},
+          true,
+        );
+        const printed = Buffer.byteLength(read.stdout);
+        yield* evidence.json("piped-source.json", {
+          code: read.code,
+          stdoutBytes: printed,
+          stderr: read.stderr,
+        });
+        expect(read.code, read.stderr).toBe(0);
+        expect(printed).toBeGreaterThan(notes.length);
+        const files = (yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Deployed))(
+          read.stdout,
+        )).files;
+        expect(files.find((file) => file.path === "notes.txt")?.content).toBe(notes);
+
+        // A reader that closes the pipe early, as `| head -c 100` does, ends the command quietly.
+        // An unhandled EPIPE failed it with exit code 1 and a stack trace.
+        const head = yield* throughPipe(
+          { mode: "head", bytes: 100 },
+          localEntryCommand(entry, ["apps", "source", "--host", origin, "--app", app.id]),
+          environment(true),
+        );
+        yield* evidence.json("head-c-100.json", head);
+        expect(head.read).toBeGreaterThanOrEqual(100);
+        expect(head.stderr).toBe("");
+        expect(head.code).toBe(0);
+        expect(head.millisecondsAfterClose).toBeLessThan(5_000);
+      }),
+    ),
+  );
   it.effect(scenarios.localAppsCliRelease.title, (context) =>
     withCase(
       context,
diff --git a/e2e/tests/local-bootstrap.spec.ts b/e2e/tests/local-bootstrap.spec.ts
index 1111cceaba..93fbc2b887 100644
--- a/e2e/tests/local-bootstrap.spec.ts
+++ b/e2e/tests/local-bootstrap.spec.ts
@@ -10,6 +10,7 @@ import { localNpmRegistry } from "../support/npm-registry.ts";
 import { scenarios } from "../test-plan.ts";
 import { localEntryCommand } from "../support/local-entry.ts";
 import { withStandInPackage } from "../support/stand-in-package.ts";
+import { fakeBrowserOpener } from "../support/background-service.ts";
 
 const Record = Schema.Struct({
   version: Schema.Literal(1),
@@ -116,9 +117,9 @@ const packagedCli = (options: {
       directory: string,
       port: number,
       extra: Readonly<Record<string, string>>,
-      subcommand = "serve",
+      args: ReadonlyArray<string> = ["serve"],
     ) =>
-      ChildProcess.make(launch.command, [...launch.prefix, subcommand], {
+      ChildProcess.make(launch.command, [...launch.prefix, ...args], {
         cwd: path.dirname(directory),
         env: environment(directory, port, extra),
         extendEnv: false,
@@ -161,7 +162,12 @@ const packagedCli = (options: {
           const stdout = yield* collect(child.stdout);
           const stderr = yield* collect(child.stderr);
           const origin = `http://127.0.0.1:${port}`;
+          // The server listens before it opens storage and answers 503 until it is ready.
           const ready = http.get(`${origin}/auth/session`).pipe(
+            Effect.filterOrFail(
+              (response) => response.status === 200,
+              (response) => new Error(`The server is not ready yet (${response.status})`),
+            ),
             Effect.flatMap((response) => response.json),
             Effect.timeout(2_000),
             Effect.retry({ schedule: Schedule.spaced(200), times: 200 }),
@@ -212,14 +218,14 @@ const packagedCli = (options: {
           return { code: Number(code), message };
         }),
       );
-    /** Run one subcommand to exit and return its exit code and output. */
+    /** Run one command to exit and return its exit code and output. */
     const finish =
-      (subcommand: string) =>
+      (args: ReadonlyArray<string>) =>
       (directory: string, env: Readonly<Record<string, string>> = {}, serverPort?: number) =>
         Effect.scoped(
           Effect.gen(function* () {
             const port = serverPort ?? (yield* freePort);
-            const child = yield* processes.spawn(command(directory, port, env, subcommand));
+            const child = yield* processes.spawn(command(directory, port, env, args));
             const [code, stdout, stderr] = yield* Effect.all(
               [
                 child.exitCode,
@@ -231,8 +237,16 @@ const packagedCli = (options: {
             return { code: Number(code), stdout, stderr };
           }),
         );
-    // Without a server port, `pair` is given a free port: reaching it shows the key was read.
-    return { start, refuse, rotate: finish("rotate-key"), pair: finish("pair"), readRecord };
+    /** `executor --server <url>`: a client of a server it did not start, sent the saved API key. */
+    const client = (url: string) => finish(["--server", url]);
+    return {
+      start,
+      refuse,
+      rotate: finish(["rotate-key"]),
+      pair: finish(["pair"]),
+      client,
+      readRecord,
+    };
   });
 
 it.live(scenarios.localBootstrap.title, () =>
@@ -781,15 +795,17 @@ it.live(scenarios.localBootstrapPair.title, () =>
       const path = yield* Path.Path;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "executor-pair-e2e-" });
       const cli = yield* packagedCli({
-        keys: ["PATH", "HOME", "USERPROFILE", "SystemRoot", "APPDATA", "LOCALAPPDATA"],
+        keys: ["HOME", "USERPROFILE", "SystemRoot", "APPDATA", "LOCALAPPDATA"],
         standIn: root,
       });
+      const browser = yield* fakeBrowserOpener(path.join(root, "browser"));
       const storeFile = path.join(root, "stand-in-store.json");
       const as = (mode: string) => ({
+        ...browser.environment,
+        EXECUTOR_NO_UPDATE_CHECK: "1",
         EXECUTOR_E2E_STAND_IN: mode,
         EXECUTOR_E2E_STAND_IN_FILE: storeFile,
       });
-      const noServer = "No server answered on 127.0.0.1:";
       /** The record and the stand-in store, which pairing must leave as they were. */
       const saved = (directory: string) =>
         Effect.all([
@@ -806,36 +822,48 @@ it.live(scenarios.localBootstrapPair.title, () =>
           );
         });
 
-      // A directory that keeps its keys in the OS store sends the key saved there, which its
-      // running server accepts.
       const ready = path.join(root, "ready");
       yield* cli.start(ready, {
         env: as("granted"),
         during: (port) =>
           Effect.gen(function* () {
             const before = yield* saved(ready);
-            const paired = yield* cli.pair(ready, as("granted"), port);
-            expect(paired.code, paired.stderr).toBe(0);
-            expect(paired.stdout.trim()).toMatch(
-              new RegExp(`^http://127\\.0\\.0\\.1:${port}/#pair=[a-f0-9]{64}$`, "u"),
-            );
+            const origin = `http://127.0.0.1:${port}`;
+            const link = new RegExp(`^http://127\\.0\\.0\\.1:${port}/#pair=[a-f0-9]{64}$`, "u");
+            // `executor pair` sends the password the running server registered and reads no
+            // keys, so a store that denies access or cannot be found does not stop it.
+            for (const mode of ["granted", "denied", "absent"]) {
+              const paired = yield* cli.pair(ready, as(mode), port);
+              expect(paired.code, paired.stderr).toBe(0);
+              expect(paired.stdout.trim()).toMatch(link);
+            }
+            // A client of a server it did not start sends the key saved where its directory keeps
+            // it, here the OS store, which that server accepts.
+            const joined = yield* cli.client(origin)(ready, as("granted"), port);
+            expect(joined.code, joined.stderr).toBe(0);
+            const lines = joined.stdout.trim().split("\n");
+            expect(lines[0]).toBe(`Executor: ${origin}`);
+            expect(lines[3]).toMatch(link);
+            expect(yield* browser.opened).toEqual([lines[3]]);
             expect(yield* saved(ready)).toEqual(before);
           }),
       });
       const before = yield* saved(ready);
       expect(before[2]).toBe(false);
-      const read = yield* cli.pair(ready, as("granted"));
-      expect(read.code).toBe(1);
-      expect(read.stderr).toContain(noServer);
+      const stopped = yield* cli.pair(ready, as("granted"));
+      expect(stopped.code).toBe(1);
+      expect(stopped.stderr).toContain(`No background Executor is running for ${ready}.`);
       expect(yield* saved(ready)).toEqual(before);
 
-      // Denied store access is reported, and pairing never falls back to a key file.
-      const denied = yield* cli.pair(ready, as("denied"));
+      // The client reads its key before it sends anything, so these fail before any request.
+      const nowhere = `http://127.0.0.1:${yield* freePort}`;
+      // Denied store access is reported, and the client never falls back to a key file.
+      const denied = yield* cli.client(nowhere)(ready, as("denied"));
       expect(denied.code).toBe(1);
       expect(denied.stderr).toContain("Access to the OS credential store was denied");
       expect(denied.stderr).toContain("Nothing was changed.");
       expect(yield* saved(ready)).toEqual(before);
-      const absent = yield* cli.pair(ready, as("absent"));
+      const absent = yield* cli.client(nowhere)(ready, as("absent"));
       expect(absent.code).toBe(1);
       expect(absent.stderr).toContain("OS credential store could not be found");
       expect(yield* saved(ready)).toEqual(before);
@@ -844,7 +872,7 @@ it.live(scenarios.localBootstrapPair.title, () =>
       const lost = path.join(root, "lost");
       yield* record(lost, "ready");
       const lostBefore = yield* saved(lost);
-      const missing = yield* cli.pair(lost, as("granted"));
+      const missing = yield* cli.client(nowhere)(lost, as("granted"));
       expect(missing.code).toBe(1);
       expect(missing.stderr).toContain("OS credential is missing");
       expect(yield* saved(lost)).toEqual(lostBefore);
@@ -853,10 +881,11 @@ it.live(scenarios.localBootstrapPair.title, () =>
       const pending = path.join(root, "pending");
       yield* record(pending, "pending");
       const pendingBefore = yield* saved(pending);
-      const unfinished = yield* cli.pair(pending, as("granted"));
+      const unfinished = yield* cli.client(nowhere)(pending, as("granted"));
       expect(unfinished.code).toBe(1);
       expect(unfinished.stderr).toContain(`${pending} has no saved keys`);
       expect(yield* saved(pending)).toEqual(pendingBefore);
+      expect(yield* browser.opened).toHaveLength(1);
     }),
   ).pipe(Effect.provide(NodeServices.layer), Effect.provide(FetchHttpClient.layer)),
 );
diff --git a/e2e/tests/local-cli-legacy-commands.spec.ts b/e2e/tests/local-cli-legacy-commands.spec.ts
index 52e09e6462..43cde0a13d 100644
--- a/e2e/tests/local-cli-legacy-commands.spec.ts
+++ b/e2e/tests/local-cli-legacy-commands.spec.ts
@@ -9,8 +9,10 @@ import { localEntryCommand } from "../support/local-entry.ts";
 
 const dashboard =
   "In Executor 2, run `executor` to start the local server and open its dashboard. If the server is already running, run `executor pair` and open the link it prints.";
-const headless = "Run `executor serve` to start the local server without opening a browser";
-const service = "Executor 2 cannot run as a background service yet. Keep `executor serve` running";
+const headless =
+  "In Executor 2, run `executor service start` to start the background server without opening a browser. It keeps running until `executor service stop`.";
+const install =
+  "Executor 2 installs nothing with your operating system. `executor` or `executor service start` starts the background Executor, which runs until `executor service stop`.";
 const mcp = "Executor 2 serves MCP over HTTP from the running server.";
 const tools = "Executor 2 runs tools through MCP.";
 const endpoint = "http://127.0.0.1:4312/mcp";
@@ -22,9 +24,7 @@ const login = "run `executor apps login --host https://api.executor.sh`";
 const cases = [
   { args: ["web"], command: "web", replacement: dashboard },
   { args: ["daemon", "run"], command: "daemon", replacement: headless },
-  { args: ["service", "start"], command: "service", replacement: service },
-  { args: ["service", "install"], command: "service", replacement: service },
-  { args: ["install"], command: "install", replacement: service },
+  { args: ["install"], command: "install", replacement: install },
   { args: ["mcp"], command: "mcp", replacement: `${mcp} Start the server` },
   { args: ["open"], command: "open", replacement: pairing },
   { args: ["call", "return 1"], command: "call", replacement: tools },
@@ -42,7 +42,7 @@ const cases = [
     command: "web",
     replacement: dashboard,
   },
-  { args: ["install", "--port", "4788", "--boot"], command: "install", replacement: service },
+  { args: ["install", "--port", "4788", "--boot"], command: "install", replacement: install },
   {
     args: ["daemon", "run", "--port", "4788", "--foreground"],
     command: "daemon",
@@ -119,7 +119,7 @@ layer(TestLive, { excludeTestServices: true })("Local CLI legacy commands", (it)
             expect(result.code, result.stderr).toBe(1);
             expect(result.stderr).toContain(`\`executor ${command}\` is an Executor 1 command.`);
             expect(result.stderr).toContain(replacement);
-            // Effect's typo suggestion pointed `executor service` at `serve`, the wrong command.
+            // Effect's typo suggestion pointed `executor server` at `serve`, the wrong command.
             expect(result.stderr).not.toContain("Did you mean");
             expect(result.stderr).not.toContain("Unknown subcommand");
             expect(result.stderr).not.toContain("Executor could not start");
@@ -137,7 +137,9 @@ layer(TestLive, { excludeTestServices: true })("Local CLI legacy commands", (it)
           const listed = help.stdout
             .split("\n")
             .flatMap((line) => /^ {2}([a-z][a-z-]*)\s/u.exec(line)?.slice(1, 2) ?? []);
-          expect(listed).toEqual(expect.arrayContaining(["apps", "serve", "pair", "rotate-key"]));
+          expect(listed).toEqual(
+            expect.arrayContaining(["apps", "serve", "service", "pair", "rotate-key"]),
+          );
           for (const { command } of cases) expect(listed).not.toContain(command);
           const typo = yield* run(["sevre"]);
           expect(typo.code).toBe(1);
diff --git a/e2e/tests/local-mcp-connections.spec.ts b/e2e/tests/local-mcp-connections.spec.ts
index 942b8bc25c..dffb168cb6 100644
--- a/e2e/tests/local-mcp-connections.spec.ts
+++ b/e2e/tests/local-mcp-connections.spec.ts
@@ -22,6 +22,7 @@ import { Target } from "../support/platform.ts";
 import { connectLocalAccount } from "../support/app-accounts.ts";
 import { linkLocal, localLinks } from "../support/local-links.ts";
 import { appsManifest } from "../support/apps-release.ts";
+import { siteless } from "../support/failure-site.ts";
 
 /**
  * MCP clients print a refused request's body after their own prefix, such as "Error POSTing to
@@ -683,7 +684,7 @@ layer(TestLive, { excludeTestServices: true })("Local scoped MCP connections", (
               code: "GrantForbidden",
               status: 403,
             });
-            return refused.execution.error.message;
+            return siteless(refused.execution.error.message);
           });
         yield* evidence.step(
           "A read-only connection names the tool it excludes",
diff --git a/e2e/tests/local-pair.spec.ts b/e2e/tests/local-pair.spec.ts
index 3ad31ec939..c430d5cd72 100644
--- a/e2e/tests/local-pair.spec.ts
+++ b/e2e/tests/local-pair.spec.ts
@@ -29,7 +29,10 @@ const desktopHint =
 const KeyFile = Schema.fromJsonString(Schema.Struct({ apiKey: Schema.String }));
 /** What pair says about something on the port that is not a working Executor server. */
 const notExecutor = (port: number) =>
-  `Something is listening on 127.0.0.1:${port}, but it did not answer as an Executor server.`;
+  `Something is listening on 127.0.0.1:${port}, but it did not answer as an Executor server. Run \`executor service status\` to see where the background Executor listens.`;
+/** What pair says when no server is registered for the directory, or the registered one is gone. */
+const noServer = (directory: string) =>
+  `No background Executor is running for ${directory}. Start it with \`executor\` or \`executor service start\`.`;
 
 layer(TestLive, { excludeTestServices: true })("Local pair", (it) => {
   it.effect(
@@ -111,18 +114,6 @@ layer(TestLive, { excludeTestServices: true })("Local pair", (it) => {
             port: number,
             extra: Readonly<Record<string, string>> = {},
           ) => run(["pair"], directory, port, extra);
-          /** Every file under a directory with its contents, to show a command changed nothing. */
-          const snapshot = (directory: string) =>
-            Effect.gen(function* () {
-              const entries = (yield* fs.readDirectory(directory, { recursive: true })).toSorted();
-              const files: Array<readonly [string, string]> = [];
-              for (const name of entries) {
-                const file = path.join(directory, name);
-                if ((yield* fs.stat(file)).type === "File")
-                  files.push([name, yield* fs.readFileString(file)]);
-              }
-              return files;
-            });
           /** A running server writes its own databases; its key files are what pairing must keep. */
           const keyFiles = (directory: string) =>
             Effect.forEach(["installation.json", "keys.json"], (name) =>
@@ -131,199 +122,201 @@ layer(TestLive, { excludeTestServices: true })("Local pair", (it) => {
 
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "executor-pair-" });
           const running = path.join(root, "running");
+          const missing = path.join(root, "missing");
           const port = yield* freePort;
           const link = new RegExp(`^http://127\\.0\\.0\\.1:${port}/#pair=[a-f0-9]{64}$`, "u");
-          const server = yield* processes.spawn(command(["serve"], running, port));
-          const ready = yield* Deferred.make<void>();
-          const log = yield* Ref.make("");
-          yield* Stream.merge(server.stdout, server.stderr).pipe(
-            Stream.decodeText(),
-            Stream.splitLines,
-            Stream.runForEach((line) =>
-              Effect.gen(function* () {
-                yield* Ref.update(
-                  log,
-                  (before) =>
-                    `${before}${line.replace(/#pair=[a-f0-9]{64}/gu, "#pair=<redacted>")}\n`,
-                );
-                if (line === `Executor: http://127.0.0.1:${port}`)
-                  yield* Deferred.succeed(ready, undefined);
-              }),
-            ),
-            Effect.forkScoped,
-          );
-          yield* Effect.raceFirst(
-            Deferred.await(ready),
-            server.exitCode.pipe(
-              Effect.flatMap((code) =>
-                Effect.fail(new Error(`executor serve exited before readiness (${code})`)),
-              ),
-            ),
-          ).pipe(
-            Effect.timeout("90 seconds"),
-            Effect.tapError(() =>
-              Ref.get(log).pipe(Effect.flatMap((text) => evidence.json("serve.json", { text }))),
-            ),
-          );
+          const afterRotation = yield* Effect.scoped(
+            Effect.gen(function* () {
+              // A foreground server registers itself in its data directory, as the background
+              // server does, so pairing finds it there.
+              const server = yield* processes.spawn(command(["serve"], running, port));
+              const ready = yield* Deferred.make<void>();
+              const log = yield* Ref.make("");
+              yield* Stream.merge(server.stdout, server.stderr).pipe(
+                Stream.decodeText(),
+                Stream.splitLines,
+                Stream.runForEach((line) =>
+                  Effect.gen(function* () {
+                    yield* Ref.update(
+                      log,
+                      (before) =>
+                        `${before}${line.replace(/#pair=[a-f0-9]{64}/gu, "#pair=<redacted>")}\n`,
+                    );
+                    if (line === `Executor: http://127.0.0.1:${port}`)
+                      yield* Deferred.succeed(ready, undefined);
+                  }),
+                ),
+                Effect.forkScoped,
+              );
+              yield* Effect.raceFirst(
+                Deferred.await(ready),
+                server.exitCode.pipe(
+                  Effect.flatMap((code) =>
+                    Effect.fail(new Error(`executor serve exited before readiness (${code})`)),
+                  ),
+                ),
+              ).pipe(
+                Effect.timeout("90 seconds"),
+                Effect.tapError(() =>
+                  Ref.get(log).pipe(
+                    Effect.flatMap((text) => evidence.json("serve.json", { text })),
+                  ),
+                ),
+              );
 
-          // The running server's own directory pairs, and pairing leaves that directory as it was.
-          const before = yield* keyFiles(running);
-          const paired = yield* pair(running, port);
-          expect(paired.code, paired.stderr).toBe(0);
-          expect(paired.stdout.trim()).toMatch(link);
-          expect(yield* keyFiles(running)).toEqual(before);
+              // The running server's own directory pairs, and pairing leaves that directory as it was.
+              const before = yield* keyFiles(running);
+              const paired = yield* pair(running, port);
+              expect(paired.code, paired.stderr).toBe(0);
+              expect(paired.stdout.trim()).toMatch(link);
+              expect(yield* keyFiles(running)).toEqual(before);
 
-          // Pairing reads only the port and the API key, so a setting only the server uses cannot
-          // stop it.
-          const serverOnly = yield* pair(running, port, {
-            EXECUTOR_MCP_TIMEOUT_MS: "not-a-number",
-          });
-          expect(serverOnly.code, serverOnly.stderr).toBe(0);
-          expect(serverOnly.stdout.trim()).toMatch(link);
+              // Pairing reads only the registration, so a setting only the server uses cannot
+              // stop it, and EXECUTOR_PORT need not name the server's port.
+              const serverOnly = yield* pair(running, port, {
+                EXECUTOR_MCP_TIMEOUT_MS: "not-a-number",
+              });
+              expect(serverOnly.code, serverOnly.stderr).toBe(0);
+              expect(serverOnly.stdout.trim()).toMatch(link);
+              for (const other of [String(yield* refusingPort), "not-a-port"]) {
+                const elsewhere = yield* pair(running, port, { EXECUTOR_PORT: other });
+                expect(elsewhere.code, elsewhere.stderr).toBe(0);
+                expect(elsewhere.stdout.trim()).toMatch(link);
+              }
 
-          // An invalid port is named instead of the startup failure.
-          const badPort = yield* pair(running, port, { EXECUTOR_PORT: "not-a-port" });
-          yield* evidence.json("invalid-port.json", badPort);
-          expect(badPort.code).toBe(1);
-          expect(badPort.stderr).toContain("EXECUTOR_PORT must be a port number from 1 to 65535");
-          expect(badPort.stderr).not.toContain("Executor could not start");
+              // A directory no server runs for is refused, and not even the directory is created.
+              const refused = yield* pair(missing, port);
+              yield* evidence.json("no-server.json", refused);
+              expect(refused.code).toBe(1);
+              expect(refused.stderr).toContain(noServer(missing));
+              expect(refused.stderr).toContain(desktopHint);
+              expect(refused.stderr).toContain(nothingChanged);
+              expect(refused.stderr).not.toContain("Executor could not start");
+              expect(yield* fs.exists(missing)).toBe(false);
 
-          // A directory without saved keys is refused, and not even the directory is created.
-          const missing = path.join(root, "missing");
-          const refused = yield* pair(missing, port);
-          yield* evidence.json("no-saved-keys.json", refused);
-          expect(refused.code).toBe(1);
-          expect(refused.stderr).toContain(`${missing} has no saved keys`);
-          expect(refused.stderr).toContain(
-            "set EXECUTOR_DATA_DIR to the folder the running server uses",
-          );
-          expect(refused.stderr).toContain(desktopHint);
-          expect(refused.stderr).toContain("No keys were created.");
-          expect(refused.stderr).not.toContain("Executor could not start");
-          expect(yield* fs.exists(missing)).toBe(false);
-
-          // Another directory's keys, as when Executor desktop or another EXECUTOR_DATA_DIR owns the
-          // port, are rejected by the server. The message names both causes and changes nothing.
-          const other = path.join(root, "other");
-          yield* fs.makeDirectory(other);
-          yield* fs.writeFileString(
-            path.join(other, "installation.json"),
-            JSON.stringify({ version: 1, id: crypto.randomUUID(), state: "file" }),
-          );
-          yield* fs.writeFileString(
-            path.join(other, "keys.json"),
-            JSON.stringify({
-              apiKey: randomBytes(32).toString("hex"),
-              encryptionKey: randomBytes(32).toString("hex"),
-            }),
-          );
-          const otherBefore = yield* snapshot(other);
-          const rejected = yield* pair(other, port);
-          yield* evidence.json("key-rejected.json", rejected);
-          expect(rejected.code).toBe(1);
-          expect(rejected.stderr).toContain(
-            `The Executor server on 127.0.0.1:${port} did not accept the API key saved in ${other}.`,
-          );
-          expect(rejected.stderr).toContain("set EXECUTOR_DATA_DIR to the folder it uses");
-          expect(rejected.stderr).toContain(desktopHint);
-          expect(rejected.stderr).toContain("restart the server");
-          expect(rejected.stderr).toContain(nothingChanged);
-          expect(rejected.stderr).not.toContain("Executor could not start");
-          expect(yield* snapshot(other)).toEqual(otherBefore);
+              // A supplied key the server did not start with is named as such.
+              const supplied = yield* pair(running, port, {
+                EXECUTOR_API_KEY: randomBytes(32).toString("hex"),
+              });
+              yield* evidence.json("key-rejected.json", supplied);
+              expect(supplied.code).toBe(1);
+              expect(supplied.stderr).toContain(
+                `The Executor server on 127.0.0.1:${port} did not accept the supplied EXECUTOR_API_KEY.`,
+              );
+              expect(supplied.stderr).toContain(nothingChanged);
+              expect(yield* keyFiles(running)).toEqual(before);
 
-          // Supplied keys the server did not start with are named as such.
-          const supplied = yield* pair(missing, port, {
-            EXECUTOR_API_KEY: randomBytes(32).toString("hex"),
-            EXECUTOR_ENCRYPTION_KEY: randomBytes(32).toString("hex"),
-          });
-          expect(supplied.code).toBe(1);
-          expect(supplied.stderr).toContain(
-            `The Executor server on 127.0.0.1:${port} did not accept the supplied EXECUTOR_API_KEY.`,
-          );
-          expect(supplied.stderr).toContain(nothingChanged);
-          expect(yield* fs.exists(missing)).toBe(false);
+              // The server's own API key, supplied alone, pairs the server on EXECUTOR_PORT without
+              // a registration in the directory: a client never needs the encryption key.
+              const { apiKey } = yield* fs
+                .readFileString(path.join(running, "keys.json"))
+                .pipe(Effect.flatMap(Schema.decodeUnknownEffect(KeyFile)));
+              const suppliedPaired = yield* pair(missing, port, { EXECUTOR_API_KEY: apiKey });
+              expect(suppliedPaired.code, suppliedPaired.stderr).toBe(0);
+              expect(suppliedPaired.stdout.trim()).toMatch(link);
+              expect(yield* fs.exists(missing)).toBe(false);
 
-          // The server's own API key, supplied alone, pairs without a saved directory: a client
-          // never needs the encryption key.
-          const { apiKey } = yield* fs
-            .readFileString(path.join(running, "keys.json"))
-            .pipe(Effect.flatMap(Schema.decodeUnknownEffect(KeyFile)));
-          const suppliedPaired = yield* pair(missing, port, { EXECUTOR_API_KEY: apiKey });
-          expect(suppliedPaired.code, suppliedPaired.stderr).toBe(0);
-          expect(suppliedPaired.stdout.trim()).toMatch(link);
-          expect(yield* fs.exists(missing)).toBe(false);
+              // Then EXECUTOR_PORT is where the server is: an invalid one is named, and a port with
+              // no server says so instead of blaming the key or the port being in use.
+              const badPort = yield* pair(missing, port, {
+                EXECUTOR_API_KEY: apiKey,
+                EXECUTOR_PORT: "not-a-port",
+              });
+              yield* evidence.json("invalid-port.json", badPort);
+              expect(badPort.code).toBe(1);
+              expect(badPort.stderr).toContain(
+                "EXECUTOR_PORT must be a port number from 1 to 65535: the port the running server listens on. Nothing was changed.",
+              );
+              expect(badPort.stderr).not.toContain("Executor could not start");
+              const silentPort = yield* refusingPort;
+              const silent = yield* pair(missing, silentPort, { EXECUTOR_API_KEY: apiKey });
+              yield* evidence.json("no-server-on-port.json", silent);
+              expect(silent.code).toBe(1);
+              expect(silent.stderr).toContain(noServer(missing));
+              expect(silent.stderr).not.toContain("already in use");
 
-          // A rotated key is used only after the server restarts, so pairing says to restart it.
-          const rotated = yield* run(["rotate-key"], running, port);
-          expect(rotated.code, rotated.stderr).toBe(0);
-          const afterRotation = yield* keyFiles(running);
-          expect(afterRotation).not.toEqual(before);
-          const stale = yield* pair(running, port);
-          yield* evidence.json("rotated-key.json", stale);
-          expect(stale.code).toBe(1);
-          expect(stale.stderr).toContain(
-            `The Executor server on 127.0.0.1:${port} did not accept the API key saved in ${running}.`,
-          );
-          expect(stale.stderr).toContain(
-            "If you ran `executor rotate-key`, restart the server to use the new key.",
-          );
-          expect(yield* keyFiles(running)).toEqual(afterRotation);
+              // A rotated key takes effect only when the server restarts. Pairing sends the
+              // password the server registered, so it keeps working until then.
+              const rotated = yield* run(["rotate-key"], running, port);
+              expect(rotated.code, rotated.stderr).toBe(0);
+              expect(rotated.stdout).toContain(
+                "Rotated the local API key. Run `executor service restart` to use it, then update clients that used the previous key.",
+              );
+              const rotatedKeys = yield* keyFiles(running);
+              expect(rotatedKeys).not.toEqual(before);
+              const afterRotating = yield* pair(running, port);
+              expect(afterRotating.code, afterRotating.stderr).toBe(0);
+              expect(afterRotating.stdout.trim()).toMatch(link);
+              expect(yield* keyFiles(running)).toEqual(rotatedKeys);
 
-          // A port with no server says so instead of blaming the keys or the port being in use.
-          const silentPort = yield* refusingPort;
-          const silent = yield* pair(running, silentPort);
-          yield* evidence.json("no-server.json", silent);
-          expect(silent.code).toBe(1);
-          expect(silent.stderr).toContain(`No server answered on 127.0.0.1:${silentPort}.`);
-          expect(silent.stderr).toContain("set EXECUTOR_PORT to the port it listens on");
-          expect(silent.stderr).toContain(desktopHint);
-          expect(silent.stderr).not.toContain("already in use");
+              // Another service on EXECUTOR_PORT answers, but not with a connection link.
+              const services = yield* Layer.build(
+                HttpRouter.serve(
+                  HttpRouter.add(
+                    "*",
+                    "/auth/pair",
+                    HttpServerResponse.text("<h1>Not Executor</h1>", {
+                      status: 404,
+                      contentType: "text/html",
+                    }),
+                  ),
+                  { disableLogger: true, disableListenLog: true },
+                ).pipe(
+                  Layer.provideMerge(
+                    NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }),
+                  ),
+                ),
+              );
+              const foreign = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+              if (!("port" in foreign.address))
+                return yield* Effect.die("Fixture must listen on TCP");
+              const unexpected = yield* pair(missing, foreign.address.port, {
+                EXECUTOR_API_KEY: apiKey,
+              });
+              yield* evidence.json("not-executor.json", unexpected);
+              expect(unexpected.code).toBe(1);
+              expect(unexpected.stderr).toContain(notExecutor(foreign.address.port));
+              expect(unexpected.stderr).toContain(nothingChanged);
 
-          // Another service on the port answers, but not with a connection link.
-          const services = yield* Layer.build(
-            HttpRouter.serve(
-              HttpRouter.add(
-                "*",
-                "/auth/pair",
-                HttpServerResponse.text("<h1>Not Executor</h1>", {
-                  status: 404,
-                  contentType: "text/html",
-                }),
-              ),
-              { disableLogger: true, disableListenLog: true },
-            ).pipe(
-              Layer.provideMerge(
-                NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }),
-              ),
-            ),
+              // A service that is not HTTP is not "no server" either: one that resets each
+              // connection, and one that reads each request and never answers.
+              for (const [name, onConnection] of [
+                ["resets-connection", (socket) => socket.resetAndDestroy()],
+                // Reading each request lets the connection close when pair gives up. A client may
+                // reset it rather than close it, as a Bun-compiled CLI does on exit.
+                ["never-answers", (socket) => socket.on("error", () => {}).resume()],
+              ] as const satisfies ReadonlyArray<
+                readonly [string, Parameters<typeof holdPort>[1]]
+              >) {
+                const other = yield* Effect.scoped(
+                  Effect.gen(function* () {
+                    const otherPort = yield* holdPort(0, onConnection);
+                    return {
+                      port: otherPort,
+                      result: yield* pair(missing, otherPort, { EXECUTOR_API_KEY: apiKey }),
+                    };
+                  }),
+                );
+                yield* evidence.json(`${name}.json`, other.result);
+                expect(other.result.code).toBe(1);
+                expect(other.result.stderr).toContain(notExecutor(other.port));
+                expect(other.result.stderr).not.toContain("No background Executor is running");
+              }
+              return rotatedKeys;
+            }),
           );
-          const foreign = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
-          if (!("port" in foreign.address)) return yield* Effect.die("Fixture must listen on TCP");
-          const unexpected = yield* pair(running, foreign.address.port);
-          yield* evidence.json("not-executor.json", unexpected);
-          expect(unexpected.code).toBe(1);
-          expect(unexpected.stderr).toContain(notExecutor(foreign.address.port));
-          expect(unexpected.stderr).toContain(nothingChanged);
 
-          // A service that is not HTTP is not "no server" either: one that resets each connection,
-          // and one that reads each request and never answers.
-          for (const [name, onConnection] of [
-            ["resets-connection", (socket) => socket.resetAndDestroy()],
-            // Reading each request lets the connection close when pair gives up. A client may
-            // reset it rather than close it, as a Bun-compiled CLI does on exit.
-            ["never-answers", (socket) => socket.on("error", () => {}).resume()],
-          ] as const satisfies ReadonlyArray<readonly [string, Parameters<typeof holdPort>[1]]>) {
-            const other = yield* Effect.scoped(
-              Effect.gen(function* () {
-                const otherPort = yield* holdPort(0, onConnection);
-                return { port: otherPort, result: yield* pair(running, otherPort) };
-              }),
-            );
-            yield* evidence.json(`${name}.json`, other.result);
-            expect(other.result.code).toBe(1);
-            expect(other.result.stderr).toContain(notExecutor(other.port));
-            expect(other.result.stderr).not.toContain("No server answered");
-          }
+          // The server stops as its scope closes. On POSIX SIGTERM stops it, and it takes its
+          // registration with it. Windows has no SIGTERM, so the server is ended at once and its
+          // registration stays, naming a process that has exited. Either way pairing says nothing
+          // runs.
+          expect(yield* fs.exists(path.join(running, "server.json"))).toBe(
+            process.platform === "win32",
+          );
+          const stopped = yield* pair(running, port);
+          yield* evidence.json("stopped.json", stopped);
+          expect(stopped.code).toBe(1);
+          expect(stopped.stderr).toContain(noServer(running));
           expect(yield* keyFiles(running)).toEqual(afterRotation);
         }),
       ),
diff --git a/e2e/tests/local-query-state.spec.ts b/e2e/tests/local-query-state.spec.ts
index 87b16181f2..1786ed393f 100644
--- a/e2e/tests/local-query-state.spec.ts
+++ b/e2e/tests/local-query-state.spec.ts
@@ -172,6 +172,8 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({  })
         expect(
           (yield* session.send("DELETE", `/v1/apps/${app.id}`, undefined, headers)).status,
         ).toBe(200);
+        // The app's page and its accounts section each report the removal from their own live
+        // read, in either order, so the page can show two such alerts by the time this looks.
         yield* browser.use("The live app query reports removal", (page) =>
           page
             .getByRole("alert", {
@@ -179,6 +181,7 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({  })
               exact: true,
               includeHidden: true,
             })
+            .first()
             .waitFor({ state: "visible" }),
         );
         expect(
diff --git a/e2e/tests/local-serve-shutdown.spec.ts b/e2e/tests/local-serve-shutdown.spec.ts
new file mode 100644
index 0000000000..0b50d34213
--- /dev/null
+++ b/e2e/tests/local-serve-shutdown.spec.ts
@@ -0,0 +1,156 @@
+/** The real local server while nothing reads its output, or after its reader goes away. */
+import { expect, layer } from "@effect/vitest";
+import { Config, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { randomBytes } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { TestLive, withCase } from "../support/case.ts";
+import { Evidence } from "../support/evidence.ts";
+import { freePort } from "../support/ports.ts";
+import { localEntryCommand } from "../support/local-entry.ts";
+import { throughPipe, type Reader } from "../support/pipe-readers.ts";
+
+const LogLine = Schema.fromJsonString(Schema.Struct({ message: Schema.Unknown }));
+
+/**
+ * Start the server with these arguments under one of the pipe readers and return what the reader
+ * saw, with the messages the server logged. `setup` chooses the reader for the server's origin and
+ * adds to its environment, given the server's own temporary directory.
+ */
+const serveThrough = (
+  args: ReadonlyArray<string>,
+  setup: (
+    directory: string,
+    origin: string,
+  ) => Effect.Effect<{ readonly reader: Reader; readonly env?: Readonly<Record<string, string>> }>,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem,
+      path = yield* Path.Path;
+    const packagedEntry = yield* Config.NonEmptyString("EXECUTOR_E2E_LOCAL_ENTRY").pipe(
+      Config.option,
+    );
+    const entry = path.resolve(
+      Option.isSome(packagedEntry) ? packagedEntry.value : "apps/local/server/src/bin.ts",
+    );
+    // Startup deploys the bundled Executor app, which pins this checkout's apps release.
+    const registry = yield* Config.NonEmptyString("E2E_NPM_REGISTRY").pipe(Config.option);
+    const directory = yield* fs.makeTempDirectoryScoped({ prefix: "executor-serve-stop-" });
+    const port = yield* freePort;
+    const { reader, env } = yield* setup(directory, `http://127.0.0.1:${port}`);
+    const observed = yield* throughPipe(reader, localEntryCommand(entry, args), {
+      HOME: directory,
+      // Release scenarios never send product analytics, even from a build with a baked key.
+      DO_NOT_TRACK: "1",
+      // Scenarios never reach the public registry.
+      EXECUTOR_NO_UPDATE_CHECK: "1",
+      EXECUTOR_API_KEY: randomBytes(32).toString("hex"),
+      EXECUTOR_ENCRYPTION_KEY: randomBytes(32).toString("hex"),
+      EXECUTOR_DATA_DIR: path.join(directory, "data"),
+      EXECUTOR_PORT: String(port),
+      EXECUTOR_ENVIRONMENT: "e2e",
+      EXECUTOR_WORKER_BUNDLE: path.resolve(".local/test-runtime/host.json"),
+      ...(Option.isSome(registry) ? { EXECUTOR_NPM_REGISTRY: registry.value } : {}),
+      ...env,
+    });
+    // Every log line also goes to the data directory's diagnostics, which shutdown writes last.
+    const diagnostics = yield* fs
+      .readFileString(path.join(directory, "data", "diagnostics", "executor-local.jsonl"))
+      .pipe(Effect.orElseSucceed(() => ""));
+    const logged = diagnostics
+      .split("\n")
+      .filter((line) => line !== "")
+      .map((line) => String(Schema.decodeUnknownSync(LogLine)(line).message));
+    return { ...observed, logged };
+  });
+
+layer(TestLive, { excludeTestServices: true })("Local serve shutdown", (it) => {
+  it.effect(
+    scenarios.localServeStalledOutput.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const evidence = yield* Evidence;
+          // serve logs on stderr, here into a pipe already full, and prints its connection link on
+          // stdout only after logging that it is ready. Shutdown waited for the logs it could not
+          // write until something read the pipe, so SIGTERM never finished.
+          const stopped = yield* serveThrough(["serve"], (_, origin) =>
+            Effect.succeed({ reader: { mode: "stalled", origin } }),
+          );
+          yield* evidence.json("serve-sigterm.json", stopped);
+          expect(stopped.pipeFullAtSignal).toBe(true);
+          // Its shutdown finished: the last log of the product's scope reached the diagnostics.
+          expect(stopped.logged).toContain("Local server ready");
+          expect(stopped.logged).toContain("Local server stopped");
+          expect(stopped.signal).toBeNull();
+          expect(stopped.code).toBe(130);
+          expect(stopped.millisecondsAfterSignal).toBeLessThan(5_000);
+        }),
+      ),
+    { timeout: 180_000 },
+  );
+  it.effect(
+    scenarios.localServeClosedOutput.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem,
+            path = yield* Path.Path,
+            evidence = yield* Evidence;
+          // A closed stdout or stderr pipe ended the server with exit code 0, so its clients lost
+          // it. Each reader closes one pipe once the server answers, and the server then writes
+          // that stream again with output it always prints.
+          //
+          // `serve` logs a runtime sample on stderr every 30 seconds.
+          const stderrClosed = serveThrough(["serve"], (_, origin) =>
+            Effect.succeed({ reader: { mode: "late", origin, stream: "stderr", holdMs: 32_000 } }),
+          );
+          // `executor --standalone` serves in the foreground. It opens the connection link in a
+          // browser and, when the opener fails, prints on stdout to open it by hand. The stand-in
+          // opener fails once the reader has closed stdout. Windows opens links through rundll32,
+          // which has no stand-in. Its private server picks its own port, which it prints.
+          const stdoutClosed = serveThrough(["--standalone"], (directory) =>
+            Effect.gen(function* () {
+              const bin = path.join(directory, "bin"),
+                gate = path.join(directory, "stdout-closed");
+              yield* fs.makeDirectory(bin);
+              for (const opener of ["open", "xdg-open"])
+                yield* fs.writeFileString(
+                  path.join(bin, opener),
+                  // Gives up after two minutes if the reader never closes stdout.
+                  `#!/bin/sh\ni=0\nwhile [ ! -e '${gate}' ] && [ $i -lt 1200 ]; do sleep 0.1; i=$((i + 1)); done\nexit 1\n`,
+                  { mode: 0o755 },
+                );
+              return {
+                reader: { mode: "late", stream: "stdout", gate, holdMs: 2_000 },
+                env: { PATH: `${bin}:${process.env.PATH ?? ""}` },
+              } as const;
+            }).pipe(Effect.orDie),
+          );
+          const [afterStderr, afterStdout] = yield* Effect.all(
+            [stderrClosed, process.platform === "win32" ? Effect.undefined : stdoutClosed],
+            { concurrency: 2 },
+          );
+          yield* evidence.json("serve-stderr-closed.json", afterStderr);
+          if (afterStdout !== undefined)
+            yield* evidence.json("browser-stdout-closed.json", afterStdout);
+          expect(afterStderr.answeredAfterClose).toBe(true);
+          expect(afterStderr.signal).toBeNull();
+          expect(afterStderr.code).toBe(130);
+          expect(afterStderr.millisecondsAfterSignal).toBeLessThan(5_000);
+          if (afterStdout !== undefined) {
+            expect(afterStdout.answeredAfterClose).toBe(true);
+            // The private server's log stays in its own process. Its port refused connections
+            // once it stopped, and its shutdown reached the shared diagnostics.
+            expect(afterStdout.refusedAfterExit).toBe(true);
+            expect(afterStdout.logged).toContain("Local server stopped");
+            expect(afterStdout.signal).toBeNull();
+            expect(afterStdout.code).toBe(130);
+            expect(afterStdout.millisecondsAfterSignal).toBeLessThan(5_000);
+          }
+        }),
+      ),
+    { timeout: 180_000 },
+  );
+});
diff --git a/e2e/tests/local-service.spec.ts b/e2e/tests/local-service.spec.ts
new file mode 100644
index 0000000000..f178eef524
--- /dev/null
+++ b/e2e/tests/local-service.spec.ts
@@ -0,0 +1,1209 @@
+/**
+ * The CLI's background service: one Executor per data directory on a fixed port, started or
+ * joined by local commands, managed with `executor service`, and stopped only when asked. Every
+ * scenario runs the real CLI against its own HOME, data directory and port; see
+ * `support/background-service.ts`.
+ */
+import { expect, layer } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { createServer } from "node:http";
+import {
+  Clock,
+  Context,
+  Effect,
+  Fiber,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Ref,
+  Schema,
+} from "effect";
+import {
+  HttpClient,
+  HttpRouter,
+  HttpServer,
+  HttpServerRequest,
+  HttpServerResponse,
+} from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { scenarios } from "../test-plan.ts";
+import { Api, SessionClients } from "../support/api.ts";
+import { TestLive, withCase } from "../support/case.ts";
+import { Evidence } from "../support/evidence.ts";
+import { Target } from "../support/platform.ts";
+import { freePort } from "../support/ports.ts";
+import {
+  backgroundServiceCli,
+  crashServer,
+  eventually,
+  stoppingServer,
+} from "../support/background-service.ts";
+import { suspendProcess } from "../support/desktop.ts";
+
+const starting = "Starting background Executor...";
+const keysSaved = "keys saved to ";
+const Apps = Schema.fromJsonString(
+  Schema.Array(Schema.Struct({ id: Schema.String, slug: Schema.String })),
+);
+/** An apps command's failure as it prints it on stdout for programs. */
+const AppsFailure = Schema.fromJsonString(
+  Schema.Struct({ error: Schema.Struct({ code: Schema.String, message: Schema.String }) }),
+);
+const escaped = (text: string) => text.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+
+/** Serve `routes` on a loopback port, by default a free one, for the current scope; its URL. */
+const serving = <E, R>(routes: Layer.Layer<never, E, R>, port = 0) =>
+  Effect.gen(function* () {
+    const services = yield* Layer.build(
+      HttpRouter.serve(routes, { disableLogger: true, disableListenLog: true }).pipe(
+        Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port })),
+      ),
+    );
+    const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+    if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+    return `http://127.0.0.1:${server.address.port}`;
+  });
+
+/** A JSON record whose fields this test keeps as they are when it rewrites one of them. */
+const RecordJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));
+
+const LockOwner = Schema.fromJsonString(
+  Schema.Struct({
+    pid: Schema.Number,
+    started: Schema.optional(Schema.String),
+    boot: Schema.optional(Schema.String),
+    pipe: Schema.optional(Schema.String),
+    host: Schema.String,
+    port: Schema.Number,
+  }),
+);
+
+/** On Windows, what names a lock's owner: the pipe it listens on while it holds the lock. */
+const lockPipe = /^\\\\\.\\pipe\\executor-lock-[\w-]+$/u;
+
+/**
+ * A data directory's `.server.lock`: when its holder last refreshed it, and the owner a server
+ * records in it, `{ pid, started, boot, host, port }` on Linux and macOS and
+ * `{ pid, pipe, host, port }` on Windows, if readable.
+ */
+const lockOf = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const file = path.join(directory, ".server.lock");
+    const ownerFile = path.join(file, "owner.json");
+    const owner = fs
+      .readFileString(ownerFile)
+      .pipe(Effect.flatMap(Schema.decodeUnknownEffect(LockOwner)), Effect.option);
+    return {
+      file,
+      ownerFile,
+      refreshed: fs
+        .stat(file)
+        .pipe(Effect.map(({ mtime }) => Option.getOrUndefined(mtime)?.getTime() ?? 0)),
+      owner,
+      /** The owner's process and port. */
+      holder: owner.pipe(Effect.map(Option.map(({ pid, port }) => ({ pid, port })))),
+    };
+  });
+
+/** Requests to another local origin, such as the background server's, with their own cookies. */
+const apiAt = (origin: string) =>
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const services = yield* Layer.build(
+      Api.layer.pipe(
+        Layer.provide(SessionClients.layer),
+        Layer.provide(
+          Layer.succeed(Target, Target.of({ ...target, metadata: { ...target.metadata, origin } })),
+        ),
+      ),
+    );
+    return Context.get(services, Api);
+  });
+
+layer(TestLive, { excludeTestServices: true })("Local background service", (it) => {
+  it.effect(
+    scenarios.localServiceSharedStart.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+
+          // Both commands race to start a server; the fixed port and the data directory's lock
+          // leave one, and both print its URL.
+          const [first, second] = yield* Effect.all(
+            [cli.run(["service", "start"]), cli.run(["service", "start"])],
+            { concurrency: 2 },
+          );
+          expect(first.code, first.stderr).toBe(0);
+          expect(second.code, second.stderr).toBe(0);
+          expect(first.stdout.trim()).toBe(cli.url);
+          expect(second.stdout.trim()).toBe(cli.url);
+
+          const registration = yield* cli.registered;
+          expect(registration.url).toBe(cli.url);
+          expect(yield* cli.info(cli.url)).toEqual({
+            status: 200,
+            body: {
+              id: registration.id,
+              version: registration.version,
+              pid: registration.pid,
+              status: "ready",
+            },
+          });
+          // The registration carries the server's password, so only its owner may read it.
+          if (process.platform !== "win32")
+            expect((yield* fs.stat(cli.registrationFile)).mode & 0o777).toBe(0o600);
+
+          // No contender that lost the race took over afterwards: a later start finds the same one.
+          const third = yield* cli.run(["service", "start"]);
+          expect(third.code, third.stderr).toBe(0);
+          expect(third.stdout.trim()).toBe(cli.url);
+          expect(third.stderr).not.toContain(starting);
+          const after = yield* cli.registered;
+          expect([after.id, after.pid]).toEqual([registration.id, registration.pid]);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceJoin.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const path = yield* Path.Path;
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          // The background server's own stderr has no reader, so the start names the key file.
+          expect(started.stderr).toContain(
+            `EXECUTOR_KEY_STORAGE=file; ${keysSaved}${path.join(cli.data, "keys.json")}`,
+          );
+          const before = yield* cli.registered;
+
+          // `executor` uses the running server: it prints where it runs and the link, opens the
+          // link and exits, leaving the same server running.
+          const joined = yield* cli.run([]);
+          expect(joined.code, joined.stderr).toBe(0);
+          expect(joined.stderr).not.toContain(starting);
+          expect(joined.stderr).not.toContain(keysSaved);
+          const lines = joined.stdout.trim().split("\n");
+          expect(lines.slice(0, 3)).toEqual([
+            `Executor: ${cli.url}`,
+            `MCP: ${cli.url}/mcp`,
+            "Connect (one use, expires in 5 minutes):",
+          ]);
+          // A fifth line would say the browser could not be opened.
+          expect(lines).toHaveLength(4);
+          const link = lines[3] ?? "";
+          expect(link).toMatch(new RegExp(`^${escaped(cli.url)}/#pair=[a-f0-9]{64}$`, "u"));
+          expect(yield* cli.opened).toEqual([link]);
+          const after = yield* cli.registered;
+          expect([after.id, after.pid]).toEqual([before.id, before.pid]);
+
+          // The opened link pairs a browser with that server, once.
+          const api = yield* apiAt(cli.url);
+          const browser = yield* api.session();
+          const token = new URL(link).hash.slice("#pair=".length);
+          const exchanged = yield* api.request(browser, "POST", "/auth/exchange", { token });
+          expect(exchanged).toEqual({ status: 200, body: { authenticated: true } });
+          const session = yield* api.request(browser, "GET", "/auth/session");
+          expect(session).toEqual({ status: 200, body: { authenticated: true } });
+          const replay = yield* api.request(yield* api.session(), "POST", "/auth/exchange", {
+            token,
+          });
+          expect(replay.status).toBe(401);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceVersion.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const cli = yield* backgroundServiceCli();
+          // The other releases are the checkout's CLI, which reports EXECUTOR_BUILD_VERSION. The
+          // CLI under test reports its own release version when it is a release executable.
+          const [older, other] = ["2.0.0-e2e.1", "2.0.0-e2e.3"];
+          const current = { EXECUTOR_BUILD_VERSION: "2.0.0-e2e.2" };
+          const printed = yield* cli.run(["--version"], current);
+          expect(printed.code, printed.stderr).toBe(0);
+          const newer = printed.stdout.trim().replace(/^executor v/u, "");
+          expect([older, other]).not.toContain(newer);
+          const started = yield* cli.run(
+            ["service", "start"],
+            { EXECUTOR_BUILD_VERSION: older },
+            { source: true },
+          );
+          expect(started.code, started.stderr).toBe(0);
+          const first = yield* cli.registered;
+          expect(first.version).toBe(older);
+
+          // The interactive command replaces a server of another version with its own.
+          const replaced = yield* cli.run([], current);
+          expect(replaced.code, replaced.stderr).toBe(0);
+          expect(replaced.stderr).toContain(
+            `Restarting background Executor (running ${older}, this is ${newer})...`,
+          );
+          expect(replaced.stdout).toContain(`Executor: ${cli.url}\n`);
+          const second = yield* cli.registered;
+          expect(second.version).toBe(newer);
+          expect(second.pid).not.toBe(first.pid);
+          expect(yield* cli.alive(first.pid)).toBe(false);
+          expect(yield* cli.info(cli.url)).toEqual({
+            status: 200,
+            body: { id: second.id, version: newer, pid: second.pid, status: "ready" },
+          });
+
+          // Other commands use whichever version runs.
+          const kept = yield* cli.run(
+            ["service", "start"],
+            { EXECUTOR_BUILD_VERSION: other },
+            { source: true },
+          );
+          expect(kept.code, kept.stderr).toBe(0);
+          expect(kept.stdout.trim()).toBe(cli.url);
+          expect(kept.stderr).not.toContain("background Executor");
+          const third = yield* cli.registered;
+          expect([third.id, third.pid, third.version]).toEqual([second.id, second.pid, newer]);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceStandalone.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          const standalone = yield* cli.start(["--standalone"], (line) =>
+            line.startsWith("Executor: "),
+          );
+          const origin = standalone.line.slice("Executor: ".length);
+          expect(origin).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/u);
+          expect(origin).not.toBe(cli.url);
+          const port = Number(new URL(origin).port);
+
+          // The private server answers, while nothing registers or listens on the service port.
+          expect((yield* cli.info(origin)).body.status).toBe("ready");
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          expect(yield* cli.refused(cli.port)).toBe(true);
+
+          // A background server cannot start meanwhile, and since the private server is not
+          // registered, the message does not offer `executor service stop`, which cannot stop it.
+          const blocked = yield* cli.run(["service", "start"]);
+          expect(blocked.code).toBe(1);
+          expect(blocked.stderr).toContain(
+            `The background Executor could not start.\nAnother Executor is using the data directory ${cli.data}, and it is not the background Executor, so \`executor service stop\` cannot stop it.`,
+          );
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+
+          // Interrupting the command, as Ctrl-C does, stops its server. The private server leads a
+          // process group of its own, so on POSIX only the command gets SIGINT, and it exits as an
+          // interrupted program does. Windows has no SIGINT for another process, and ending the
+          // command's process tree would end the private server directly, so only the command is
+          // ended there: the private server then stops because its standard input closed.
+          if (process.platform === "win32")
+            yield* Effect.try(() => process.kill(standalone.child.pid, "SIGTERM"));
+          else yield* standalone.child.kill({ killSignal: "SIGINT" });
+          const interrupted = yield* standalone.child.exitCode.pipe(Effect.timeout("30 seconds"));
+          if (process.platform !== "win32") expect(Number(interrupted)).toBe(130);
+          expect(yield* eventually(cli.refused(port), (refused) => refused, "15 seconds")).toBe(
+            true,
+          );
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+
+          // When the private server stops on its own, the command says so and fails instead of
+          // waiting with a dead link.
+          const crashed = yield* cli.start(["--standalone"], (line) =>
+            line.startsWith("Executor: "),
+          );
+          const own = new URL(crashed.line.slice("Executor: ".length));
+          yield* crashServer((yield* cli.info(own.origin)).body.pid);
+          const code = yield* crashed.child.exitCode.pipe(Effect.timeout("30 seconds"));
+          expect(Number(code)).toBe(1);
+          expect(yield* crashed.output).toContain(
+            "This command's private Executor server stopped (",
+          );
+
+          // While the background server holds the data directory, the private server says so,
+          // and the command does not claim the background server failed.
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const held = yield* cli.run(["--standalone"]);
+          expect(held.code).toBe(1);
+          expect(held.stderr).toContain(
+            `This command's private Executor server could not start.\nThe background Executor already serves the data directory ${cli.data} at ${cli.url}.`,
+          );
+          expect(held.stderr).not.toContain("background Executor could not start");
+          expect(held.stderr).not.toContain("executorService");
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServicePortInUse.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          // Another program answers HTTP on the configured port, and not as Executor.
+          const services = yield* Layer.build(
+            HttpRouter.serve(
+              HttpRouter.add(
+                "*",
+                "/*",
+                HttpServerResponse.text("<h1>Not Executor</h1>", {
+                  status: 404,
+                  contentType: "text/html",
+                }),
+              ),
+              { disableLogger: true, disableListenLog: true },
+            ).pipe(
+              Layer.provideMerge(
+                NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }),
+              ),
+            ),
+          );
+          const foreign = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+          if (!("port" in foreign.address)) return yield* Effect.die("Fixture must listen on TCP");
+          const cli = yield* backgroundServiceCli({ port: foreign.address.port });
+
+          // EXECUTOR_PORT chose the port, so changing the saved port would not help.
+          const refused = yield* cli.run(["service", "start"]);
+          expect(refused.code).toBe(1);
+          expect(refused.stderr).toContain("The background Executor could not start.");
+          expect(refused.stderr).toContain(
+            `Port ${cli.port} is already in use by another program. EXECUTOR_PORT is set to ${cli.port} and wins over the \`port\` setting: set EXECUTOR_PORT to another port, or unset it, then try again.`,
+          );
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+
+          // The saved port chose it, so the message names the setting.
+          const saved = { EXECUTOR_PORT: undefined };
+          const set = yield* cli.run(["service", "set", "port", String(cli.port)], saved);
+          expect(set.code, set.stderr).toBe(0);
+          const setting = yield* cli.run(["service", "start"], saved);
+          expect(setting.code).toBe(1);
+          expect(setting.stderr).toContain(
+            `Port ${cli.port} is already in use by another program. Choose another port with \`executor service set port <port>\`, then run \`executor\` again.`,
+          );
+
+          // An apps command reports the same failure in its own contract, with JSON on stdout.
+          const apps = yield* cli.run(["apps", "list"]);
+          expect(apps.code).toBe(1);
+          expect(apps.stderr).toContain("Code: LocalServerUnavailable");
+          const failure = yield* Schema.decodeUnknownEffect(AppsFailure)(apps.stdout);
+          expect(failure.error.code).toBe("LocalServerUnavailable");
+          expect(failure.error.message).toContain(`Port ${cli.port} is already in use`);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceLifecycle.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          // A client's own credential, without an encryption key, is only what it would send; the
+          // server it starts still uses the data directory's keys.
+          const started = yield* cli.run(["service", "start"], {
+            EXECUTOR_API_KEY: "a".repeat(64),
+          });
+          expect(started.code, started.stderr).toBe(0);
+          expect(started.stdout.trim()).toBe(cli.url);
+          const first = yield* cli.registered;
+
+          const status = yield* cli.run(["service", "status"]);
+          expect(status.code, status.stderr).toBe(0);
+          expect(status.stdout.trim()).toBe(
+            `${cli.url} (version ${first.version}, process ${first.pid})`,
+          );
+
+          // Restart stops the server and starts another in its place.
+          const restarted = yield* cli.run(["service", "restart"]);
+          expect(restarted.code, restarted.stderr).toBe(0);
+          expect(restarted.stdout.trim()).toBe(cli.url);
+          const second = yield* cli.registered;
+          expect(second.pid).not.toBe(first.pid);
+          expect(yield* cli.alive(first.pid)).toBe(false);
+          expect((yield* cli.info(cli.url)).body).toEqual({
+            id: second.id,
+            version: second.version,
+            pid: second.pid,
+            status: "ready",
+          });
+
+          // Stop ends the process, frees its port and removes its registration.
+          const stopped = yield* cli.run(["service", "stop"]);
+          expect(stopped.code, stopped.stderr).toBe(0);
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          expect(yield* cli.alive(second.pid)).toBe(false);
+          expect(yield* cli.refused(cli.port)).toBe(true);
+          const after = yield* cli.run(["service", "status"]);
+          expect(after.code, after.stderr).toBe(0);
+          expect(after.stdout.trim()).toBe("stopped");
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceRegistration.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem,
+            evidence = yield* Evidence;
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const registration = yield* cli.registered;
+
+          // A server no client can find any more stops on its own, and nothing serves its port.
+          const removedAt = yield* Clock.currentTimeMillis;
+          yield* fs.remove(cli.registrationFile);
+          const exited = yield* eventually(
+            cli.alive(registration.pid),
+            (alive) => !alive,
+            "10 seconds",
+          ).pipe(Effect.option);
+          const stoppedAt = yield* Clock.currentTimeMillis;
+          const answering = yield* cli.info(cli.url).pipe(Effect.option);
+          yield* evidence.json("watchdog.json", {
+            stoppedAfterMs: stoppedAt - removedAt,
+            exited: Option.isSome(exited),
+            answering: Option.getOrUndefined(answering),
+          });
+          expect(
+            Option.isSome(exited),
+            "the unregistered server was still running after 10 s",
+          ).toBe(true);
+          expect(
+            Option.getOrUndefined(answering),
+            "another server answered on the port after the unregistered one stopped",
+          ).toBeUndefined();
+          expect(yield* cli.refused(cli.port)).toBe(true);
+          const status = yield* cli.run(["service", "status"]);
+          expect(status.stdout.trim()).toBe("stopped");
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServicePortSetting.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          // The saved port applies only without EXECUTOR_PORT, which wins over it.
+          const saved = { EXECUTOR_PORT: undefined };
+          const next = yield* freePort.pipe(
+            Effect.repeat({ until: (port) => port !== cli.port, times: 5 }),
+          );
+          expect(next).not.toBe(cli.port);
+
+          const set = yield* cli.run(["service", "set", "port", String(cli.port)], saved);
+          expect(set.code, set.stderr).toBe(0);
+          const started = yield* cli.run(["service", "start"], saved);
+          expect(started.code, started.stderr).toBe(0);
+          expect(started.stdout.trim()).toBe(cli.url);
+          const first = yield* cli.registered;
+
+          // Changing the port stops the running server, so the next start uses the new one.
+          const changed = yield* cli.run(["service", "set", "port", String(next)], saved);
+          expect(changed.code, changed.stderr).toBe(0);
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          expect(yield* cli.alive(first.pid)).toBe(false);
+          expect(yield* cli.refused(cli.port)).toBe(true);
+          const read = yield* cli.run(["service", "get", "port"], saved);
+          expect(read.code, read.stderr).toBe(0);
+          expect(read.stdout.trim()).toBe(String(next));
+
+          const restarted = yield* cli.run(["service", "start"], saved);
+          expect(restarted.code, restarted.stderr).toBe(0);
+          const url = `http://127.0.0.1:${next}`;
+          expect(restarted.stdout.trim()).toBe(url);
+          const second = yield* cli.registered;
+          expect(second.url).toBe(url);
+          expect((yield* cli.info(url)).body).toEqual({
+            id: second.id,
+            version: second.version,
+            pid: second.pid,
+            status: "ready",
+          });
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceDirectoryLock.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const cli = yield* backgroundServiceCli();
+          const foreground = yield* cli.start(["serve"], (line) => line === `Executor: ${cli.url}`);
+          const other = yield* freePort;
+
+          // A second server for the same data directory on another port stops before storage, and
+          // names the registered server that holds it.
+          const second = yield* cli.run(["serve"], { EXECUTOR_PORT: String(other) });
+          expect(second.code).toBe(1);
+          expect(second.stderr).toContain(
+            `The background Executor already serves the data directory ${cli.data} at ${cli.url}. Stop it with \`executor service stop\`, or set EXECUTOR_DATA_DIR to another folder.`,
+          );
+
+          // On the registered server's own port, it is that server that holds the directory.
+          const same = yield* cli.run(["serve"]);
+          expect(same.code).toBe(1);
+          expect(same.stderr).toContain(
+            `The background Executor already serves the data directory ${cli.data} at ${cli.url}. Stop it with \`executor service stop\``,
+          );
+          expect(same.stderr).not.toContain("in use by another program");
+
+          // The first one keeps serving the directory, registered as the one the CLI shares.
+          const registration = yield* cli.registered;
+          expect(registration.pid).toBe(foreground.child.pid);
+          expect((yield* cli.info(cli.url)).body).toEqual({
+            id: registration.id,
+            version: registration.version,
+            pid: registration.pid,
+            status: "ready",
+          });
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceStopping.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const server = yield* cli.registered;
+
+          // The server is asked to stop and takes seconds to exit, answering meanwhile that it is
+          // stopping; a stand-in answers in its place for those seconds.
+          yield* crashServer(server.pid);
+          yield* eventually(cli.refused(cli.port), (refused) => refused, "15 seconds");
+          const scope = yield* Effect.scope;
+          const restarted = yield* Effect.scoped(
+            Effect.gen(function* () {
+              const stopping = yield* stoppingServer(server);
+              const status = yield* cli.run(["service", "status"]);
+              expect(status.code, status.stderr).toBe(0);
+              expect(status.stdout.trim()).toBe(
+                `stopping ${cli.url} (version ${server.version}, process ${server.pid})`,
+              );
+
+              // A start waits for it to exit, asking it again and again, and neither joins it nor
+              // asks it to stop.
+              const seen = yield* stopping.answered;
+              const start = yield* Effect.forkIn(cli.run(["service", "start"]), scope);
+              yield* eventually(
+                stopping.answered,
+                (answered) => answered >= seen + 20,
+                "30 seconds",
+              );
+              expect(start.pollUnsafe()).toBeUndefined();
+              expect(
+                (yield* stopping.requests).filter((request) => request !== "GET /api/service"),
+              ).toEqual([]);
+              return start;
+            }),
+          );
+
+          // Once it has gone, the start starts a server in its place.
+          const result = yield* Fiber.join(restarted);
+          expect(result.code, result.stderr).toBe(0);
+          expect(result.stdout.trim()).toBe(cli.url);
+          const next = yield* cli.registered;
+          expect(next.pid).not.toBe(server.pid);
+          expect((yield* cli.info(cli.url)).body).toEqual({
+            id: next.id,
+            version: next.version,
+            pid: next.pid,
+            status: "ready",
+          });
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceSuspendedLock.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const evidence = yield* Evidence;
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const server = yield* cli.registered;
+          const lock = yield* lockOf(cli.data);
+          expect(yield* lock.holder).toEqual(Option.some({ pid: server.pid, port: cli.port }));
+
+          // The server stops running without exiting, as after Ctrl+Z, `kill -STOP` or a paused
+          // debugger, so it stops refreshing its lock too.
+          const suspendedAt = yield* Effect.scoped(
+            Effect.gen(function* () {
+              const held = yield* suspendProcess(server.pid);
+              const last = yield* lock.refreshed;
+              // A minute later its lock is twice as stale as one without an owner may get.
+              const waited = yield* eventually(
+                Clock.currentTimeMillis,
+                (now) => now - last > 61_000,
+                "90 seconds",
+              ).pipe(Effect.map((now) => now - last));
+              expect(yield* lock.refreshed).toBe(last);
+
+              // A private server and a foreground one on another port each listen, find the
+              // directory held by a process that still runs and still has its port open, and stop
+              // before storage, naming the registered server.
+              const standalone = Option.getOrUndefined(
+                yield* cli.run(["--standalone"]).pipe(Effect.timeoutOption("60 seconds")),
+              );
+              expect(standalone?.code, "`executor --standalone` still ran after 60 s").toBe(1);
+              expect(standalone?.stderr).toContain(
+                `This command's private Executor server could not start.\nThe background Executor already serves the data directory ${cli.data} at ${cli.url}.`,
+              );
+              const other = yield* freePort;
+              const foreground = Option.getOrUndefined(
+                yield* cli
+                  .run(["serve"], { EXECUTOR_PORT: String(other) })
+                  .pipe(Effect.timeoutOption("60 seconds")),
+              );
+              expect(foreground?.code, "`executor serve` still ran after 60 s").toBe(1);
+              expect(foreground?.stderr).toContain(
+                `The background Executor already serves the data directory ${cli.data} at ${cli.url}. Stop it with \`executor service stop\``,
+              );
+              expect(yield* lock.holder).toEqual(Option.some({ pid: server.pid, port: cli.port }));
+              expect(yield* lock.refreshed).toBe(last);
+
+              // `executor service status` says why no command could use it.
+              const status = yield* cli.run(["service", "status"]);
+              expect(status.code, status.stderr).toBe(0);
+              expect(status.stdout.trim()).toBe(
+                `not responding ${cli.url} (version ${server.version}, process ${server.pid})`,
+              );
+              yield* evidence.json("suspended.json", {
+                lockAgeAtRefusalsMs: (yield* Clock.currentTimeMillis) - last,
+                waitedMs: waited,
+              });
+              yield* held.resume;
+              return last;
+            }),
+          );
+
+          // Resumed, the same process serves and keeps its lock: it refreshes it again, which a
+          // server whose lock was taken would not.
+          yield* eventually(lock.refreshed, (time) => time > suspendedAt, "20 seconds");
+          expect((yield* cli.info(cli.url)).body).toEqual({
+            id: server.id,
+            version: server.version,
+            pid: server.pid,
+            status: "ready",
+          });
+          const after = yield* cli.registered;
+          expect([after.id, after.pid]).toEqual([server.id, server.pid]);
+          expect(yield* lock.holder).toEqual(Option.some({ pid: server.pid, port: cli.port }));
+          const resumed = yield* cli.run(["service", "status"]);
+          expect(resumed.stdout.trim()).toBe(
+            `${cli.url} (version ${server.version}, process ${server.pid})`,
+          );
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceCrashedLock.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem,
+            evidence = yield* Evidence;
+          const cli = yield* backgroundServiceCli();
+          const lock = yield* lockOf(cli.data);
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const first = yield* cli.registered;
+
+          // The server is killed, as by SIGKILL or a crash, so its lock and registration stay.
+          yield* crashServer(first.pid);
+          yield* eventually(cli.alive(first.pid), (alive) => !alive, "15 seconds");
+          expect(yield* lock.holder).toEqual(Option.some({ pid: first.pid, port: cli.port }));
+          expect((yield* cli.registered).id).toBe(first.id);
+
+          // The next start takes the lock over as soon as it tries, long before the 30 seconds
+          // after which a lock without an owner counts as abandoned.
+          const begun = yield* Clock.currentTimeMillis;
+          const takenOver = yield* eventually(
+            lock.owner,
+            (owner) => Option.isSome(owner) && owner.value.pid !== first.pid,
+            "60 seconds",
+          ).pipe(
+            Effect.andThen(Clock.currentTimeMillis),
+            Effect.map((now) => now - begun),
+            Effect.forkScoped({ startImmediately: true }),
+          );
+          const restarted = yield* cli.run(["service", "start"]);
+          expect(restarted.code, restarted.stderr).toBe(0);
+          const second = yield* cli.registered;
+          expect(second.pid).not.toBe(first.pid);
+          const tookMs = yield* Fiber.join(takenOver);
+          expect(yield* lock.holder).toEqual(Option.some({ pid: second.pid, port: cli.port }));
+          expect(tookMs).toBeLessThan(20_000);
+
+          // A killed server's lock as the OS would leave it once it gave the server's process ID to
+          // another running program: this test's own process, which started at another time. The
+          // lock is made to look just refreshed, as a running owner's would, so it would stay held
+          // for 30 seconds if anything but the owner's start time, or on Windows its pipe, decided.
+          const reusedBy = (server: number) =>
+            Effect.gen(function* () {
+              yield* crashServer(server);
+              yield* eventually(cli.alive(server), (alive) => !alive, "15 seconds");
+              const recorded = yield* lock.owner;
+              if (Option.isNone(recorded))
+                return yield* Effect.die("The killed server left no owner");
+              // The server recorded when it started and on which boot, which tell it apart, or on
+              // Windows the pipe it listened on, which Windows removed when it was killed.
+              expect(recorded.value).toMatchObject(
+                process.platform === "win32"
+                  ? { pid: server, pipe: expect.stringMatching(lockPipe) }
+                  : { pid: server, started: expect.any(String), boot: expect.any(String) },
+              );
+              yield* fs.writeFileString(
+                lock.ownerFile,
+                JSON.stringify({ ...recorded.value, pid: process.pid }),
+              );
+              // A number is a time in seconds, as for Node's utimes.
+              const now = (yield* Clock.currentTimeMillis) / 1_000;
+              yield* fs.utimes(lock.file, now, now);
+              expect(Math.abs(now * 1_000 - (yield* lock.refreshed))).toBeLessThan(2_000);
+            });
+          /** Start a foreground server on a free port: how long it took to take the lock. */
+          const takeOver = Effect.gen(function* () {
+            const port = yield* freePort;
+            const begun = yield* Clock.currentTimeMillis;
+            const taken = yield* eventually(
+              lock.owner,
+              (owner) => Option.isSome(owner) && owner.value.pid !== process.pid,
+              "60 seconds",
+            ).pipe(
+              Effect.andThen(Clock.currentTimeMillis),
+              Effect.map((now) => now - begun),
+              Effect.forkScoped({ startImmediately: true }),
+            );
+            const server = yield* cli.start(
+              ["serve"],
+              (line) => line === `Executor: http://127.0.0.1:${port}`,
+              { EXECUTOR_PORT: String(port) },
+            );
+            const ms = yield* Fiber.join(taken);
+            expect(yield* lock.holder).toEqual(Option.some({ pid: server.child.pid, port }));
+            return { server, port, ms };
+          });
+
+          // Killed again, its process ID now names this test's process, and its port is closed. A
+          // server on another port takes the lock over at once.
+          yield* reusedBy(second.pid);
+          const third = yield* takeOver;
+          expect(third.ms).toBeLessThan(20_000);
+
+          // Killed once more, and both its process ID and its port are now another program's: the
+          // port accepts connections and answers, as no Executor does. The lock is still
+          // abandoned, and the next server takes it over at once.
+          yield* reusedBy(third.server.child.pid);
+          yield* eventually(cli.refused(third.port), (refused) => refused, "15 seconds");
+          yield* serving(
+            HttpRouter.add("*", "/*", Effect.succeed(HttpServerResponse.empty({ status: 404 }))),
+            third.port,
+          );
+          const fourth = yield* takeOver;
+          expect(fourth.ms).toBeLessThan(20_000);
+          yield* evidence.json("takeovers.json", {
+            tookMs,
+            reusedPidMs: third.ms,
+            reusedPidAndPortMs: fourth.ms,
+          });
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceReusedPid.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem,
+            processes = yield* ChildProcessSpawner.ChildProcessSpawner,
+            evidence = yield* Evidence;
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const server = yield* cli.registered;
+          const registration = yield* fs
+            .readFileString(cli.registrationFile)
+            .pipe(Effect.flatMap(Schema.decodeUnknownEffect(RecordJson)));
+          // On Linux and macOS the registration records when the server started and on which
+          // boot. On Windows it names only the pid, and the data directory's lock names the same
+          // pid with the pipe the server listens on.
+          if (process.platform === "win32") {
+            expect(registration).toMatchObject({ pid: server.pid, group: true });
+            expect(registration).not.toHaveProperty("started");
+            expect(Option.getOrUndefined(yield* (yield* lockOf(cli.data)).owner)).toMatchObject({
+              pid: server.pid,
+              pipe: expect.stringMatching(lockPipe),
+            });
+          } else {
+            expect(registration).toMatchObject({
+              pid: server.pid,
+              group: true,
+              started: expect.any(String),
+              boot: expect.any(String),
+            });
+          }
+
+          // The server is killed, and the OS gives its process ID to another program that leads
+          // its own process group, as a background server does. Another program takes its port,
+          // accepting connections and never answering, as a hung server would.
+          yield* crashServer(server.pid);
+          yield* eventually(cli.alive(server.pid), (alive) => !alive, "15 seconds");
+          yield* eventually(cli.refused(cli.port), (refused) => refused, "15 seconds");
+          const unrelated = yield* processes.spawn(
+            ChildProcess.make(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {
+              stdout: "ignore",
+              stderr: "ignore",
+            }),
+          );
+          yield* serving(HttpRouter.add("*", "/*", Effect.never), cli.port);
+          const reuse = fs.writeFileString(
+            cli.registrationFile,
+            JSON.stringify({ ...registration, pid: unrelated.pid }),
+          );
+
+          // `executor service stop` gets no answer, finds that the process with that ID started
+          // after the server did, or on Windows that the lock names another process, and removes
+          // the registration without signalling it.
+          yield* reuse;
+          const stopped = yield* cli.run(["service", "stop"]);
+          expect(stopped.code, stopped.stderr).toBe(0);
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          const status = yield* cli.run(["service", "status"]);
+          expect(status.stdout.trim()).toBe("stopped");
+          expect(yield* cli.alive(unrelated.pid)).toBe(true);
+
+          // A start counts the registration as hung after three unanswered requests and removes
+          // it the same way. Its server then finds the port taken by another program.
+          yield* reuse;
+          const restarted = yield* cli.run(["service", "start"]);
+          expect(restarted.code).toBe(1);
+          expect(restarted.stderr).toContain(
+            `Port ${cli.port} is already in use by another program.`,
+          );
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          yield* Effect.sleep("1 second");
+          expect(yield* cli.alive(unrelated.pid)).toBe(true);
+          expect(yield* unrelated.isRunning).toBe(true);
+          yield* evidence.json("reused-pid.json", {
+            server: server.pid,
+            unrelated: unrelated.pid,
+            stopCode: stopped.code,
+            startCode: restarted.code,
+          });
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceKeyStorageInvalid.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          const refusal =
+            'EXECUTOR_KEY_STORAGE must be "file" (keep keys in keys.json) or "os" (OS credential store only), or unset. Nothing was changed.';
+
+          // Each way to start a server refuses the value before it creates the data directory.
+          for (const args of [["service", "start"], [], ["--standalone"], ["serve"]]) {
+            const refused = yield* cli.run(args, { EXECUTOR_KEY_STORAGE: "keyring" });
+            expect(refused.code, refused.stdout).toBe(1);
+            expect(refused.stderr).toContain(refusal);
+            expect(refused.stdout).not.toContain("#pair=");
+            expect(yield* fs.exists(cli.data)).toBe(false);
+          }
+          expect(yield* cli.refused(cli.port)).toBe(true);
+
+          // Saved as a setting, which servers a client starts run with, the setting wins over the
+          // environment's valid value, and nothing but the setting is written.
+          const saved = yield* cli.run([
+            "service",
+            "set",
+            "env",
+            "EXECUTOR_KEY_STORAGE",
+            "keyring",
+          ]);
+          expect(saved.code, saved.stderr).toBe(0);
+          for (const args of [["service", "start"], []]) {
+            const refused = yield* cli.run(args);
+            expect(refused.code, refused.stdout).toBe(1);
+            expect(refused.stderr).toContain(
+              `The background Executor could not start.\n${refusal}`,
+            );
+            expect(yield* fs.readDirectory(cli.data)).toEqual(["service.json"]);
+          }
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+
+          // Once the setting is removed, the same command starts the server.
+          const unset = yield* cli.run(["service", "unset", "env", "EXECUTOR_KEY_STORAGE"]);
+          expect(unset.code, unset.stderr).toBe(0);
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          expect(started.stdout.trim()).toBe(cli.url);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceAppsCli.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          // No --host or EXECUTOR_HOST: the command starts the background server and uses its
+          // registered password, with no API key supplied.
+          const listed = yield* cli.run(["apps", "list"]);
+          expect(listed.code, listed.stderr).toBe(0);
+          expect(listed.stderr).toContain(starting);
+          const apps = yield* Schema.decodeUnknownEffect(Apps)(listed.stdout);
+          expect(apps.map((app) => app.slug)).toContain("executor");
+          const registration = yield* cli.registered;
+          expect(registration.url).toBe(cli.url);
+          expect((yield* cli.info(cli.url)).body.pid).toBe(registration.pid);
+
+          // The next command reuses it.
+          const again = yield* cli.run(["apps", "list"]);
+          expect(again.code, again.stderr).toBe(0);
+          expect(again.stderr).not.toContain(starting);
+          expect(yield* Schema.decodeUnknownEffect(Apps)(again.stdout)).toEqual(apps);
+          const after = yield* cli.registered;
+          expect([after.id, after.pid]).toEqual([registration.id, registration.pid]);
+
+          // With the service disabled, the command runs a private server for its duration.
+          const disabled = yield* cli.run(["service", "set", "disabled", "true"]);
+          expect(disabled.code, disabled.stderr).toBe(0);
+          expect(yield* cli.alive(registration.pid)).toBe(false);
+          const own = yield* cli.run(["apps", "list"]);
+          expect(own.code, own.stderr).toBe(0);
+          expect(own.stderr).not.toContain(starting);
+          expect(yield* Schema.decodeUnknownEffect(Apps)(own.stdout)).toEqual(apps);
+          expect(yield* fs.exists(cli.registrationFile)).toBe(false);
+          expect(yield* cli.refused(cli.port)).toBe(true);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+
+  it.effect(
+    scenarios.localServiceEarlierServer.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const cli = yield* backgroundServiceCli();
+          // server.json as an Executor from before the background service wrote it. The process it
+          // names runs: this test's own. That Executor took no lock, so only the record shows it.
+          const recordOf = (url: string) =>
+            JSON.stringify({
+              pid: process.pid,
+              version: "2.0.0-beta.15",
+              url,
+              command: "executor serve",
+            });
+          yield* fs.makeDirectory(cli.data, { recursive: true });
+
+          // That Executor still answers at its URL, as its session route does for any loopback
+          // request.
+          const earlier = yield* Effect.scoped(
+            Effect.gen(function* () {
+              const url = yield* serving(
+                HttpRouter.add(
+                  "GET",
+                  "/auth/session",
+                  HttpServerResponse.jsonUnsafe({ authenticated: false }),
+                ),
+              );
+              const record = recordOf(url);
+              yield* fs.writeFileString(cli.registrationFile, record);
+              for (const args of [["service", "start"], ["serve"]]) {
+                const refused = yield* cli.run(args);
+                expect(refused.code).toBe(1);
+                expect(refused.stderr).toContain(
+                  `An Executor from before the background service (process ${process.pid}) is using the data directory ${cli.data} at ${url}.`,
+                );
+                expect(refused.stderr).not.toContain(starting);
+              }
+              // Nothing listened or replaced the record.
+              expect(yield* cli.refused(cli.port)).toBe(true);
+              expect(yield* fs.readFileString(cli.registrationFile)).toBe(record);
+              return url;
+            }),
+          );
+
+          // Once nothing answers there, the record was left by a killed Executor whose process ID
+          // another program now has. It is ignored, and a server starts in its place.
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          expect(started.stdout.trim()).toBe(cli.url);
+          expect(started.stderr).toContain(
+            `Ignoring ${cli.registrationFile}: it names process ${process.pid}, but no Executor answers at ${earlier}.`,
+          );
+          expect((yield* cli.registered).url).toBe(cli.url);
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+  it.effect(
+    scenarios.localServiceImpostor.title,
+    (context) =>
+      withCase(
+        context,
+        Effect.gen(function* () {
+          const http = yield* HttpClient.HttpClient,
+            evidence = yield* Evidence;
+          const cli = yield* backgroundServiceCli();
+          const started = yield* cli.run(["service", "start"]);
+          expect(started.code, started.stderr).toBe(0);
+          const registration = yield* cli.registered;
+          const password = Redacted.value(registration.password);
+          // What the server proved to one client that challenged it, as anyone on the machine can
+          // ask for and record: a proof only for that challenge.
+          const replayedChallenge = "e2e-recorded-challenge-0123456789";
+          const recorded = yield* http
+            .get(`${cli.url}/api/service?challenge=${replayedChallenge}`)
+            .pipe(Effect.flatMap((response) => response.json));
+          expect(recorded).toMatchObject({
+            id: registration.id,
+            pid: registration.pid,
+            status: "ready",
+            proof: expect.stringMatching(/^[\w-]{43}$/u),
+          });
+
+          // The server dies without removing its registration, as after SIGKILL or a power loss.
+          yield* crashServer(registration.pid);
+          expect(yield* eventually(cli.refused(cli.port), (refused) => refused, "15 seconds")).toBe(
+            true,
+          );
+          expect((yield* cli.registered).id).toBe(registration.id);
+
+          // Another process takes the registered port and replays that answer, proof included.
+          yield* Effect.scoped(
+            Effect.gen(function* () {
+              const requests = yield* Ref.make<
+                ReadonlyArray<{
+                  readonly url: string;
+                  readonly headers: Readonly<Record<string, string>>;
+                  readonly body: string;
+                }>
+              >([]);
+              yield* serving(
+                HttpRouter.add(
+                  "*",
+                  "/*",
+                  Effect.gen(function* () {
+                    const request = yield* HttpServerRequest.HttpServerRequest;
+                    const body = yield* request.text.pipe(Effect.orElseSucceed(() => ""));
+                    yield* Ref.update(requests, (seen) => [
+                      ...seen,
+                      { url: request.url, headers: { ...request.headers }, body },
+                    ]);
+                    return request.url.startsWith("/api/service")
+                      ? HttpServerResponse.jsonUnsafe(recorded)
+                      : HttpServerResponse.empty({ status: 404 });
+                  }),
+                ),
+                cli.port,
+              );
+
+              // Its proof is for another challenge, so it is not the server.
+              const status = yield* cli.run(["service", "status"]);
+              expect(status.code, status.stderr).toBe(0);
+              expect(status.stdout.trim()).toBe("stopped");
+
+              // `executor` neither pairs with it nor sends it the password. It cannot take the
+              // port either, so it says another Executor holds it.
+              const joined = yield* cli.run([]);
+              expect(joined.code).toBe(1);
+              expect(joined.stderr).toContain(
+                `Port ${cli.port} is already in use by another Executor server, for another data directory.`,
+              );
+              expect(joined.stdout).not.toContain("#pair=");
+              expect(yield* cli.opened).toEqual([]);
+              const seen = yield* Ref.get(requests);
+              yield* evidence.json("impostor-requests.json", {
+                requests: seen.length,
+                first: seen.slice(0, 3).map(({ url }) => url),
+              });
+              // Each client challenged it afresh, and asked it nothing else.
+              const challenges = seen.map(
+                ({ url }) => new URL(url, "http://127.0.0.1").searchParams.get("challenge") ?? "",
+              );
+              expect(challenges.length).toBeGreaterThan(0);
+              expect(seen.filter(({ url }) => !url.startsWith("/api/service?"))).toEqual([]);
+              expect(challenges.filter((challenge) => challenge === replayedChallenge)).toEqual([]);
+              // The password is nowhere in what it received: not in a URL, a header or a body.
+              expect(
+                seen.filter(
+                  ({ url, headers, body }) =>
+                    decodeURIComponent(url).includes(password) ||
+                    Object.values(headers).some((value) => value.includes(password)) ||
+                    body.includes(password),
+                ),
+              ).toEqual([]);
+            }),
+          );
+        }),
+      ),
+    { timeout: 300_000 },
+  );
+});
diff --git a/e2e/tests/local-skills.spec.ts b/e2e/tests/local-skills.spec.ts
index a6fd967df4..06f7f81c61 100644
--- a/e2e/tests/local-skills.spec.ts
+++ b/e2e/tests/local-skills.spec.ts
@@ -10,6 +10,7 @@ import { Evidence } from "../support/evidence.ts";
 import { appsManifest } from "../support/apps-release.ts";
 import { connectAccountsThroughOtherApp } from "../support/app-accounts.ts";
 import { wholeStringInputPattern } from "../support/mcp-input-patterns.ts";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
 
 const App = Schema.Struct({
   id: Schema.String,
@@ -32,6 +33,27 @@ const Document = Schema.Struct({
   version: Schema.String,
   files: Schema.Array(Schema.String),
 });
+const Listed = Schema.Struct({
+  tools: Schema.Array(
+    Schema.Struct({
+      name: Schema.String,
+      description: Schema.optional(Schema.String),
+      inputSchema: Schema.Record(Schema.String, Schema.Unknown),
+    }),
+  ),
+});
+const SkillsInput = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));
+/**
+ * The `skills` inputs a text shows. The `skills` description shows them as bare objects; every
+ * other text shows a concrete call as `skills({...})`. Keys may be unquoted and strings may use
+ * single quotes, as in the descriptions.
+ */
+const skillsExamples = (text: string, bare: boolean) =>
+  [...text.matchAll(bare ? /\{[^{}]*\}/g : /skills\((\{[^{}]*\})\)/g)].map((match) =>
+    (match[1] ?? match[0])
+      .replaceAll("'", '"')
+      .replace(/([{,]\s*)([A-Za-z_$][\w$]*)\s*:/g, '$1"$2":'),
+  );
 const files = (version: string) => [
   {
     path: "index.ts",
@@ -421,4 +443,144 @@ return { sameAccount: target.account === read.id && read.id === updated.id, labe
       }).pipe(Effect.provide(McpClient.layer)),
     ),
   );
+  it.effect(scenarios.localSkillsInputSchema.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          mcp = yield* McpClient;
+        // MCP tool input schemas use JSON Schema 2020-12, which this validator implements.
+        const validator = new CfWorkerJsonSchemaValidator();
+        const client = yield* mcp.connect(target.apiKey, "skills-input-schema");
+        const call = (step: string, input: Record<string, unknown>) =>
+          client.use(step, (client, signal) =>
+            client.callTool({ name: "skills", arguments: input }, undefined, { signal }),
+          );
+        // Every text an agent reads before calling skills: each mode's tool descriptions and
+        // the server instructions, which are the Executor app's entry skill.
+        const texts: { readonly source: string; readonly examples: ReadonlyArray<string> }[] = [];
+        let advertised: Record<string, unknown> | undefined;
+        for (const mode of ["model", "native", "browser"] as const) {
+          const connection = yield* mcp.connect(target.apiKey, `skills-guidance-${mode}`, {
+            mode,
+          });
+          const listed = yield* Schema.decodeUnknownEffect(Listed)(
+            yield* connection.use(`List the ${mode} mode tools`, (client) => client.listTools()),
+          );
+          for (const tool of listed.tools) {
+            if (tool.name === "skills") advertised ??= tool.inputSchema;
+            texts.push({
+              source: `${mode} ${tool.name} description`,
+              examples: skillsExamples(tool.description ?? "", tool.name === "skills"),
+            });
+          }
+          const instructions = yield* connection.use(
+            `Read the ${mode} mode instructions`,
+            (client) => Promise.resolve(client.getInstructions() ?? ""),
+          );
+          texts.push({
+            source: `${mode} instructions`,
+            examples: skillsExamples(instructions, false),
+          });
+        }
+        if (advertised === undefined)
+          return yield* Effect.die("Every MCP mode must list the skills tool");
+        const accepts = validator.getValidator(advertised);
+
+        // The advertised schema and the runtime agree on every read shape, and both refuse a
+        // document or reference without its app or skill.
+        const index = yield* Schema.decodeUnknownEffect(Index)(
+          (yield* call("List every skill", {})).structuredContent,
+        );
+        const guide = index.skills.find(
+          (skill) => skill.name === "executor" && skill.app.slug === "executor",
+        );
+        if (guide === undefined)
+          return yield* Effect.die("The Executor app must publish its entry skill");
+        const shapes: ReadonlyArray<readonly [Record<string, unknown>, boolean]> = [
+          [{}, true],
+          [{ app: "executor" }, true],
+          [{ app: "executor", name: "executor" }, true],
+          [{ app: "executor", name: "executor", file: "feedback.md" }, true],
+          [{ name: "executor" }, false],
+          [{ name: "executor", version: guide.version }, false],
+          [{ revision: guide.revision }, false],
+          [{ file: "feedback.md" }, false],
+          [{ app: "executor", file: "feedback.md" }, false],
+        ];
+        for (const [input, valid] of shapes) {
+          const result = yield* call(`Call skills with ${JSON.stringify(input)}`, input);
+          expect({
+            input,
+            schema: accepts(input).valid,
+            runtime: result.isError !== true,
+          }).toEqual({ input, schema: valid, runtime: valid });
+        }
+        const refused = yield* call("Read a skill without its app", { name: "executor" });
+        // The refusal names the call that works.
+        expect(refused.content).toEqual([
+          {
+            type: "text",
+            text: expect.stringContaining('{app: "executor", name: "executor"}'),
+          },
+        ]);
+
+        // Every Executor app skill document and reference: the guidance agents read next.
+        const listed = yield* Schema.decodeUnknownEffect(Index)(
+          (yield* call("List the Executor app's skills", { app: guide.app.slug }))
+            .structuredContent,
+        );
+        for (const skill of listed.skills) {
+          const document = yield* Schema.decodeUnknownEffect(Document)(
+            (yield* call(`Read the ${skill.name} skill`, { app: skill.app.slug, name: skill.name }))
+              .structuredContent,
+          );
+          texts.push({
+            source: `${skill.name}/SKILL.md`,
+            examples: skillsExamples(document.content, false),
+          });
+          for (const file of document.files.filter((file) => file !== "SKILL.md")) {
+            const reference = yield* Schema.decodeUnknownEffect(Document)(
+              (yield* call(`Read ${skill.name}/${file}`, {
+                app: skill.app.slug,
+                name: skill.name,
+                file,
+                version: skill.version,
+                revision: skill.revision,
+              })).structuredContent,
+            );
+            texts.push({
+              source: `${skill.name}/${file}`,
+              examples: skillsExamples(reference.content, false),
+            });
+          }
+        }
+        // The texts that send agents to skills give a call they can make.
+        for (const source of [
+          "model skills description",
+          "model execute description",
+          "native execute description",
+          "browser execute description",
+          "model instructions",
+        ])
+          expect(
+            texts.find((text) => text.source === source)?.examples.length ?? 0,
+            source,
+          ).toBeGreaterThan(0);
+        const examples = new Map<string, string>();
+        for (const text of texts)
+          for (const example of text.examples)
+            if (!examples.has(example)) examples.set(example, text.source);
+        for (const [example, source] of examples) {
+          const input = yield* Schema.decodeUnknownEffect(SkillsInput)(example);
+          expect(accepts(input).valid, `${source}: ${example}`).toBe(true);
+          const result = yield* call(`Run the ${source} example ${example}`, input);
+          expect(
+            result.isError,
+            `${source}: ${example} ${JSON.stringify(result.content)}`,
+          ).not.toBe(true);
+        }
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
 });
diff --git a/e2e/tests/local-upgrade.spec.ts b/e2e/tests/local-upgrade.spec.ts
index a9f9cad28c..d0c0f10849 100644
--- a/e2e/tests/local-upgrade.spec.ts
+++ b/e2e/tests/local-upgrade.spec.ts
@@ -3,23 +3,30 @@
  * against a fake npm registry and fake package managers on PATH. The fakes record how they were
  * called and install an `executor` command that prints the version they were asked for, so the
  * scenario sees what the CLI ran and what it verified without touching this machine's installs.
+ * A background server runs for part of it: the upgrade stops it before installing and starts it
+ * on the new version, or on the old one when the install fails.
  *
  * A release executable is also run from the install script's layout, upgrading from a fake release
  * download: it checks the archive against SHA256SUMS, switches `current`, keeps the version it
- * replaced and rolls back to it.
+ * replaced and rolls back to it, with its background server following each switch.
  */
 import { expect, layer } from "@effect/vitest";
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http";
-import { Config, Deferred, Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
+import { Config, Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
 import { HttpRouter, HttpServer, HttpServerResponse } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { scenarios } from "../test-plan.ts";
 import { TestLive, withCase } from "../support/case.ts";
 import { Evidence } from "../support/evidence.ts";
 import { freePort } from "../support/ports.ts";
-import { isScript, localEntryCommand } from "../support/local-entry.ts";
+import {
+  answersAsServer,
+  crashServer,
+  ServiceRegistration,
+} from "../support/background-service.ts";
+import { isScript } from "../support/local-entry.ts";
 import { shadowInstall } from "../support/stand-in-package.ts";
 
 const Call = Schema.fromJsonString(
@@ -27,13 +34,17 @@ const Call = Schema.fromJsonString(
 );
 
 /**
- * A package manager stand-in. It records its arguments; then, by FAKE_PM_MODE, it installs a
- * working `executor`, installs one that cannot start, or fails as a registry error would.
+ * A package manager stand-in. It records its arguments, and with FAKE_PM_SERVER_LOG whether the
+ * data directory had a registered server while it ran. Then, by FAKE_PM_MODE, it installs an
+ * `executor` that only prints its version, one that cannot start, or (`cli`) one that runs the
+ * checkout's CLI (FAKE_PM_CLI) as that version; or it fails as a registry error would.
  */
-const fakePackageManager = `import { appendFileSync, chmodSync, writeFileSync } from "node:fs";
+const fakePackageManager = `import { appendFileSync, chmodSync, existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 const [name, ...args] = process.argv.slice(2);
 appendFileSync(process.env.FAKE_PM_LOG, JSON.stringify({ name, args }) + "\\n");
+if (process.env.FAKE_PM_SERVER_LOG !== undefined)
+  appendFileSync(process.env.FAKE_PM_SERVER_LOG, (existsSync(join(process.env.EXECUTOR_DATA_DIR, "server.json")) ? "registered" : "none") + "\\n");
 const mode = process.env.FAKE_PM_MODE ?? "install";
 if (mode === "fail") {
   console.error(name + " error: 503 Service Unavailable from the fake registry");
@@ -42,14 +53,20 @@ if (mode === "fail") {
 const version = args.find((arg) => arg.startsWith("executor@")).slice("executor@".length);
 console.log("installed executor@" + version + " with fake " + name);
 const directory = process.env.FAKE_PM_BIN;
+const node = JSON.stringify(process.execPath);
+const cli = JSON.stringify(process.env.FAKE_PM_CLI ?? "");
 if (process.platform === "win32") {
   writeFileSync(join(directory, "executor.cmd"), mode === "broken"
     ? "@echo off\\r\\necho Executor's native runtime is missing. 1>&2\\r\\nexit /b 1\\r\\n"
-    : "@echo off\\r\\necho executor v" + version + "\\r\\n");
+    : mode === "cli"
+      ? "@echo off\\r\\nset EXECUTOR_BUILD_VERSION=" + version + "\\r\\n" + node + " " + cli + " %*\\r\\n"
+      : "@echo off\\r\\necho executor v" + version + "\\r\\n");
 } else {
   writeFileSync(join(directory, "executor"), mode === "broken"
     ? "#!/bin/sh\\necho \\"Executor's native runtime is missing.\\" >&2\\nexit 1\\n"
-    : "#!/bin/sh\\necho \\"executor v" + version + "\\"\\n");
+    : mode === "cli"
+      ? "#!/bin/sh\\nEXECUTOR_BUILD_VERSION=" + version + " exec " + node + " " + cli + " \\"$@\\"\\n"
+      : "#!/bin/sh\\necho \\"executor v" + version + "\\"\\n");
   chmodSync(join(directory, "executor"), 0o755);
 }
 `;
@@ -57,6 +74,7 @@ if (process.platform === "win32") {
 /**
  * A release executable in the install script's layout upgrades from a fake release download,
  * refuses an archive that does not match SHA256SUMS, and rolls back to the version it replaced.
+ * The background server it runs stops for each switch and starts again on the version switched to.
  */
 const standaloneUpgrade = (options: {
   readonly root: string;
@@ -65,6 +83,10 @@ const standaloneUpgrade = (options: {
   readonly environment: (extra: Readonly<Record<string, string>>) => Record<string, string>;
   readonly downloads: Map<string, Uint8Array>;
   readonly registryUrl: string;
+  /** What a background server needs in this scenario. */
+  readonly serving: Readonly<Record<string, string>>;
+  /** The checkout's CLI, which stands in for a release that runs a server. */
+  readonly cli: string;
 }) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -78,18 +100,23 @@ const standaloneUpgrade = (options: {
     yield* shadowInstall(options.entry, path.join(versions, options.version));
     const current = path.join(runtime, "current");
     yield* fs.symlink(path.join(versions, options.version), current);
-    const exec = (command: string, args: ReadonlyArray<string>, cwd = options.root) =>
+    const exec = (
+      command: string,
+      args: ReadonlyArray<string>,
+      settings: { readonly cwd?: string; readonly env?: Readonly<Record<string, string>> } = {},
+    ) =>
       Effect.scoped(
         Effect.gen(function* () {
           const child = yield* processes.spawn(
             ChildProcess.make(command, args, {
-              cwd,
+              cwd: settings.cwd ?? options.root,
               extendEnv: false,
               env: options.environment({
                 EXECUTOR_DOWNLOAD_URL: `${options.registryUrl}/download`,
                 HOME: path.join(options.root, "home"),
                 USERPROFILE: path.join(options.root, "home"),
                 PATH: process.env.PATH ?? "",
+                ...settings.env,
               }),
               stdout: "pipe",
               stderr: "pipe",
@@ -103,23 +130,40 @@ const standaloneUpgrade = (options: {
               child.stderr.pipe(Stream.decodeText(), Stream.mkString),
             ],
             { concurrency: 3 },
-          ).pipe(Effect.timeout("120 seconds"));
+          ).pipe(Effect.timeout("150 seconds"));
           return { code: Number(code), stdout, stderr };
         }),
       );
-    /** Publish a release whose executable prints `reports`, with `listed` as its SHA256SUMS digest. */
-    const publish = (release: string, reports: string, listed?: string) =>
+    /**
+     * Publish a release whose executable prints `reports`, with `listed` as its SHA256SUMS digest.
+     * With `cli`, the executable runs the checkout's CLI as version `reports` instead.
+     */
+    const publish = (
+      release: string,
+      reports: string,
+      settings: { readonly listed?: string; readonly cli?: boolean } = {},
+    ) =>
       Effect.gen(function* () {
         const work = yield* fs.makeTempDirectoryScoped({ prefix: "executor-release-" });
         yield* fs.makeDirectory(path.join(work, "package"));
         yield* fs.writeFileString(
           path.join(work, "stub.mjs"),
-          `console.log(${JSON.stringify(`executor v${reports}`)});\n`,
+          settings.cli === true
+            ? [
+                'import { spawnSync } from "node:child_process";',
+                `const result = spawnSync(${JSON.stringify(process.execPath)}, [${JSON.stringify(options.cli)}, ...process.argv.slice(2)], {`,
+                '  stdio: "inherit",',
+                `  env: { ...process.env, EXECUTOR_BUILD_VERSION: ${JSON.stringify(reports)} },`,
+                "});",
+                "process.exit(result.status ?? 1);",
+                "",
+              ].join("\n")
+            : `console.log(${JSON.stringify(`executor v${reports}`)});\n`,
         );
         const built = yield* exec(
           "bun",
           ["build", "--compile", "stub.mjs", "--outfile", path.join("package", executableName)],
-          work,
+          { cwd: work },
         );
         expect(built.code, built.stderr).toBe(0);
         const file = `executor-${release}-${process.platform}-${process.arch}.tgz`;
@@ -127,14 +171,14 @@ const standaloneUpgrade = (options: {
         const tar = windows
           ? path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe")
           : "tar";
-        const packed = yield* exec(tar, ["-czf", file, "package"], work);
+        const packed = yield* exec(tar, ["-czf", file, "package"], { cwd: work });
         expect(packed.code, packed.stderr).toBe(0);
         const bytes = yield* fs.readFile(path.join(work, file));
         const digest = createHash("sha256").update(bytes).digest("hex");
         options.downloads.set(`executor@${release}/${file}`, bytes);
         options.downloads.set(
           `executor@${release}/SHA256SUMS`,
-          new TextEncoder().encode(`${listed ?? digest}  ./${file}\n`),
+          new TextEncoder().encode(`${settings.listed ?? digest}  ./${file}\n`),
         );
       });
     const linked = (name: "current" | "previous") =>
@@ -142,45 +186,81 @@ const standaloneUpgrade = (options: {
         Effect.map((target) => path.basename(path.resolve(runtime, target))),
         Effect.orElseSucceed(() => undefined),
       );
+    const previous = path.join(versions, options.version, executableName);
+    /** What `executor service status` prints: the server's URL, version and process, or `stopped`. */
+    const status = exec(previous, ["service", "status"], { env: options.serving }).pipe(
+      Effect.map((result) => result.stdout.trim()),
+    );
+
+    // The background server runs from the version directory the upgrade replaces.
+    const started = yield* exec(path.join(current, executableName), ["service", "start"], {
+      env: options.serving,
+    });
+    expect(started.code, started.stderr).toBe(0);
+    expect(yield* status).toContain(`(version ${options.version}, process`);
 
     // The command on PATH starts current/executor, which resolves to its version directory.
-    yield* publish("2.999.0", "2.999.0");
-    const upgraded = yield* exec(path.join(current, executableName), ["upgrade", "2.999.0"]);
+    yield* publish("2.999.0", "2.999.0", { cli: true });
+    const upgraded = yield* exec(path.join(current, executableName), ["upgrade", "2.999.0"], {
+      env: options.serving,
+    });
     yield* evidence.json("standalone-upgrade.json", upgraded);
     expect(upgraded.code, upgraded.stderr).toBe(0);
+    expect(upgraded.stdout).toContain(
+      `Stopping the background Executor (v${options.version}) until the upgrade is done.`,
+    );
     expect(upgraded.stdout).toContain(
       `Upgraded Executor from v${options.version} to v2.999.0. v${options.version} stays installed`,
     );
+    expect(upgraded.stdout).toContain("Restarted the background Executor on v2.999.0.");
     expect(yield* linked("current")).toBe("2.999.0");
     expect(yield* linked("previous")).toBe(options.version);
+    expect(yield* status).toContain("(version 2.999.0, process");
     const switched = yield* exec(path.join(current, executableName), ["--version"]);
     expect(switched.stdout.trim()).toBe("executor v2.999.0");
 
-    // An archive that does not match SHA256SUMS is deleted and nothing changes.
-    yield* publish("2.998.0", "2.998.0", "0".repeat(64));
-    const previous = path.join(versions, options.version, executableName);
-    const tampered = yield* exec(previous, ["upgrade", "2.998.0", "--yes"]);
+    // An archive that does not match SHA256SUMS is deleted and nothing changes, the running
+    // server included.
+    yield* publish("2.998.0", "2.998.0", { listed: "0".repeat(64) });
+    const tampered = yield* exec(previous, ["upgrade", "2.998.0", "--yes"], {
+      env: options.serving,
+    });
     yield* evidence.json("standalone-checksum.json", tampered);
     expect(tampered.code).toBe(1);
     expect(tampered.stderr).toContain("does not match the SHA256SUMS of the v2.998.0 release");
+    expect(tampered.stdout).not.toContain("Stopping the background Executor");
     expect(yield* fs.exists(path.join(versions, "2.998.0"))).toBe(false);
     expect(yield* linked("current")).toBe("2.999.0");
 
     // An archive whose executable does not report its version is removed.
     yield* publish("2.997.0", "2.0.0");
-    const broken = yield* exec(previous, ["upgrade", "2.997.0", "--yes"]);
+    const broken = yield* exec(previous, ["upgrade", "2.997.0", "--yes"], {
+      env: options.serving,
+    });
     expect(broken.code).toBe(1);
     expect(broken.stderr).toContain("did not start");
+    expect(broken.stdout).not.toContain("Stopping the background Executor");
     expect(yield* fs.exists(path.join(versions, "2.997.0"))).toBe(false);
     expect(yield* linked("current")).toBe("2.999.0");
+    expect(yield* status).toContain("(version 2.999.0, process");
 
-    // Rollback returns to the version the upgrade replaced, and can be undone the same way.
-    const rolledBack = yield* exec(previous, ["upgrade", "--rollback", "--yes"]);
+    // Rollback returns to the version the upgrade replaced, and can be undone the same way. The
+    // server follows it back.
+    const rolledBack = yield* exec(previous, ["upgrade", "--rollback", "--yes"], {
+      env: options.serving,
+    });
     yield* evidence.json("standalone-rollback.json", rolledBack);
     expect(rolledBack.code, rolledBack.stderr).toBe(0);
+    expect(rolledBack.stdout).toContain(
+      "Stopping the background Executor (v2.999.0) until the upgrade is done.",
+    );
     expect(rolledBack.stdout).toContain(`back to v${options.version}`);
+    expect(rolledBack.stdout).toContain(
+      `Restarted the background Executor on v${options.version}.`,
+    );
     expect(yield* linked("current")).toBe(options.version);
     expect(yield* linked("previous")).toBe("2.999.0");
+    expect(yield* status).toContain(`(version ${options.version}, process`);
     const restored = yield* exec(path.join(current, executableName), ["--version"]);
     expect(restored.stdout.trim()).toBe(`executor v${options.version}`);
   });
@@ -234,7 +314,7 @@ layer(TestLive, { excludeTestServices: true })("Local upgrade", (it) => {
           // The registry's dist-tags and the Node range each release declares.
           let published: Record<string, string> = {};
           let nodeRange = ">=24.14.0";
-          // Release downloads by tag, as the public release serves them.
+          // Release downloads by tag. As on GitHub, each download redirects to the file's asset URL.
           const downloads = new Map<string, Uint8Array>();
           const services = yield* Layer.build(
             HttpRouter.serve(
@@ -261,6 +341,18 @@ layer(TestLive, { excludeTestServices: true })("Local upgrade", (it) => {
                 HttpRouter.add(
                   "GET",
                   "/download/:tag/:file",
+                  Effect.gen(function* () {
+                    const { tag, file } = yield* HttpRouter.schemaPathParams(
+                      Schema.Struct({ tag: Schema.String, file: Schema.String }),
+                    );
+                    return downloads.has(`${decodeURIComponent(tag)}/${file}`)
+                      ? HttpServerResponse.redirect(`/assets/${tag}/${file}`, { status: 302 })
+                      : HttpServerResponse.empty({ status: 404 });
+                  }).pipe(Effect.orDie),
+                ),
+                HttpRouter.add(
+                  "GET",
+                  "/assets/:tag/:file",
                   Effect.gen(function* () {
                     const { tag, file } = yield* HttpRouter.schemaPathParams(
                       Schema.Struct({ tag: Schema.String, file: Schema.String }),
@@ -367,7 +459,8 @@ layer(TestLive, { excludeTestServices: true })("Local upgrade", (it) => {
                       child.stderr.pipe(Stream.decodeText(), Stream.mkString),
                     ],
                     { concurrency: 3 },
-                  ).pipe(Effect.timeout("60 seconds"));
+                    // An upgrade may stop and start the background server.
+                  ).pipe(Effect.timeout("150 seconds"));
                   return { code: Number(code), stdout, stderr };
                 }),
               ),
@@ -489,72 +582,111 @@ layer(TestLive, { excludeTestServices: true })("Local upgrade", (it) => {
             { name: "npm", args: ["install", "-g", "executor@2.0.0-beta.1", "--include=optional"] },
           ]);
 
-          // A running server from this installation still uses the old version until restarted.
+          // A background server for this data directory, which every scenario below stops.
           const port = yield* freePort;
+          const serverLog = path.join(root, "server-seen.log");
+          // The checkout's CLI compiles its Worker host when no prepared one exists, as in the
+          // release workflow, which builds none.
+          const workerBundle = path.resolve(".local/test-runtime/host.json");
+          const prepared = yield* fs.exists(workerBundle);
+          const serving = {
+            // The installed `executor` comes first; Git and Node follow for the server.
+            PATH: [bin, process.env.PATH ?? ""].join(windows ? ";" : ":"),
+            EXECUTOR_ENVIRONMENT: "e2e",
+            // Keys stay in keys.json so no run touches the machine's OS credential store.
+            EXECUTOR_KEY_STORAGE: "file",
+            ...(prepared ? { EXECUTOR_WORKER_BUNDLE: workerBundle } : {}),
+            EXECUTOR_NO_UPDATE_CHECK: "1",
+            EXECUTOR_PORT: String(port),
+            FAKE_PM_CLI: path.resolve("apps/local/server/src/bin.ts"),
+            FAKE_PM_SERVER_LOG: serverLog,
+          };
+          /** Whether a server was registered each time the package manager ran, since the last read. */
+          const seen = Effect.gen(function* () {
+            if (!(yield* fs.exists(serverLog))) return [];
+            const lines = (yield* fs.readFileString(serverLog)).split("\n").filter(Boolean);
+            yield* fs.remove(serverLog);
+            return lines;
+          });
+          /** What `executor service status` prints: the server's URL, version and process, or `stopped`. */
+          const status = run(npm, ["service", "status"], serving).pipe(
+            Effect.map((result) => result.stdout.trim()),
+          );
+          const Registration = Schema.fromJsonString(ServiceRegistration);
+          yield* Effect.addFinalizer(() =>
+            Effect.gen(function* () {
+              yield* run(npm, ["service", "stop"], serving).pipe(Effect.ignore);
+              // A server still answering as itself is ended with its collector and workerd; a
+              // pid that does not may name another program by now.
+              const left = yield* fs
+                .readFileString(path.join(data, "server.json"))
+                .pipe(Effect.flatMap(Schema.decodeUnknownEffect(Registration)), Effect.option);
+              if (Option.isSome(left) && (yield* answersAsServer(left.value)))
+                yield* crashServer(left.value.pid);
+            }),
+          );
+          // Startup deploys the bundled Executor app, which pins this checkout's apps release.
           const registryForApps = yield* Config.NonEmptyString("E2E_NPM_REGISTRY").pipe(
             Config.option,
           );
-          yield* Effect.scoped(
-            Effect.gen(function* () {
-              // The server records its own process, which the npm launcher is not.
-              const serve = isScript(entry)
-                ? { command: process.execPath, args: [npm, "serve"] }
-                : localEntryCommand(entry, ["serve"]);
-              const server = yield* processes.spawn(
-                ChildProcess.make(serve.command, serve.args, {
-                  cwd: root,
-                  extendEnv: false,
-                  env: {
-                    ...environment({}),
-                    PATH: process.env.PATH ?? "",
-                    EXECUTOR_ENVIRONMENT: "e2e",
-                    // Keys stay in keys.json so no run touches the machine's OS credential store.
-                    EXECUTOR_KEY_STORAGE: "file",
-                    EXECUTOR_WORKER_BUNDLE: path.resolve(".local/test-runtime/host.json"),
-                    EXECUTOR_NO_UPDATE_CHECK: "1",
-                    EXECUTOR_PORT: String(port),
-                    ...(Option.isSome(registryForApps)
-                      ? { EXECUTOR_NPM_REGISTRY: registryForApps.value }
-                      : {}),
-                  },
-                  stdout: "pipe",
-                  stderr: "pipe",
-                  forceKillAfter: "3 seconds",
-                }),
-              );
-              const ready = yield* Deferred.make<void>();
-              yield* Stream.merge(server.stdout, server.stderr).pipe(
-                Stream.decodeText(),
-                Stream.splitLines,
-                Stream.runForEach((line) =>
-                  line === `Executor: http://127.0.0.1:${port}`
-                    ? Deferred.succeed(ready, undefined)
-                    : Effect.void,
-                ),
-                Effect.forkScoped,
-              );
-              yield* Effect.raceFirst(
-                Deferred.await(ready),
-                server.exitCode.pipe(
-                  Effect.flatMap((code) =>
-                    Effect.fail(new Error(`executor serve exited before readiness (${code})`)),
-                  ),
-                ),
-              ).pipe(Effect.timeout("90 seconds"));
+          if (Option.isSome(registryForApps)) {
+            const saved = yield* run(
+              npm,
+              ["service", "set", "env", "EXECUTOR_NPM_REGISTRY", registryForApps.value],
+              serving,
+            );
+            expect(saved.code, saved.stderr).toBe(0);
+          }
+          const started = yield* run(npm, ["service", "start"], serving);
+          expect(started.code, started.stderr).toBe(0);
+          expect(yield* status).toContain(`(version ${version}, process`);
 
-              const running = yield* run(npm, ["upgrade"]);
-              yield* evidence.json("running-server.json", running);
-              expect(running.code, running.stderr).toBe(0);
-              expect(running.stdout).toContain(upgraded);
-              expect(running.stdout).toContain(
-                `The Executor server at http://127.0.0.1:${port} (process ${server.pid}) is still running v${version}. Stop it, then start it again with \`executor serve\` to use v2.999.0.`,
-              );
-            }),
+          // The server stops before the package manager replaces its files, then the new
+          // `executor service start` starts it on the new version.
+          const restarted = yield* run(npm, ["upgrade"], { ...serving, FAKE_PM_MODE: "cli" });
+          yield* evidence.json("running-server.json", restarted);
+          expect(restarted.code, restarted.stderr).toBe(0);
+          expect(restarted.stdout).toContain(
+            `Stopping the background Executor (v${version}) until the upgrade is done.`,
           );
-          // Once the server has stopped, there is nothing to restart.
-          const stopped = yield* run(npm, ["upgrade"]);
+          expect(restarted.stdout).toContain(upgraded);
+          expect(restarted.stdout).toContain("Restarted the background Executor on v2.999.0.");
+          expect(yield* seen).toEqual(["none"]);
+          expect(yield* status).toContain("(version 2.999.0, process");
+          yield* calls;
+
+          // A failed install starts the stopped server again, with this CLI.
+          const failedRunning = yield* run(npm, ["upgrade"], { ...serving, FAKE_PM_MODE: "fail" });
+          yield* evidence.json("running-server-install-failed.json", failedRunning);
+          expect(failedRunning.code).toBe(1);
+          expect(failedRunning.stdout).toContain(
+            "Stopping the background Executor (v2.999.0) until the upgrade is done.",
+          );
+          expect(failedRunning.stderr).toContain(
+            "npm exited with code 1 and did not install Executor v2.999.0.",
+          );
+          expect(yield* seen).toEqual(["none"]);
+          expect(yield* status).toContain(`(version ${version}, process`);
+          yield* calls;
+
+          // A new version that does not start the server still upgrades, and says how to start it.
+          const notRestarted = yield* run(npm, ["upgrade"], serving);
+          yield* evidence.json("running-server-not-restarted.json", notRestarted);
+          expect(notRestarted.code, notRestarted.stderr).toBe(0);
+          expect(notRestarted.stdout).toContain(upgraded);
+          expect(notRestarted.stderr).toContain(
+            "The background Executor stopped for the upgrade and did not start again on v2.999.0.\nStart it with `executor service start`.",
+          );
+          expect(yield* status).toBe("stopped");
+          yield* seen;
+          yield* calls;
+
+          // With no server registered, nothing is stopped or started.
+          const stopped = yield* run(npm, ["upgrade"], serving);
           expect(stopped.code, stopped.stderr).toBe(0);
-          expect(stopped.stdout).not.toContain("still running");
+          expect(`${stopped.stdout}${stopped.stderr}`).not.toContain("background Executor");
+          expect(yield* status).toBe("stopped");
+          yield* seen;
           yield* calls;
 
           // Already current: the newest release on the channel is the installed one.
@@ -578,10 +710,19 @@ layer(TestLive, { excludeTestServices: true })("Local upgrade", (it) => {
           );
 
           if (isScript(entry)) return;
-          yield* standaloneUpgrade({ root, entry, version, environment, downloads, registryUrl });
+          yield* standaloneUpgrade({
+            root,
+            entry,
+            version,
+            environment,
+            downloads,
+            registryUrl,
+            serving,
+            cli: serving.FAKE_PM_CLI,
+          });
         }),
       ),
-    // Server readiness and every command have their own timeouts.
-    { timeout: 240_000 },
+    // Every command has its own timeout; several start and stop the background server.
+    { timeout: 480_000 },
   );
 });
diff --git a/e2e/tests/mcp-account-choice.spec.ts b/e2e/tests/mcp-account-choice.spec.ts
index de03a7ef48..cc17a3cd4e 100644
--- a/e2e/tests/mcp-account-choice.spec.ts
+++ b/e2e/tests/mcp-account-choice.spec.ts
@@ -17,6 +17,12 @@ import { App, Resource } from "../support/contracts.ts";
 import { Evidence } from "../support/evidence.ts";
 import { localAgent, localLinks } from "../support/local-links.ts";
 import { McpClient } from "../support/mcp-client.ts";
+import { siteless } from "../support/failure-site.ts";
+
+/** A tool result's text content. */
+const TextContent = Schema.Array(
+  Schema.Struct({ type: Schema.Literal("text"), text: Schema.String }),
+);
 
 const source = `import { defineApp, defineProvider, secrets, object, string, query, mutation, router, type QueryContext, type MutationContext } from "apps";
 const service = defineProvider({ name: "Account choice fixture", auth: { key: secrets({ label: "API key", fields: object({ token: string() }) }) } });
@@ -164,7 +170,12 @@ const checkNoAccountChoice = (
     });
     expect(refused.isError, JSON.stringify(refused)).toBe(true);
     // The skills tool's error text carries the code and status, as the uncaught refusal above.
-    expect(refused.content).toEqual([
+    expect(
+      Schema.decodeUnknownSync(TextContent)(refused.content).map((item) => ({
+        ...item,
+        text: siteless(item.text),
+      })),
+    ).toEqual([
       {
         type: "text",
         text: `AccountChoiceUnsupported (HTTP 400): ${unsupported} Recovery: Call again without choosing accounts. Change the app's accounts in its Accounts tab. Retryable (unchanged call): no.`,
diff --git a/e2e/tests/mcp-account-failures.spec.ts b/e2e/tests/mcp-account-failures.spec.ts
new file mode 100644
index 0000000000..382f1faf98
--- /dev/null
+++ b/e2e/tests/mcp-account-failures.spec.ts
@@ -0,0 +1,252 @@
+/**
+ * One linked account whose MCP server fails discovery does not take the app's other accounts down
+ * with it: their tools stay listed and callable, and the failure is reported for the broken one.
+ */
+import { expect, layer } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Effect, Layer, Schema } from "effect";
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App, Resource } from "../support/contracts.ts";
+import { Evidence } from "../support/evidence.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { mcpSdkVersion, withApps } from "../support/apps-release.ts";
+import { connectionsPath } from "../support/app-accounts.ts";
+
+const JsonRpcRequest = Schema.Struct({
+  id: Schema.optional(Schema.Union([Schema.String, Schema.Number])),
+  method: Schema.String,
+  params: Schema.optional(Schema.Struct({ protocolVersion: Schema.optional(Schema.String) })),
+});
+
+/** The token of the account whose server does not answer `tools/list`. */
+const brokenToken = "synthetic-broken-token";
+
+/**
+ * An MCP server that lists and runs `lookup` for every token but one: for `brokenToken` it answers
+ * `tools/list` with JSON-RPC -32601, as a server that does not serve that account's catalog does.
+ */
+const accountMcpServer = Effect.gen(function* () {
+  const answer = (id: string | number, body: object) =>
+    HttpServerResponse.json({ jsonrpc: "2.0", id, ...body });
+  const handler = Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    if (request.method !== "POST") return HttpServerResponse.empty({ status: 405 });
+    const message = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(JsonRpcRequest))(
+      yield* request.text,
+    );
+    if (message.id === undefined) return HttpServerResponse.empty({ status: 202 });
+    const broken = request.headers.authorization === `Bearer ${brokenToken}`;
+    switch (message.method) {
+      case "initialize":
+        return yield* answer(message.id, {
+          result: {
+            protocolVersion: message.params?.protocolVersion,
+            capabilities: { tools: {} },
+            serverInfo: { name: "Account fixture", version: "1.0.0" },
+          },
+        });
+      case "tools/list":
+        if (broken)
+          return yield* answer(message.id, {
+            error: { code: -32601, message: "Method not found" },
+          });
+        return yield* answer(message.id, {
+          result: {
+            tools: [
+              {
+                name: "lookup",
+                description: "Look up an item",
+                inputSchema: { type: "object" },
+                annotations: { readOnlyHint: true },
+              },
+            ],
+          },
+        });
+      case "tools/call":
+        return yield* answer(message.id, {
+          result: {
+            content: [{ type: "text", text: "found" }],
+            structuredContent: { found: true },
+          },
+        });
+      default:
+        return yield* answer(message.id, {
+          error: { code: -32601, message: "Method not found" },
+        });
+    }
+  });
+  const services = yield* Layer.build(
+    HttpRouter.serve(HttpRouter.add("*", "/mcp", handler), {
+      disableLogger: true,
+      disableListenLog: true,
+    }).pipe(Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }))),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return { url: `http://127.0.0.1:${server.address.port}/mcp` };
+});
+
+/** The generated MCP app for per-member accounts: every linked account's server, combined. */
+const appFiles = (url: string) => [
+  {
+    path: "package.json",
+    content: JSON.stringify({
+      dependencies: withApps({ "@modelcontextprotocol/sdk": mcpSdkVersion }),
+    }),
+  },
+  {
+    path: "index.ts",
+    content: `import { accountRouter, defineApp, defineProvider, object, secrets, string } from "apps";
+import { mcpRouter } from "apps/mcp";
+const provider = defineProvider({ name: "Account fixture", hosts: ${JSON.stringify([new URL(url).host])}, auth: { key: secrets({ label: "Token", fields: object({ token: string() }) }) } });
+export default defineApp({ user: { accounts: { service: provider.many() } } }, async ({ user, signal, cache }) => ({
+  tools: await accountRouter(user?.accounts.service ?? [], (account) => mcpRouter({
+    url: ${JSON.stringify(url)},
+    account,
+    cache,
+    headers: { Authorization: "Bearer " + account.fields.token },
+    signal,
+  }), { signal }),
+}));`,
+  },
+];
+
+const Index = Schema.Struct({
+  items: Schema.Array(Schema.Struct({ name: Schema.String })),
+  routers: Schema.Array(
+    Schema.Struct({ path: Schema.String, error: Schema.optional(Schema.Unknown) }),
+  ),
+});
+
+const Executed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Boolean,
+    value: Schema.optional(Schema.Unknown),
+    error: Schema.optional(Schema.Struct({ kind: Schema.String, message: Schema.String })),
+  }),
+  unavailableApps: Schema.Array(Schema.Struct({ app: Schema.String, reason: Schema.String })),
+});
+
+layer(HostedLive, { excludeTestServices: true })("MCP account failures", (it) => {
+  it.effect(scenarios.mcpAccountFailureIsolated.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          mcp = yield* McpClient,
+          evidence = yield* Evidence;
+        const server = yield* accountMcpServer;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `Account MCP ${randomUUID().slice(0, 8)}`,
+          files: appFiles(server.url),
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed);
+        const path = `${prefix}/apps/${app.id}`;
+        const key = yield* body(
+          Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
+          yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", {
+            name: "Account failures",
+          }),
+        );
+        const accounts: string[] = [];
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            yield* api.request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id });
+            yield* api.request(actors.owner, "DELETE", path);
+            for (const account of accounts)
+              yield* api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`);
+          }).pipe(Effect.orDie),
+        );
+        // Connecting from the app links each account to it; `.many()` uses every linked one.
+        const connect = (label: string, token: string) =>
+          Effect.gen(function* () {
+            const connection = yield* body(
+              Resource,
+              yield* api.request(
+                actors.owner,
+                "POST",
+                connectionsPath(path, "user", "service"),
+                {},
+              ),
+            );
+            const submitted = yield* api.request(
+              actors.owner,
+              "POST",
+              `${prefix}/connections/${connection.id}/submit`,
+              { method: "key", label, fields: { token } },
+            );
+            expect(submitted.status, JSON.stringify(submitted.body)).toBe(200);
+            const id = (yield* body(Resource, submitted)).id;
+            accounts.push(id);
+            return id;
+          });
+        const working = yield* connect("Working", randomUUID());
+        const broken = yield* connect("Broken", brokenToken);
+
+        // The working account's tools are listed; the broken account's failure is reported on
+        // the router it lists through instead of failing the whole listing.
+        const indexed = yield* api.request(actors.owner, "GET", `${path}/tools/index`);
+        yield* evidence.json("index.json", indexed);
+        expect(indexed.status, JSON.stringify(indexed.body)).toBe(200);
+        const index = yield* body(Index, indexed);
+        expect(index.items.map((tool) => tool.name)).toEqual(["lookup"]);
+        const failed = index.routers.filter((router) => router.error !== undefined);
+        expect(failed).toHaveLength(1);
+        expect(JSON.stringify(failed[0]?.error)).toContain("-32601");
+
+        // The working account's tool runs.
+        const called = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
+          tool: "lookup",
+          kind: "query",
+          input: { accountId: working, input: {} },
+        });
+        yield* evidence.json("working-call.json", called);
+        expect(called.status, JSON.stringify(called.body)).toBe(200);
+        expect(called.body).toMatchObject({ structuredContent: { found: true } });
+
+        // A call with the broken account reports that account's failure, not invalid input.
+        const refused = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
+          tool: "lookup",
+          kind: "query",
+          input: { accountId: broken, input: {} },
+        });
+        yield* evidence.json("broken-call.json", refused);
+        expect(refused.status).not.toBe(200);
+        expect(JSON.stringify(refused.body)).toContain("Method not found");
+
+        // Through MCP execute the agent can still use the working account, and is told why the
+        // other one is unavailable.
+        const client = yield* mcp.connect(key.key, "account-failures", {
+          organization: actors.organization.id,
+        });
+        const executed = yield* client.use("Call the working account's tool", (client, signal) =>
+          client.callTool(
+            {
+              name: "execute",
+              arguments: {
+                code: `return await tools[${JSON.stringify(app.slug)}].lookup({ accountId: ${JSON.stringify(working)}, input: {} });`,
+              },
+            },
+            undefined,
+            { signal },
+          ),
+        );
+        yield* evidence.json("execute.json", executed.structuredContent);
+        const result = yield* Schema.decodeUnknownEffect(Executed)(executed.structuredContent);
+        expect(result.execution, JSON.stringify(result.execution)).toMatchObject({ ok: true });
+        const reason = result.unavailableApps.find((entry) => entry.app === app.id)?.reason;
+        expect(reason).toContain("Method not found");
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+});
diff --git a/e2e/tests/mcp-auth-detection.spec.ts b/e2e/tests/mcp-auth-detection.spec.ts
index 665deab67e..1698ca7001 100644
--- a/e2e/tests/mcp-auth-detection.spec.ts
+++ b/e2e/tests/mcp-auth-detection.spec.ts
@@ -59,7 +59,7 @@ const SetupFailed = Schema.Struct({
 });
 const SignIn = Schema.Struct({ authorizationUrl: Schema.String });
 
-/** Import one emulated server through the hosted Connect a service API. */
+/** Import one emulated server through the hosted MCP server import API. */
 const importer = Effect.gen(function* () {
   const api = yield* Api,
     actors = yield* Actors;
@@ -414,8 +414,11 @@ layer(HostedLive, { excludeTestServices: true })("MCP auth detection", (it) => {
         // The dashboard shows the reason with the signals that decided it.
         const server = yield* mcpAuthServer("bearer-key");
         yield* browser.login(actors.owner);
-        yield* browser.use("Open Connect a service", (page) =>
-          page.goto(`/org/${actors.organization.slug}/apps/add/custom`),
+        yield* browser.use("Open the MCP server dialog", (page) =>
+          page
+            .goto(`/org/${actors.organization.slug}/apps`)
+            .then(() => page.getByRole("button", { name: "Add app", exact: true }).click())
+            .then(() => page.getByRole("menuitem", { name: /^From an MCP server/ }).click()),
         );
         yield* browser.use("Name the app", (page) =>
           page.getByLabel("App name", { exact: true }).fill("Keyed service"),
diff --git a/e2e/tests/mcp-catalog-scale.spec.ts b/e2e/tests/mcp-catalog-scale.spec.ts
index 1120c4cb7f..0658f570d0 100644
--- a/e2e/tests/mcp-catalog-scale.spec.ts
+++ b/e2e/tests/mcp-catalog-scale.spec.ts
@@ -4,7 +4,7 @@ import { Clock, Console, Effect, Schedule, Schema } from "effect";
 import { createServer, type Socket } from "node:net";
 import { createServer as createHttpServer } from "node:http";
 import { randomUUID } from "node:crypto";
-import { scenarios } from "../test-plan.ts";
+import { agedRowsRenewSeconds, scenarios } from "../test-plan.ts";
 import { Api, body, type Session } from "../support/api.ts";
 import { Actors } from "../support/actors.ts";
 import { App, Resource } from "../support/contracts.ts";
@@ -12,6 +12,7 @@ import { saveAndDeploy } from "../support/app-authoring.ts";
 import { Evidence } from "../support/evidence.ts";
 import { HostedLive, withHostedCase } from "../support/case.ts";
 import { McpClient } from "../support/mcp-client.ts";
+import { expireEvaluated, writeRows } from "../support/cloud-rows.ts";
 import {
   connectionsPath,
   linkAccount,
@@ -167,13 +168,14 @@ const listingLoadMs = 45_000;
 
 /**
  * A loopback catalog that holds every request until `recover` is called, then answers held and
- * later requests at once. It counts requests.
+ * later requests at once, until `stall` holds them again. It counts requests.
  */
 const heldCatalog = Effect.acquireRelease(
   Effect.callback<{
     server: ReturnType<typeof createHttpServer>;
     requests: { count: number };
     recover: () => void;
+    stall: () => void;
   }>((resume) => {
     const requests = { count: 0 };
     let healthy = false;
@@ -194,7 +196,12 @@ const heldCatalog = Effect.acquireRelease(
       for (const response of held) answer(response);
       held.clear();
     };
-    server.listen(0, "127.0.0.1", () => resume(Effect.succeed({ server, requests, recover })));
+    const stall = () => {
+      healthy = false;
+    };
+    server.listen(0, "127.0.0.1", () =>
+      resume(Effect.succeed({ server, requests, recover, stall })),
+    );
   }),
   ({ server }) =>
     Effect.callback<void>((resume) => {
@@ -202,10 +209,15 @@ const heldCatalog = Effect.acquireRelease(
       server.close(() => resume(Effect.void));
     }),
 ).pipe(
-  Effect.flatMap(({ server, requests, recover }) => {
+  Effect.flatMap(({ server, requests, recover, stall }) => {
     const address = server.address();
     return address !== null && typeof address === "object"
-      ? Effect.succeed({ url: `http://127.0.0.1:${address.port}/catalog`, requests, recover })
+      ? Effect.succeed({
+          url: `http://127.0.0.1:${address.port}/catalog`,
+          requests,
+          recover,
+          stall,
+        })
       : Effect.die(new Error("Held catalog requires a TCP listener"));
   }),
 );
@@ -254,6 +266,60 @@ export default defineApp({}, async (ctx) => {
   )]))) };
 });`;
 
+/**
+ * A loopback catalog that answers at once: the tool names while healthy, HTTP 503 once `fail` is
+ * called, and the names again after `recover`. It counts requests.
+ */
+const switchedCatalog = Effect.acquireRelease(
+  Effect.callback<{
+    server: ReturnType<typeof createHttpServer>;
+    requests: { count: number };
+    health: { healthy: boolean };
+  }>((resume) => {
+    const requests = { count: 0 };
+    const health = { healthy: true };
+    const server = createHttpServer((_request, response) => {
+      requests.count += 1;
+      response.writeHead(health.healthy ? 200 : 503, { "content-type": "application/json" });
+      response.end(JSON.stringify(health.healthy ? ["alpha", "beta", "gamma"] : { error: "down" }));
+    });
+    server.listen(0, "127.0.0.1", () => resume(Effect.succeed({ server, requests, health })));
+  }),
+  ({ server }) =>
+    Effect.callback<void>((resume) => {
+      server.closeAllConnections();
+      server.close(() => resume(Effect.void));
+    }),
+).pipe(
+  Effect.flatMap(({ server, requests, health }) => {
+    const address = server.address();
+    return address !== null && typeof address === "object"
+      ? Effect.succeed({
+          url: `http://127.0.0.1:${address.port}/catalog`,
+          requests,
+          fail: () => {
+            health.healthy = false;
+          },
+          recover: () => {
+            health.healthy = true;
+          },
+        })
+      : Effect.die(new Error("Switched catalog requires a TCP listener"));
+  }),
+);
+
+/** Tools come from an upstream the factory fetches on every evaluation, failing if it fails. */
+const switchedAppSource = (url: string) => `import { defineApp, query, object, router } from "apps";
+export default defineApp({}, async (ctx) => {
+  const response = await ctx.fetch(${JSON.stringify(url)}, { signal: ctx.signal });
+  if (!response.ok) throw new Error("Catalog upstream answered " + response.status);
+  const names = await response.json();
+  return { tools: router(Object.fromEntries(names.map((name) => [name, query(
+    { description: "Switched catalog tool " + name + " (marker zqrenewq).", input: object({}) },
+    async () => name,
+  )]))) };
+});`;
+
 /**
  * Evaluating this app takes `sleepMs`, with no upstream. Every evaluation names itself in its
  * tools' descriptions, so a search shows which evaluation it reads.
@@ -270,6 +336,13 @@ export default defineApp({}, async () => {
     async () => name,
   )]))) };
 });`;
+/**
+ * How long the aged search rows scenario's app takes to evaluate: longer than discovery waits, so
+ * evaluating it again before answering times it out, and inside `agedRowsRenewSeconds`.
+ */
+const agedListingMs = 12_000;
+/** After how long Cloud renews the search rows it serves: the default `renewMillis`, a day. */
+const listingRenewMs = 86_400_000;
 /** Cloud keeps background work this long after the event that started it closes. */
 const cloudBackgroundMs = 20_000;
 /**
@@ -581,6 +654,224 @@ return { items: [...small.items, ...large.items] };`;
     ),
   );
 
+  it.effect(
+    scenarios.mcpAgedSearchRows.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors;
+          const prefix = `/api/organizations/${actors.organization.id}`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Aged catalog ${randomUUID().slice(0, 8)}`,
+            files: [
+              { path: "index.ts", content: sleepingAppSource(agedListingMs, "zqagedq") },
+              appsManifest,
+            ],
+          });
+          expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+          const app = yield* body(App, deployed);
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+          );
+          const execute = yield* connectActor(actors.owner, "Aged rows", actors.organization.id);
+          const search = `return await tools.search({ query: "zqagedq" });`;
+          const tools = ["alpha", "beta", "gamma"].map(
+            (name) => `tools[${JSON.stringify(app.slug)}].${name}`,
+          );
+          /** The found tools and the one evaluation every description names. */
+          const listed = (value: unknown) =>
+            Schema.decodeUnknownEffect(SearchDescriptions)(value).pipe(
+              Effect.map(({ items }) => ({
+                paths: items.map((item) => item.path).sort(),
+                evaluations: [
+                  ...new Set(
+                    items.map((item) => /evaluation ([0-9a-f-]{36})/.exec(item.description)?.[1]),
+                  ),
+                ],
+              })),
+            );
+          /** A search that finds the app's tools without waiting for an evaluation. */
+          const found = (step: string) =>
+            Effect.gen(function* () {
+              const result = yield* execute(step, search);
+              expect(result.completed.execution.ok, step).toBe(true);
+              expect(result.completed.unavailableApps, step).toEqual([]);
+              expect(result.elapsed, step).toBeLessThan(reportedBoundMs);
+              const read = yield* listed(result.completed.execution.value);
+              expect(read.paths, step).toEqual(tools);
+              expect(read.evaluations, step).toHaveLength(1);
+              return read.evaluations[0]!;
+            });
+
+          // The first search has no rows to read: it reports the app while its listing runs on.
+          const began = yield* Clock.currentTimeMillis;
+          const first = yield* execute("Search an app with no rows", search);
+          expect(first.completed.unavailableApps.map((entry) => entry.app)).toEqual([app.id]);
+          expect(first.completed.unavailableApps[0]!.reason).toContain("AppDiscoveryTimedOut");
+          const kept = yield* Effect.gen(function* () {
+            const polled = yield* execute("Search while the first listing runs", search);
+            expect(polled.elapsed).toBeLessThan(reportedBoundMs);
+            if (polled.completed.unavailableApps.length > 0)
+              return yield* Effect.fail("still loading" as const);
+            return yield* found("Search once the first listing finishes");
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("1 second"),
+              while: (error) => error === "still loading",
+              times: 30,
+            }),
+          );
+
+          // Searches never renew the rows they read, so they age past the server's renewal age
+          // while the organization is idle, as every app's rows do after a day in production.
+          const aged = began + agedRowsRenewSeconds * 1_000 + 2_000;
+          yield* Effect.sleep(Math.max(0, aged - (yield* Clock.currentTimeMillis)));
+
+          // The first search after that still answers at once from the aged rows, instead of
+          // evaluating the app again and reporting it timed out, and starts one evaluation that
+          // replaces them. Searches meanwhile read the aged rows.
+          expect(yield* found("Search aged rows")).toBe(kept);
+          const renewed = yield* Effect.gen(function* () {
+            const read = yield* found("Search while the aged rows are renewed");
+            if (read !== kept) return read;
+            return yield* Effect.fail("still aged" as const);
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("1 second"),
+              while: (error) => error === "still aged",
+              times: 30,
+            }),
+          );
+          // Later searches read the renewed rows; nothing evaluates the app again.
+          for (const attempt of [1, 2])
+            expect(yield* found(`Search the renewed rows (${attempt})`)).toBe(renewed);
+        }).pipe(Effect.provide(McpClient.layer)),
+      ),
+    { timeout: 150_000 },
+  );
+
+  it.effect(
+    scenarios.mcpAgedRowsFailedRenewal.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors;
+          const catalog = yield* switchedCatalog;
+          const prefix = `/api/organizations/${actors.organization.id}`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Unrenewed catalog ${randomUUID().slice(0, 8)}`,
+            files: [{ path: "index.ts", content: switchedAppSource(catalog.url) }, appsManifest],
+          });
+          expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+          const app = yield* body(App, deployed);
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+          );
+          const execute = yield* connectActor(
+            actors.owner,
+            "Unrenewed rows",
+            actors.organization.id,
+          );
+          const search = `return await tools.search({ query: "zqrenewq" });`;
+          const tools = ["alpha", "beta", "gamma"].map(
+            (name) => `tools[${JSON.stringify(app.slug)}].${name}`,
+          );
+          const paths = (value: unknown) =>
+            Schema.decodeUnknownEffect(SearchDescriptions)(value).pipe(
+              Effect.map(({ items }) => items.map((item) => item.path).sort()),
+            );
+          /** A search that finds the app's tools and reports nothing unavailable. */
+          const found = (step: string) =>
+            Effect.gen(function* () {
+              const result = yield* execute(step, search);
+              expect(result.completed.execution.ok, step).toBe(true);
+              expect(result.completed.unavailableApps, step).toEqual([]);
+              expect(yield* paths(result.completed.execution.value), step).toEqual(tools);
+            });
+          /**
+           * A search that still finds the app's tools, from its earlier rows, and reports why they
+           * may be out of date.
+           */
+          const stale = (step: string) =>
+            Effect.gen(function* () {
+              const result = yield* execute(step, search);
+              expect(result.completed.execution.ok, step).toBe(true);
+              expect(result.elapsed, step).toBeLessThan(reportedBoundMs);
+              expect(yield* paths(result.completed.execution.value), step).toEqual(tools);
+              expect(
+                result.completed.unavailableApps.map((entry) => entry.app),
+                step,
+              ).toEqual([app.id]);
+              const reason = result.completed.unavailableApps[0]!.reason;
+              expect(reason, step).toContain("ToolSearchStale");
+              expect(reason, step).toContain("Catalog upstream answered 503");
+            });
+
+          // The app's rows are written while its upstream is healthy.
+          yield* Effect.gen(function* () {
+            const result = yield* execute("Search an app with no rows", search);
+            if (result.completed.unavailableApps.length > 0)
+              return yield* Effect.fail("still loading" as const);
+            return yield* found("Search once the first listing finishes");
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("1 second"),
+              while: (error) => error === "still loading",
+              times: 30,
+            }),
+          );
+
+          // The upstream now fails at once, faster than any failure a read remembers. Rows kept
+          // before this moment age past the server's renewal age while nothing renews them.
+          catalog.fail();
+          yield* Effect.sleep(agedRowsRenewSeconds * 1_000 + 2_000);
+
+          // The first search after that cannot know: it serves the aged rows and renews them in
+          // the background. That renewal fails, so later searches still find the app's tools, from
+          // the rows they have, and report the failure beside them while it lasts, without
+          // listing the app again for each search.
+          const before = catalog.requests.count;
+          yield* found("Search aged rows");
+          yield* Effect.gen(function* () {
+            const result = yield* execute("Search after the renewal of aged rows", search);
+            if (result.completed.unavailableApps.length === 0)
+              return yield* Effect.fail("not yet reported" as const);
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("1 second"),
+              while: (error) => error === "not yet reported",
+              times: 10,
+            }),
+          );
+          expect(catalog.requests.count).toBe(before + 1);
+          for (const attempt of [1, 2])
+            yield* stale(`Search while the upstream fails (${attempt})`);
+          expect(catalog.requests.count).toBe(before + 1);
+
+          // Once the upstream recovers, a later renewal lists the app again and replaces the rows.
+          catalog.recover();
+          yield* Effect.gen(function* () {
+            const result = yield* execute("Search after the upstream recovers", search);
+            expect(yield* paths(result.completed.execution.value)).toEqual(tools);
+            if (result.completed.unavailableApps.length > 0)
+              return yield* Effect.fail("still stale" as const);
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("2 seconds"),
+              while: (error) => error === "still stale",
+              times: 30,
+            }),
+          );
+          for (const attempt of [1, 2]) yield* found(`Search the renewed rows (${attempt})`);
+        }).pipe(Effect.provide(McpClient.layer)),
+      ),
+    { timeout: 180_000 },
+  );
+
   it.effect(
     scenarios.mcpBackgroundListingCloud.title,
     (context) =>
@@ -748,6 +1039,128 @@ return { items: [...small.items, ...large.items] };`;
     { timeout: 150_000 },
   );
 
+  it.effect(
+    scenarios.mcpStoppedRenewalCloud.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors;
+          const prefix = `/api/organizations/${actors.organization.id}`;
+          const upstream = yield* heldCatalog;
+          upstream.recover();
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Stopped renewal ${randomUUID().slice(0, 8)}`,
+            files: [
+              { path: "index.ts", content: slowAppSource(upstream.url, "zqstoprenewq") },
+              appsManifest,
+            ],
+          });
+          expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+          const app = yield* body(App, deployed);
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+          );
+          const execute = yield* connectActor(
+            actors.owner,
+            "Stopped renewal",
+            actors.organization.id,
+          );
+          const search = `return await tools.search({ query: "zqstoprenewq" });`;
+          const tools = ["alpha", "beta", "gamma"].map(
+            (name) => `tools[${JSON.stringify(app.slug)}].${name}`,
+          );
+          /** A search that answers without waiting for the app: its tools, and what it reports. */
+          const searched = (step: string) =>
+            Effect.gen(function* () {
+              const result = yield* execute(step, search);
+              expect(result.completed.execution.ok, step).toBe(true);
+              expect(result.elapsed, step).toBeLessThan(cloudReportedBoundMs);
+              const { items } = yield* Schema.decodeUnknownEffect(SearchValue)(
+                result.completed.execution.value,
+              );
+              return {
+                paths: items.map((item) => item.path).sort(),
+                unavailable: result.completed.unavailableApps,
+              };
+            });
+          const found = (step: string) =>
+            Effect.gen(function* () {
+              const read = yield* searched(step);
+              expect(read.unavailable, step).toEqual([]);
+              expect(read.paths, step).toEqual(tools);
+            });
+          /** Wait until the upstream has been asked `count` times. */
+          const asked = (count: number) =>
+            Effect.gen(function* () {
+              if (upstream.requests.count < count) return yield* Effect.fail("not asked" as const);
+            }).pipe(
+              Effect.retry({
+                schedule: Schedule.spaced("100 millis"),
+                while: (error) => error === "not asked",
+                times: 100,
+              }),
+            );
+
+          // The app's rows are written while its upstream answers.
+          yield* Effect.gen(function* () {
+            const result = yield* execute("Search an app with no rows", search);
+            if (result.completed.unavailableApps.length > 0)
+              return yield* Effect.fail("still loading" as const);
+            return yield* found("Search once the first listing finishes");
+          }).pipe(
+            Effect.retry({
+              schedule: Schedule.spaced("1 second"),
+              while: (error) => error === "still loading",
+              times: 30,
+            }),
+          );
+
+          // A day passes with nothing renewing them: the rows, and the supervisor's copy of the
+          // listing they were written from, age past Cloud's renewal age. Only this app's are
+          // changed, as the clock would change them.
+          const rows = yield* writeRows("sso-database.json", [
+            {
+              sql: `update executor_tool_search_listings set at = at - ${listingRenewMs + 60_000}
+                where app = $1 returning listing`,
+              params: [app.id],
+            },
+          ]).pipe(
+            Effect.flatMap((results) =>
+              Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ listing: Schema.String })))(
+                results[0],
+              ),
+            ),
+          );
+          expect(rows).toHaveLength(1);
+          expect(yield* expireEvaluated(rows[0]!.listing)).toBeGreaterThan(0);
+
+          // The first search after that serves the aged rows at once and renews them in its
+          // background work, where the upstream now holds the renewal. Cloud refuses new
+          // background work once that search's request closes, so the renewal evaluates in its
+          // own background fiber.
+          upstream.stall();
+          const before = upstream.requests.count;
+          const renewing = yield* Clock.currentTimeMillis;
+          yield* found("Search aged rows");
+          yield* asked(before + 1);
+
+          // Cloud stops the renewal when the first search's background work ends. Running out of
+          // time says nothing about the app's tools, so searches keep serving its rows, as healthy,
+          // before and after the stop, and do not start the renewal again at once.
+          while ((yield* Clock.currentTimeMillis) - renewing < cloudBackgroundMs + 5_000) {
+            yield* found("Search while the aged rows are renewed or after Cloud stops it");
+            yield* Effect.sleep("2 seconds");
+          }
+          for (const attempt of [1, 2, 3])
+            yield* found(`Search after the stopped renewal (${attempt})`);
+          expect(upstream.requests.count).toBe(before + 1);
+        }).pipe(Effect.provide(McpClient.layer)),
+      ),
+    { timeout: 150_000 },
+  );
+
   it.effect(
     scenarios.mcpRememberedListingFailure.title,
     (context) =>
diff --git a/e2e/tests/mcp-catalog.spec.ts b/e2e/tests/mcp-catalog.spec.ts
index 215aebefc5..f9cbe1e0d0 100644
--- a/e2e/tests/mcp-catalog.spec.ts
+++ b/e2e/tests/mcp-catalog.spec.ts
@@ -169,7 +169,13 @@ const control = (origin: string, data?: Schema.Json) =>
     return yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Stats)));
   });
 
-const source = (url: string, cached: boolean, accounts: boolean, accountless = false) => [
+const source = (
+  url: string,
+  cached: boolean,
+  accounts: boolean,
+  accountless = false,
+  freshFor?: string,
+) => [
   {
     path: "package.json",
     content: JSON.stringify({
@@ -186,6 +192,7 @@ const provider = defineProvider({ name: "Cache fixture", hosts: ${JSON.stringify
 export default defineApp({ user: { accounts: ${accounts ? "{ service: provider.many() }" : "{}"} } }, async ctx => {
   const options = account => ({ url: ${JSON.stringify(url)}, signal: ctx.signal,
     ${cached ? "cache: ctx.cache," : ""}
+    ${freshFor === undefined ? "" : `freshFor: ${JSON.stringify(freshFor)},`}
     ${accountless ? 'headers: { Authorization: "Bearer accountless" },' : ""}
     ...(account ? { account, headers: { "X-Fixture-Variant": account.fields.variant, Authorization: "Bearer " + account.fields.token } } : {}),
   });
@@ -202,17 +209,23 @@ export default defineApp({ user: { accounts: ${accounts ? "{ service: provider.m
   },
 ];
 
-const deploy = (url: string, cached: boolean, accounts = false, accountless = false) =>
+const deploy = (
+  url: string,
+  cached: boolean,
+  accounts = false,
+  accountless = false,
+  freshFor?: string,
+) =>
   Effect.gen(function* () {
     const api = yield* Api;
     const actors = yield* Actors;
     const prefix = `/api/organizations/${actors.organization.id}`;
     const response = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
       name: `MCP cache ${randomUUID().slice(0, 8)}`,
-      files: source(url, cached, accounts, accountless),
+      files: source(url, cached, accounts, accountless, freshFor),
     });
     expect(response.status).toBe(200);
-    const id = (yield* body(App, response)).id;
+    const { id, slug } = yield* body(App, response);
     const path = `${prefix}/apps/${id}`;
     yield* Effect.addFinalizer(() => api.request(actors.owner, "DELETE", path).pipe(Effect.orDie));
     // The server's tools are mounted under "upstream" beside the app's own refresh query.
@@ -223,7 +236,7 @@ const deploy = (url: string, cached: boolean, accounts = false, accountless = fa
         kind: "query",
         input,
       });
-    return { api, actors, id, path, prefix, call };
+    return { api, actors, id, slug, path, prefix, call };
   });
 
 /** Connect a `service` account whose requests the fixture answers under `variant`. */
@@ -255,6 +268,50 @@ const connectAccount = (app: Effect.Success<ReturnType<typeof deploy>>, variant:
     return account.id;
   });
 
+const Executed = Schema.Struct({
+  structuredContent: Schema.Struct({
+    execution: Schema.Struct({
+      ok: Schema.Boolean,
+      value: Schema.optional(Schema.Unknown),
+      error: Schema.optional(
+        Schema.Struct({
+          kind: Schema.String,
+          suggestions: Schema.optional(Schema.Array(Schema.String)),
+        }),
+      ),
+    }),
+  }),
+});
+
+/** Run MCP `execute` programs as the app's owner, through an API key of their own. */
+const executeAs = (app: Effect.Success<ReturnType<typeof deploy>>, name: string) =>
+  Effect.gen(function* () {
+    const key = yield* body(
+      Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
+      yield* app.api.request(app.actors.owner, "POST", "/api/auth/api-key/create", { name }),
+    );
+    yield* Effect.addFinalizer(() =>
+      app.api
+        .request(app.actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+        .pipe(Effect.orDie),
+    );
+    const client = yield* (yield* McpClient).connect(key.key, name, {
+      organization: app.actors.organization.id,
+    });
+    return (step: string, code: string) =>
+      client
+        .use(step, (client, signal) =>
+          client.callTool({ name: "execute", arguments: { code } }, undefined, {
+            signal,
+            timeout: 55_000,
+          }),
+        )
+        .pipe(
+          Effect.flatMap(Schema.decodeUnknownEffect(Executed)),
+          Effect.map((result) => result.structuredContent.execution),
+        );
+  });
+
 layer(HostedLive, { excludeTestServices: true })("MCP cache", (it) => {
   it.effect(scenarios.mcpCatalogCache.title, (context) =>
     withHostedCase(
@@ -561,6 +618,69 @@ layer(HostedLive, { excludeTestServices: true })("MCP cache", (it) => {
     ),
   );
 
+  it.effect(scenarios.mcpListingUpstreamChange.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const origin = yield* fixture();
+        yield* control(origin, { count: 3, delayMs: 0 });
+        // The app keeps its server's tool list fresh for a second, as it would for five minutes
+        // by default, so its routine refresh runs within the scenario.
+        const app = yield* deploy(`${origin}/mcp`, true, false, false, "1 second");
+        const execute = yield* executeAs(app, "Listing upstream change");
+        const tools = `tools[${JSON.stringify(app.slug)}].upstream`;
+        /** The revision tools search lists for the app. */
+        const searched = (step: string) =>
+          execute(
+            step,
+            `const found = await tools.search({ query: "revision", namespace: ${JSON.stringify(app.slug)}, limit: 50 });
+return found.items.map((item) => item.path.split(".").at(-1)).sort();`,
+          ).pipe(
+            Effect.flatMap((result) =>
+              Schema.decodeUnknownEffect(Schema.Array(Schema.String))(result.value),
+            ),
+            Effect.map((names) => names.filter((name) => name.startsWith("revision_"))),
+          );
+        const called = (step: string, tool: string) =>
+          execute(step, `return (await ${tools}.${tool}({})).structuredContent.tool;`);
+
+        expect(yield* searched("First search")).toEqual(["revision_1"]);
+        const first = yield* called("Call a listed tool", "revision_1");
+        expect(first.value, JSON.stringify(first)).toBe("revision_1");
+        // The listing is kept now: another execute neither evaluates the app nor asks the server.
+        const lists = (yield* control(origin)).counters.list;
+        expect(yield* searched("Kept listing")).toEqual(["revision_1"]);
+        expect((yield* control(origin)).counters.list).toBe(lists);
+
+        // The server replaces its tools without announcing it, as a deploy of it does.
+        yield* control(origin, { version: 2 });
+        // A call of a tool both lists have runs on the app's stale tool list and refreshes it in
+        // the background once it is past its freshness: the server is asked again.
+        yield* Effect.gen(function* () {
+          expect((yield* app.call("fixture_0000")).status).toBe(200);
+          if ((yield* control(origin)).counters.list === lists)
+            return yield* Effect.fail(new Error("The app has not refreshed its tool list yet"));
+        }).pipe(Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 20 }));
+
+        // The refreshed tool list differs, so every kept listing of the app is outdated: the new
+        // tool is called and searched without a redeploy, after at most one change check.
+        const renamed = yield* called("Call the server's new tool", "revision_2").pipe(
+          Effect.flatMap((result) =>
+            result.ok
+              ? Effect.succeed(result)
+              : Effect.fail(new Error(`The new tool is not listed yet: ${JSON.stringify(result)}`)),
+          ),
+          Effect.retry({ schedule: Schedule.spaced("1 second"), times: 25 }),
+        );
+        expect(renamed.value).toBe("revision_2");
+        expect(yield* searched("Search after the server changed")).toEqual(["revision_2"]);
+        const removed = yield* called("Call the server's removed tool", "revision_1");
+        expect(removed.ok).toBe(false);
+        expect(removed.error?.kind).toBe("UnknownTool");
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+
   it.effect(scenarios.mcpExecuteSignatures.title, (context) =>
     withHostedCase(
       context,
diff --git a/e2e/tests/mcp-connections.spec.ts b/e2e/tests/mcp-connections.spec.ts
index 45014529de..bd06bc93ec 100644
--- a/e2e/tests/mcp-connections.spec.ts
+++ b/e2e/tests/mcp-connections.spec.ts
@@ -618,6 +618,12 @@ return { first, second };`,
         yield* browser.use("Open Connections", (page) =>
           page.goto(`/org/${actors.organization.slug}/connect`),
         );
+        yield* browser.use("Connect with full access", (page) =>
+          page
+            .getByRole("listitem", { name: "Full access" })
+            .getByRole("button", { name: "Connect", exact: true })
+            .click(),
+        );
         yield* browser.use("Show assistant-specific instructions", (page) =>
           page.getByRole("heading", { name: "Connect an assistant", exact: true }).waitFor(),
         );
@@ -643,6 +649,25 @@ return { first, second };`,
             page.evaluate(() => navigator.clipboard.readText()),
           ),
         ).toBe(`codex mcp add executor --url '${targetHosts(target).mcp}/mcp'`);
+        yield* browser.use("Switch to OpenCode", (page) =>
+          page.getByRole("button", { name: "OpenCode", exact: true }).click(),
+        );
+        yield* browser.use("Copy the OpenCode command", (page) =>
+          page.getByRole("button", { name: "Copy assistant setup", exact: true }).click(),
+        );
+        expect(
+          yield* browser.use("Read the copied OpenCode command", (page) =>
+            page.evaluate(() => navigator.clipboard.readText()),
+          ),
+        ).toBe(`opencode mcp add executor --url '${targetHosts(target).mcp}/mcp'`);
+        yield* browser.use("Copy the OpenCode sign-in command", (page) =>
+          page.getByRole("button", { name: "Copy sign-in command", exact: true }).click(),
+        );
+        expect(
+          yield* browser.use("Read the copied OpenCode sign-in command", (page) =>
+            page.evaluate(() => navigator.clipboard.readText()),
+          ),
+        ).toBe("opencode mcp auth executor");
         yield* browser.use("Switch to Claude", (page) =>
           page.getByRole("button", { name: "Claude", exact: true }).click(),
         );
@@ -676,19 +701,17 @@ return { first, second };`,
             .getByRole("img")
             .waitFor({ state: "visible" }),
         );
+        // Radix paints the dialog before the effect that makes it the topmost layer and moves focus
+        // into it. Escape pressed before that effect closes the setup dialog beneath it instead.
+        yield* browser.use("The full-size screenshot takes focus", (page) =>
+          page
+            .getByRole("dialog", { name: "Claude’s Add custom connector dialog" })
+            .and(page.locator(":focus-within"))
+            .waitFor(),
+        );
         yield* browser.use("Close the full-size screenshot", (page) =>
           page.keyboard.press("Escape"),
         );
-        yield* browser.use("Choose Cursor plugin setup", (page) =>
-          page.getByRole("button", { name: "Cursor", exact: true }).click(),
-        );
-        expect(
-          yield* browser.use("Cursor links to our published plugin", (page) =>
-            page
-              .getByRole("link", { name: "Install Executor for Cursor", exact: true })
-              .getAttribute("href"),
-          ),
-        ).toBe("https://cursor.com/marketplace/usefulsoftwareco");
         yield* browser.use("Choose Grok Bot setup", (page) =>
           page.getByRole("button", { name: "Grok Bot", exact: true }).click(),
         );
@@ -718,8 +741,9 @@ return { first, second };`,
               ),
           ),
         ).toBe(`/account/tokens?organization=${actors.organization.slug}`);
+        yield* browser.use("Close the full-access setup", (page) => page.keyboard.press("Escape"));
         yield* browser.use("Start a new connection", (page) =>
-          page.getByRole("button", { name: "Create a scoped connection", exact: true }).click(),
+          page.getByRole("link", { name: "New connection", exact: true }).click(),
         );
         yield* browser.use("Name the connection", (page) =>
           page.getByLabel("Name", { exact: true }).fill("Support assistant"),
@@ -749,6 +773,9 @@ return { first, second };`,
         expect(saved?.policy.apps).toEqual([
           { app: app.id, runsAs: [{ kind: "app" }], tools: { kind: "readOnly" } },
         ]);
+        yield* browser.use("Open the connection's setup", (page) =>
+          page.getByRole("button", { name: "Connect", exact: true }).click(),
+        );
         yield* browser.use("The connection shows its own MCP URL", (page) =>
           page
             .getByText(`${targetHosts(target).mcp}/mcp?connection=${saved?.id}`)
@@ -769,17 +796,46 @@ return { first, second };`,
           `codex mcp add executor --url '${targetHosts(target).mcp}/mcp?connection=${saved?.id}'`,
         );
         yield* browser.checkpoint("Saved connection with its MCP URL");
+        yield* browser.use("Close the connection's setup", (page) => page.keyboard.press("Escape"));
+        yield* browser.use("Return to the connection list", (page) =>
+          page
+            .getByRole("navigation")
+            .getByRole("link", { name: "Connections", exact: true })
+            .click(),
+        );
+        yield* browser.use("The list shows the connection's app on its card", (page) =>
+          page
+            .getByRole("listitem", { name: "Support assistant" })
+            .getByText(app.name, { exact: true })
+            .waitFor({ state: "visible" }),
+        );
+        yield* browser.checkpoint("Connections listing full access and the saved connection");
+        yield* browser.use("Open the connection from its card", (page) =>
+          page
+            .getByRole("listitem", { name: "Support assistant" })
+            .getByRole("link", { name: "Support assistant", exact: true })
+            .click(),
+        );
+        yield* browser.use("Open the connection's actions", (page) =>
+          page.getByRole("button", { name: "More actions", exact: true }).click(),
+        );
         yield* browser.use("Revoke the connection", (page) =>
-          page.getByRole("button", { name: "Revoke", exact: true }).click(),
+          page.getByRole("menuitem", { name: "Revoke connection", exact: true }).click(),
         );
         yield* browser.use("Confirm revocation", (page) =>
-          page.getByRole("button", { name: "Revoke connection", exact: true }).click(),
-        );
-        yield* browser.use("The page returns to agent setup", (page) =>
           page
-            .getByRole("button", { name: "Create a scoped connection", exact: true })
-            .waitFor({ state: "visible" }),
+            .getByRole("dialog")
+            .getByRole("button", { name: "Revoke connection", exact: true })
+            .click(),
         );
+        expect(
+          yield* browser.use("The page returns to the list without the connection", (page) =>
+            page
+              .getByRole("listitem", { name: "Full access" })
+              .waitFor({ state: "visible" })
+              .then(() => page.getByRole("listitem", { name: "Support assistant" }).count()),
+          ),
+        ).toBe(0);
         expect(yield* list).toEqual([]);
       }),
     ),
diff --git a/e2e/tests/mcp-deferred-setup.spec.ts b/e2e/tests/mcp-deferred-setup.spec.ts
index 9948656d68..de6d8f6d66 100644
--- a/e2e/tests/mcp-deferred-setup.spec.ts
+++ b/e2e/tests/mcp-deferred-setup.spec.ts
@@ -53,7 +53,9 @@ layer(HostedLive, { excludeTestServices: true })("Deferred MCP setup", (it) => {
           );
         yield* browser.use("Fill the MCP server form", (page) =>
           page
-            .goto(`/org/${actors.organization.slug}/apps/add/custom`)
+            .goto(`/org/${actors.organization.slug}/apps`)
+            .then(() => page.getByRole("button", { name: "Add app", exact: true }).click())
+            .then(() => page.getByRole("menuitem", { name: /^From an MCP server/ }).click())
             .then(() => page.getByLabel("App name", { exact: true }).fill(name))
             .then(() =>
               page.getByLabel("MCP server URL", { exact: true }).fill(`${issuer.origin}/mcp`),
diff --git a/e2e/tests/mcp-direct-calls.spec.ts b/e2e/tests/mcp-direct-calls.spec.ts
index 44d47cbbe3..f79c3c066a 100644
--- a/e2e/tests/mcp-direct-calls.spec.ts
+++ b/e2e/tests/mcp-direct-calls.spec.ts
@@ -16,7 +16,7 @@ import { always } from "apps/operations/approval";
 export default defineApp({}, async () => ({ tools: router({
   echo: query({ input: object({ text: string() }), description: "Echo text back to the caller" },
     async (_ctx, { text }) => ({ text })),
-  oversized: query({ input: object({}), description: "Return more than the output limit" },
+  oversized: query({ input: object({}), description: "Return more than 100,000 bytes" },
     async () => ({ data: "x".repeat(150000) })),
   review: mutation({ input: object({ note: string() }), approval: always(), description: "Record a reviewed note" },
     async (_ctx, { note }) => ({ reviewed: note })),
@@ -178,7 +178,8 @@ layer(HostedLive, { excludeTestServices: true })("MCP direct calls", (it) => {
           toolCalls: [{ name: echo, outcome: "success" }],
         });
 
-        // A batch keeps its order, and one call failing does not stop the others.
+        // A batch keeps its order, one call failing does not stop the others, and a result over
+        // 100,000 bytes comes back whole.
         const batch = yield* Schema.decodeUnknownEffect(Completed)(
           yield* tool("Call a batch", "call", {
             calls: [
@@ -193,7 +194,7 @@ layer(HostedLive, { excludeTestServices: true })("MCP direct calls", (it) => {
         expect(batch.execution.value).toMatchObject([
           { path: echo, ok: true, value: { text: "first" } },
           { path: `${echo}x`, ok: false, error: { kind: "UnknownTool" } },
-          { path: oversized, ok: false, error: { kind: "Truncated" } },
+          { path: oversized, ok: true, value: { data: "x".repeat(150_000) } },
           { path: echo, ok: true, value: { text: "last" } },
         ]);
         expect(JSON.stringify(batch.execution.value)).toContain(
diff --git a/e2e/tests/mcp-event-stream.spec.ts b/e2e/tests/mcp-event-stream.spec.ts
new file mode 100644
index 0000000000..95c8ac6c98
--- /dev/null
+++ b/e2e/tests/mcp-event-stream.spec.ts
@@ -0,0 +1,154 @@
+/** A remote MCP server that refuses the optional event stream still serves its tools. */
+import { expect, layer } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Deferred, Effect, Layer, Ref, Schema } from "effect";
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { Evidence } from "../support/evidence.ts";
+import { mcpSdkVersion, withApps } from "../support/apps-release.ts";
+
+const JsonRpcRequest = Schema.Struct({
+  id: Schema.optional(Schema.Union([Schema.String, Schema.Number])),
+  method: Schema.String,
+  params: Schema.optional(Schema.Struct({ protocolVersion: Schema.optional(Schema.String) })),
+});
+
+/**
+ * An MCP server that answers every POST but refuses the standalone GET event stream with a 401
+ * and a JSON-RPC error, as some hosted servers do instead of the 405 the spec asks for. It holds
+ * `tools/list` until that GET has arrived, so the refusal reaches the client during discovery.
+ */
+const refusedStreamMcpServer = Effect.gen(function* () {
+  const requests = yield* Ref.make<ReadonlyArray<string>>([]);
+  const streamRequested = yield* Deferred.make<void>();
+  const answer = (id: string | number, result: object) =>
+    HttpServerResponse.json({ jsonrpc: "2.0", id, result });
+  const handler = Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    if (request.method === "GET") {
+      yield* Ref.update(requests, (seen) => [...seen, "GET 401"]);
+      yield* Deferred.succeed(streamRequested, undefined);
+      return yield* HttpServerResponse.json(
+        {
+          jsonrpc: "2.0",
+          error: { code: -32600, message: "Authorization required" },
+          id: null,
+        },
+        {
+          status: 401,
+          headers: {
+            "www-authenticate": `Bearer resource_metadata="http://127.0.0.1/.well-known/oauth-protected-resource"`,
+          },
+        },
+      );
+    }
+    if (request.method !== "POST") return HttpServerResponse.empty({ status: 405 });
+    const message = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(JsonRpcRequest))(
+      yield* request.text,
+    );
+    yield* Ref.update(requests, (seen) => [...seen, `POST ${message.method}`]);
+    if (message.id === undefined) return HttpServerResponse.empty({ status: 202 });
+    switch (message.method) {
+      case "initialize":
+        return yield* answer(message.id, {
+          protocolVersion: message.params?.protocolVersion,
+          capabilities: { tools: {} },
+          serverInfo: { name: "Refused stream fixture", version: "1.0.0" },
+        });
+      case "tools/list":
+        yield* Deferred.await(streamRequested).pipe(Effect.timeout("5 seconds"), Effect.ignore);
+        return yield* answer(message.id, {
+          tools: [
+            {
+              name: "ping",
+              description: "Answer pong",
+              inputSchema: { type: "object" },
+              annotations: { readOnlyHint: true },
+            },
+          ],
+        });
+      case "tools/call":
+        return yield* answer(message.id, {
+          content: [{ type: "text", text: "pong" }],
+          structuredContent: { reply: "pong" },
+        });
+      default:
+        return yield* HttpServerResponse.json({
+          jsonrpc: "2.0",
+          id: message.id,
+          error: { code: -32601, message: "Method not found" },
+        });
+    }
+  });
+  const services = yield* Layer.build(
+    HttpRouter.serve(HttpRouter.add("*", "/mcp", handler), {
+      disableLogger: true,
+      disableListenLog: true,
+    }).pipe(Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }))),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return { url: `http://127.0.0.1:${server.address.port}/mcp`, requests: Ref.get(requests) };
+});
+
+const appFiles = (url: string) => [
+  {
+    path: "package.json",
+    content: JSON.stringify({
+      dependencies: withApps({ "@modelcontextprotocol/sdk": mcpSdkVersion }),
+    }),
+  },
+  {
+    path: "index.ts",
+    content: `import { defineApp, router } from "apps";
+import { mcpRouter } from "apps/mcp";
+export default defineApp({}, async (ctx) => ({ tools: router({
+  remote: await mcpRouter({ url: ${JSON.stringify(url)}, signal: ctx.signal }),
+}) }));`,
+  },
+];
+
+layer(HostedLive, { excludeTestServices: true })("MCP event stream", (it) => {
+  it.effect(scenarios.mcpRefusedEventStream.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          evidence = yield* Evidence;
+        const server = yield* refusedStreamMcpServer;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `MCP event stream ${randomUUID().slice(0, 8)}`,
+          files: appFiles(server.url),
+        });
+        yield* evidence.json("deploy.json", deployed);
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed);
+        const path = `${prefix}/apps/${app.id}`;
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
+        );
+        const called = yield* api.request(actors.owner, "POST", `${path}/tools/call`, {
+          tool: "remote.ping",
+          kind: "query",
+          input: {},
+        });
+        yield* evidence.json("call.json", called);
+        expect(called.status, JSON.stringify(called.body)).toBe(200);
+        expect(called.body).toMatchObject({ structuredContent: { reply: "pong" } });
+        // The server did refuse the stream during the session; the tools were listed regardless.
+        const requests = yield* server.requests;
+        yield* evidence.json("upstream-requests.json", requests);
+        expect(requests).toContain("GET 401");
+        expect(requests).toContain("POST tools/list");
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/mcp-execute-failures.spec.ts b/e2e/tests/mcp-execute-failures.spec.ts
index 75d128c069..1a092e45e0 100644
--- a/e2e/tests/mcp-execute-failures.spec.ts
+++ b/e2e/tests/mcp-execute-failures.spec.ts
@@ -29,6 +29,7 @@ import { previousToolRunCompletion } from "../support/release-cb81bce6b.ts";
 import { startDevelopmentServer } from "../support/managed-server.ts";
 import { Target } from "../support/platform.ts";
 import { connectionsPath } from "../support/app-accounts.ts";
+import { siteless } from "../support/failure-site.ts";
 
 // A refresh that runs until its 30 s background limit unless cancelled.
 const slowRefresh = `const slowRefresh = (signal) => new Promise((resolve) => {
@@ -55,10 +56,10 @@ export default defineApp({}, async (ctx) => ({
 
 // `fails` throws after approval, as an upstream that rejects the approved write; `forged` throws
 // an error dressed as Executor's own expiry; `held` waits on the gate, counts its run, then throws;
-// `approved` succeeds. All need approval on every call.
+// `approved` succeeds. All need approval on every call. `broken` is a read that always fails.
 const approvalAppSource = (
   gate: string,
-) => `import { defineApp, mutation, object, router } from "apps";
+) => `import { defineApp, mutation, object, query, router } from "apps";
 import { always } from "apps/operations/approval";
 export default defineApp({}, async () => ({ tools: router({
   fails: mutation({ input: object({}), approval: always() }, async () => {
@@ -77,6 +78,9 @@ export default defineApp({}, async () => ({ tools: router({
     throw error;
   }),
   approved: mutation({ input: object({}), approval: always() }, async () => ({ ran: true })),
+  broken: query({ input: object({}) }, async () => {
+    throw new Error("The later lookup failed");
+  }),
 }) }));`;
 
 // The second read serves the cached value and starts a refresh that outlasts the result.
@@ -141,8 +145,10 @@ const invalidArguments = "Invalid arguments for tool lookup: item is required";
  * Which requests the server answers with a JSON-RPC error: every request with HTTP 400, tool calls
  * with HTTP 400, the session a tool call opens with HTTP 400, or tool calls inside a successful
  * response. `silent-calls` answers tool calls only after the app stopped waiting, and
- * `dropped-calls` runs each tool call, then closes the connection without answering. Only a tool
- * call's session offers elicitation, so its initialize is told apart by that.
+ * `dropped-calls` runs each tool call, then closes the connection without answering.
+ * `error-results` answers `lookup` with a result that says the tool failed (`isError: true`), as
+ * a server does when its own upstream refuses. Only a tool call's session offers elicitation, so
+ * its initialize is told apart by that.
  */
 type Refusal =
   | "everything"
@@ -150,7 +156,11 @@ type Refusal =
   | "call-sessions"
   | "tool-arguments"
   | "silent-calls"
-  | "dropped-calls";
+  | "dropped-calls"
+  | "error-results";
+
+/** What `error-results` says when `lookup` fails. */
+const reportedError = "Upstream returned HTTP 404 for the item";
 
 /** The JSON-RPC fields this fixture reads. */
 const JsonRpcRequest = Schema.Struct({
@@ -169,12 +179,13 @@ const JsonRpcRequest = Schema.Struct({
 
 /**
  * An MCP server that refuses the requests `refuse` selects. Its `lookup` tool may change data; its
- * `peek` tool declares that it only reads.
+ * `peek` tool says it only reads (`readOnlyHint`), which only an app's `kinds` can confirm.
  */
 const refusingMcpServer = Effect.gen(function* () {
   const refuses = yield* Ref.make<Refusal>("everything");
   const silentCalls = yield* Ref.make(0);
   const droppedCalls = yield* Ref.make<ReadonlyArray<string>>([]);
+  const answeredCalls = yield* Ref.make<ReadonlyArray<string>>([]);
   const answer = (id: string | number | null, body: object, status = 200) =>
     HttpServerResponse.json({ jsonrpc: "2.0", id, ...body }, { status });
   const refused = (id: string | number | null) =>
@@ -223,6 +234,13 @@ const refusingMcpServer = Effect.gen(function* () {
           source.socket.destroy();
           return HttpServerResponse.empty({ status: 500 });
         }
+        if (refusing === "error-results") {
+          yield* Ref.update(answeredCalls, (calls) => [...calls, message.params?.name ?? ""]);
+          if (message.params?.name === "lookup")
+            return yield* answer(message.id, {
+              result: { isError: true, content: [{ type: "text", text: reportedError }] },
+            });
+        }
         if (refusing === "silent-calls") {
           yield* Ref.update(silentCalls, (count) => count + 1);
           // Long after the app stopped waiting, so the request still ends with the scenario.
@@ -257,6 +275,8 @@ const refusingMcpServer = Effect.gen(function* () {
     silentCalls: Ref.get(silentCalls),
     /** The tools the server ran before its connection closed, in order. */
     droppedCalls: Ref.get(droppedCalls),
+    /** The tools the server answered in `error-results`, in order. */
+    answeredCalls: Ref.get(answeredCalls),
   };
 });
 
@@ -346,7 +366,7 @@ export default defineApp({}, async () => ({
 /**
  * An app whose dynamic tools save a record named after the tool to the service at `url` while the
  * app resolves them, as a factory that registers something does, and then fail before any handler
- * runs. `configure` (a mutation) and `inspect` (a read) throw an error named like an invalid
+ * runs. `configure` (a mutation) and `inspect` (a read its code confirms) throw an error named like an invalid
  * `mcpRouter` option, `warm` throws an unavailable app cache, and `send` throws an MCP failure
  * saying its arguments could not be used. Listing the tools writes nothing.
  */
@@ -362,7 +382,7 @@ class McpOptionsInvalid extends Error {
     this.code = "invalid_option";
   }
 }
-const tool = (name, readOnly) => ({ name, description: "Resolve " + name, inputSchema: { type: "object", properties: {} }, ...(readOnly ? { readOnly } : {}) });
+const tool = (name, readOnly) => ({ name, description: "Resolve " + name, inputSchema: { type: "object", properties: {} }, ...(readOnly ? { readOnly, kindConfirmed: true } : {}) });
 export default defineApp({}, {
   tools: dynamicRouter({
     list: async () => [tool("configure"), tool("inspect", true), tool("warm"), tool("send")],
@@ -586,7 +606,7 @@ const RestFailure = Schema.Struct({
 });
 
 /** An app whose only tools come from the MCP server at `url`, waiting `timeoutMs` for each call. */
-const mcpAppFiles = (url: string, timeoutMs?: number) => [
+const mcpAppFiles = (url: string, timeoutMs?: number, kinds?: Record<string, "query">) => [
   {
     path: "package.json",
     content: JSON.stringify({
@@ -597,7 +617,7 @@ const mcpAppFiles = (url: string, timeoutMs?: number) => [
     path: "index.ts",
     content: `import { defineApp } from "apps";
 import { mcpRouter } from "apps/mcp";
-export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON.stringify(url)}${timeoutMs === undefined ? "" : `, timeoutMs: ${timeoutMs}`} }) }));`,
+export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON.stringify(url)}${timeoutMs === undefined ? "" : `, timeoutMs: ${timeoutMs}`} }${kinds === undefined ? "" : `, ${JSON.stringify(kinds)}`}) }));`,
   },
 ];
 
@@ -660,7 +680,7 @@ export default defineApp({}, async () => ({ tools: router({
 }) }));`;
 
 // `publish` needs approval for every call and records each run, so `runs` shows which calls ran.
-// `ask` asks the person a question too large for any execute result, and reports how that failed.
+// `ask` asks the person a question over 100,000 bytes.
 const publishAppFiles = [
   {
     path: "migrations/0001_runs.sql",
@@ -700,6 +720,12 @@ const PublishPending = Schema.Struct({
   elicitation: Schema.Struct({ message: Schema.String }),
 });
 const LinkedPending = Schema.Struct({ ...PublishPending.fields, approvalUrl: Schema.String });
+/** A pending question from the app's own code, with the message the person reads. */
+const QuestionPending = Schema.Struct({
+  status: Schema.Literal("input-required"),
+  requestId: Schema.String,
+  elicitation: Schema.Struct({ message: Schema.String }),
+});
 /** The last characters of a long argument, which a shortened prompt would hide. */
 const ending = "END-OF-THE-BODY";
 
@@ -775,6 +801,23 @@ const Pending = Schema.Struct({
   requestId: Schema.String,
 });
 
+/** A failed execution's error with the phase it stopped and the reference of its request. */
+const Located = Schema.Struct({
+  execution: Schema.Struct({
+    error: Schema.Struct({
+      message: Schema.String,
+      response: Schema.Struct({ phase: Schema.String, reference: Schema.String }),
+    }),
+  }),
+});
+
+/** The trace the client sent with its latest request, which the server continues. */
+const latestTrace = Effect.gen(function* () {
+  const trace = (yield* (yield* Evidence).requests).at(-1)?.traceId;
+  if (trace === undefined) throw new Error("The request trace was not recorded");
+  return trace;
+});
+
 type Connected = Effect.Success<ReturnType<Effect.Success<typeof McpClient>["connect"]>>;
 
 /** Run one execute and return its decoded completed result with the client's elapsed time. */
@@ -885,6 +928,16 @@ const Unavailable = Schema.Struct({
   requestId: Schema.String,
   reason: Schema.String,
   message: Schema.String,
+  /** The caller's open requests, which it can still resume. */
+  pending: Schema.Array(
+    Schema.Struct({
+      requestId: Schema.String,
+      status: Schema.String,
+      app: Schema.String,
+      tool: Schema.String,
+      expiresAt: Schema.Number,
+    }),
+  ),
 });
 
 /** Answer one pending request and return the structured result. */
@@ -1002,12 +1055,23 @@ layer(HostedLive, { excludeTestServices: true })("Hosted MCP execute failures",
           `return await ${app}.fails({});`,
           "resume-fails-pending.json",
         );
+        const started = yield* latestTrace;
         const resumed = yield* resumeOnce(
           client,
           "Approve at once a call that then fails",
           failing,
           "resume-fails-result.json",
         );
+        // The failure names the resume that met and reports it, not the execute that started the
+        // program, in the summary and the structured response alike.
+        const resuming = yield* latestTrace;
+        expect(resuming).not.toBe(started);
+        const approvedFailure = (yield* Schema.decodeUnknownEffect(Located)(resumed)).execution
+          .error;
+        expect(approvedFailure.response).toEqual({ phase: "call", reference: resuming });
+        expect(approvedFailure.message.endsWith(` Phase: call. Reference: ${resuming}.`)).toBe(
+          true,
+        );
         const failed = yield* Schema.decodeUnknownEffect(Failed)(resumed);
         expect(failed.execution.error.kind).toBe("ToolFailure");
         expect(failed.execution.error.response?.code).toBe("ToolCallFailed");
@@ -1020,6 +1084,28 @@ layer(HostedLive, { excludeTestServices: true })("Hosted MCP execute failures",
         expect(response).toMatchObject({ code: "ToolCallFailed", retryable: false });
         expectUnknownOutcome(response.recovery);
 
+        // So does a later call that fails once the approval let the program continue.
+        const continuing = yield* pendingApproval(
+          client,
+          "Ask to approve a call before a read that fails",
+          `await ${app}.approved({});\nreturn await ${app}.broken({});`,
+          "resume-later-pending.json",
+        );
+        const continued = yield* latestTrace;
+        const later = (yield* Schema.decodeUnknownEffect(Located)(
+          yield* resumeOnce(
+            client,
+            "Approve the call, then fail the next one",
+            continuing,
+            "resume-later-result.json",
+          ),
+        )).execution.error;
+        const laterResume = yield* latestTrace;
+        expect(laterResume).not.toBe(continued);
+        expect(later.message).toContain("The later lookup failed");
+        expect(later.response).toEqual({ phase: "call", reference: laterResume });
+        expect(later.message.endsWith(` Phase: call. Reference: ${laterResume}.`)).toBe(true);
+
         // A dashboard run's review receives the same failure with its answer.
         const run = yield* body(
           Pending,
@@ -1144,6 +1230,43 @@ layer(HostedLive, { excludeTestServices: true })("Hosted MCP execute failures",
         );
         expect(foreign).toMatchObject({ requestId: pending, reason: "not-found" });
         expect(foreign.message).not.toContain("already answered");
+        // Nor does it list the first grant's open request among its own.
+        expect(foreign.pending).toEqual([]);
+
+        // An ID cut short, as a redacted transcript shows it, is named as not one Executor issues,
+        // and the grant's open requests are listed so it can resume the right one.
+        for (const [label, requestId] of [
+          ["shortened", pending.slice(0, 12)],
+          ["redacted", "apr_…"],
+        ] as const) {
+          const malformed = yield* Schema.decodeUnknownEffect(Unavailable)(
+            yield* resumeOnce(
+              client,
+              `Answer with a ${label} request ID`,
+              requestId,
+              `resume-${label}.json`,
+            ),
+          );
+          expect(malformed).toMatchObject({ requestId, reason: "malformed" });
+          expect(malformed.message).toContain("not one Executor issues");
+          expect(malformed.pending).toEqual([
+            expect.objectContaining({ requestId: pending, status: "approval-required" }),
+          ]);
+        }
+        // A well-formed ID Executor never issued is not found; the open request is still listed.
+        const unknown = yield* Schema.decodeUnknownEffect(Unavailable)(
+          yield* resumeOnce(
+            client,
+            "Answer with an ID Executor never issued",
+            `apr_${randomUUID()}`,
+            "resume-never-issued.json",
+          ),
+        );
+        expect(unknown.reason).toBe("not-found");
+        // A missing record does not prove the request was never issued, so the copy claims neither.
+        expect(unknown.message).toContain("no retained record of this request");
+        expect(unknown.message).not.toMatch(/issued no request|never issued/i);
+        expect(unknown.pending.map((open) => open.requestId)).toEqual([pending]);
         const owned = yield* Schema.decodeUnknownEffect(Completed)(
           yield* resumeOnce(
             client,
@@ -1509,7 +1632,7 @@ layer(HostedLive, { excludeTestServices: true })("Hosted MCP execute failures",
         const { error } = (yield* Schema.decodeUnknownEffect(Failed)(rejected.structured))
           .execution;
         // The problem names the keys the object takes; the supplied text is not echoed.
-        expect(error.message).toBe(
+        expect(siteless(error.message)).toBe(
           "InputInvalid (HTTP 422): Input failed validation: input.query: Expected object {text, limit?} Recovery: Change the input to the shape each problem expects, then call the tool again. Retryable (unchanged call): no.",
         );
         // `retryable: false` is about the unchanged call: a program that corrects the input makes
@@ -1535,7 +1658,10 @@ try { return await find({query: "fixture text"}); } catch (error) {
         );
         // An optional object is described by its keys, not as a union with undefined.
         expect(
-          (yield* Schema.decodeUnknownEffect(Failed)(optional.structured)).execution.error.message,
+          siteless(
+            (yield* Schema.decodeUnknownEffect(Failed)(optional.structured)).execution.error
+              .message,
+          ),
         ).toBe(
           "InputInvalid (HTTP 422): Input failed validation: input.filter: Expected object {tag} Recovery: Change the input to the shape each problem expects, then call the tool again. Retryable (unchanged call): no.",
         );
@@ -1547,7 +1673,9 @@ try { return await find({query: "fixture text"}); } catch (error) {
         );
         // A union reached through a recursive reference is described like any other.
         expect(
-          (yield* Schema.decodeUnknownEffect(Failed)(nested.structured)).execution.error.message,
+          siteless(
+            (yield* Schema.decodeUnknownEffect(Failed)(nested.structured)).execution.error.message,
+          ),
         ).toBe(
           "InputInvalid (HTTP 422): Input failed validation: input.child: Expected object {child?, name, ...} or object {child?, id, ...}. Closest is alternative 1, whose problems follow; input.child.name: Missing key Recovery: Change the input to the shape each problem expects, then call the tool again. Retryable (unchanged call): no.",
         );
@@ -1662,7 +1790,7 @@ return messages;`,
         // The agent learns that the app's own policy refused the call and not to repeat it, not
         // only the error's name. The policy is the app's code and ran after the app received the
         // mutation, so the refusal does not show that nothing changed.
-        expect(error.message).toBe(
+        expect(siteless(error.message)).toBe(
           `ToolBlocked (HTTP 403): The approval policy in the app’s code denied this call to “remove”. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(error.response).toEqual({ code: "ToolBlocked", status: 403 });
@@ -1799,72 +1927,74 @@ return messages;`,
           ),
         ).toMatchObject({ ok: true, value: { title: "Boundary report", length: 95_000 } });
 
-        // Arguments the execute result cannot hold once are refused with the request's size and
-        // the limit, not only the error's name.
-        const refusal =
-          /^ApprovalTooLarge \(HTTP 413\): The approval request for “publish” is (\d+) bytes, over the 100000-byte limit for an approval request, so Executor did not ask for approval and will not run the call\. Recovery: Make the arguments smaller/u;
-        const refusedBytes = (label: string, body: string, file: string) =>
+        // Executor sets no size limit on a request: arguments far over 100,000 bytes, in ASCII or
+        // three-byte characters, are offered whole, and approving them runs the call.
+        const offered = (label: string, title: string, body: string, file: string) =>
           Effect.gen(function* () {
-            const refused = yield* executeOnce(
+            const parked = yield* executeOnce(
               client,
               label,
-              `return await ${publish("Oversized report", body)};`,
+              `return await ${publish(title, body)};`,
               file,
             );
-            const { error } = (yield* Schema.decodeUnknownEffect(Failed)(refused.structured))
-              .execution;
-            expect(error.response).toEqual({ code: "ApprovalTooLarge", status: 413 });
-            const measured = refusal.exec(error.message);
-            if (measured === null) return yield* Effect.die(`Unexpected refusal: ${error.message}`);
-            return { bytes: Number(measured[1]), structured: refused.structured };
+            const pending = yield* Schema.decodeUnknownEffect(PublishPending)(parked.structured);
+            expect(pending.invocation.input.title).toBe(title);
+            return pending;
           });
-        const refused = yield* refusedBytes(
+        const large = yield* offered(
           "Ask approval for a call with 110 KB of arguments",
+          "Large report",
           ascii(110_000),
-          "oversized-approval.json",
+          "large-approval-offered.json",
         );
-        expect(refused.bytes).toBeGreaterThan(110_000);
-        expect(refused.bytes).toBeLessThan(115_000);
-        // 34,000 three-byte characters: short in characters, but over the limit in UTF-8 bytes.
-        const multibyte = yield* refusedBytes(
+        expect(large.invocation.input.body).toBe("A".repeat(110_000));
+        expect(
+          yield* accept(
+            "Approve the call with 110 KB of arguments",
+            large.requestId,
+            "large-approval-offered-resumed.json",
+          ),
+        ).toMatchObject({ ok: true, value: { title: "Large report", length: 110_000 } });
+        const multibyte = yield* offered(
           "Ask approval for a call with 34,000 euro signs",
+          "Euro report",
           `"€".repeat(34_000)`,
-          "oversized-multibyte-approval.json",
-        );
-        expect(multibyte.bytes).toBeGreaterThan(102_000);
-        const caught = yield* executeOnce(
-          client,
-          "Catch the oversized approval and read its recovery",
-          `try { await ${publish("Oversized report", ascii(110_000))}; return "ran"; } catch (error) { return error.message; }`,
-          "oversized-approval-caught.json",
+          "multibyte-approval-offered.json",
         );
-        const recovery = yield* Schema.decodeUnknownEffect(CaughtRecovery)(
-          (yield* Schema.decodeUnknownEffect(Completed)(caught.structured)).execution.value,
-        );
-        expect(recovery).toMatchObject({ code: "ApprovalTooLarge", status: 413 });
-        expect(recovery.recovery.instructions).toContain(
-          "Calling it again with the same arguments fails the same way",
-        );
-        expect(recovery.recovery.instructions).toContain("a URL");
-        const uncaught = yield* Schema.decodeUnknownEffect(UncaughtRecovery)(refused.structured);
-        expect(uncaught.execution.error.response.recovery).toEqual(recovery.recovery);
-        // None of the refused calls ran.
-        expect(yield* runs("Read the runs after the refusals", "runs-after-refusal.json")).toEqual([
+        expect(multibyte.invocation.input.body).toBe("€".repeat(34_000));
+        expect(
+          yield* accept(
+            "Approve the call with 34,000 euro signs",
+            multibyte.requestId,
+            "multibyte-approval-offered-resumed.json",
+          ),
+        ).toMatchObject({ ok: true, value: { title: "Euro report", length: 34_000 } });
+        expect(
+          yield* runs("Read the runs after the large approvals", "runs-after-large.json"),
+        ).toEqual([
           { title: "Weekly report", length: 60_000 },
           { title: "Boundary report", length: 95_000 },
+          { title: "Large report", length: 110_000 },
+          { title: "Euro report", length: 34_000 },
         ]);
 
-        // An app's own question too large to return reaches the app as an invalid request, and
-        // the program finishes instead of waiting for an answer.
+        // An app's own question over 100,000 bytes reaches the agent whole, and the answer reaches
+        // the app.
         const asked = yield* executeOnce(
           client,
-          "Ask a question larger than an execute result",
+          "Ask a question over 100,000 bytes",
           `return await ${app}.ask({});`,
-          "oversized-question.json",
+          "large-question.json",
         );
+        const question = yield* Schema.decodeUnknownEffect(QuestionPending)(asked.structured);
+        expect(question.elicitation.message).toBe("Q".repeat(110_000));
         expect(
-          (yield* Schema.decodeUnknownEffect(Completed)(asked.structured)).execution,
-        ).toMatchObject({ ok: true, value: { reason: "invalid-request" } });
+          yield* accept(
+            "Answer the large question",
+            question.requestId,
+            "large-question-answered.json",
+          ),
+        ).toMatchObject({ ok: true, value: { asked: true } });
 
         // The browser review shows the exact arguments, so its end is visible, and approving
         // there runs the call.
@@ -1920,8 +2050,8 @@ return messages;`,
           (yield* Schema.decodeUnknownEffect(Completed)(collected.structuredContent)).execution,
         ).toMatchObject({ ok: true, value: { title: "Browser report", length: 40_015 } });
 
-        // A native client is sent only the prompt. It shows the exact arguments when they fit an
-        // execute result, and the shortened prompt above that, so larger calls are approved too.
+        // A native client is sent only the prompt. It shows the exact arguments up to 100,000 bytes,
+        // and the shortened prompt above that, so larger calls are approved too.
         const native = yield* mcp.connect(key, "large-approval-native", {
           organization: actors.organization.id,
           mode: "native",
@@ -1970,6 +2100,8 @@ return messages;`,
         ).toEqual([
           { title: "Weekly report", length: 60_000 },
           { title: "Boundary report", length: 95_000 },
+          { title: "Large report", length: 110_000 },
+          { title: "Euro report", length: 34_000 },
           { title: "Browser report", length: 40_015 },
           { title: "Native exact report", length: 40_015 },
           { title: "Native report", length: 100_000 },
@@ -2153,8 +2285,12 @@ export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON
           actors = yield* Actors;
         const server = yield* refusingMcpServer;
         // The server lists its tools, then never answers a call; the app waits one second for it.
+        // The app confirms that `peek` only reads.
         yield* server.refuse("silent-calls");
-        const app = yield* hostedAppFiles("Silent MCP call", mcpAppFiles(server.url, 1_000));
+        const app = yield* hostedAppFiles(
+          "Silent MCP call",
+          mcpAppFiles(server.url, 1_000, { peek: "query" }),
+        );
 
         // The API names the timed-out call and says the server may still finish it. The tool may
         // change data, so the agent is told not to repeat it at all.
@@ -2192,7 +2328,7 @@ export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON
         const { message, response } = (yield* Schema.decodeUnknownEffect(ToolFailed)(
           executed.structured,
         )).execution.error;
-        expect(message).toBe(
+        expect(siteless(message)).toBe(
           `ToolCallFailed (HTTP 502): The app’s MCP server did not answer the tool call in time, so Executor stopped waiting. The server may still finish it. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(message).not.toContain("The app threw");
@@ -2206,8 +2342,8 @@ export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON
         );
         expect(caught.structured).toMatchObject({ execution: { ok: true, value: false } });
 
-        // A tool that only reads cannot repeat a change, so one more attempt is offered, and the
-        // retry flag says so too.
+        // A tool the app confirms only reads cannot repeat a change, so one more attempt is
+        // offered, and the retry flag says so too.
         const peeked = yield* executeOnce(
           app.client,
           "Call a read-only tool whose MCP server never answers",
@@ -2225,7 +2361,9 @@ export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON
               "The server may still complete the first attempt. For a read, you may retry once; if it times out again, check the server’s status before repeating it. Reduce the input only if that still meets the task. Do not expose credentials.",
           },
         });
-        expect(read.message).toMatch(/ Retryable \(unchanged call\): yes\.$/);
+        expect(read.message).toMatch(
+          / Retryable \(unchanged call\): yes\. Phase: [a-z]+\. Reference: [0-9a-f]{32}\.$/,
+        );
         // A program can follow the flag: it repeats the read once, unchanged, and stops there.
         const retried = yield* executeOnce(
           app.client,
@@ -2255,9 +2393,13 @@ try { return await call(); } catch (error) {
         const api = yield* Api,
           actors = yield* Actors;
         const server = yield* refusingMcpServer;
-        // The server runs each call, then its connection closes before it answers.
+        // The server runs each call, then its connection closes before it answers. The app
+        // confirms that `peek` only reads.
         yield* server.refuse("dropped-calls");
-        const app = yield* hostedAppFiles("Dropped MCP call", mcpAppFiles(server.url));
+        const app = yield* hostedAppFiles(
+          "Dropped MCP call",
+          mcpAppFiles(server.url, undefined, { peek: "query" }),
+        );
 
         // The call may have changed data and its outcome is unknown, so the agent is told not to
         // repeat it.
@@ -2290,12 +2432,12 @@ try { return await call(); } catch (error) {
           write.response.recovery,
           "For a call that only reads, the advice for this failure is: “Retry at most once.",
         );
-        expect(write.message).toBe(
+        expect(siteless(write.message)).toBe(
           `ToolCallFailed (HTTP 502): The request to the app’s MCP server failed before the server answered the tool call, so Executor cannot tell whether the server ran it. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(write.message).not.toContain("Try again");
 
-        // The same failure of a read can be repeated: it cannot repeat a change.
+        // The same failure of a confirmed read can be repeated: it cannot repeat a change.
         const peeked = yield* executeOnce(
           app.client,
           "Call a read-only tool whose MCP server closes the connection after running it",
@@ -2312,12 +2454,234 @@ try { return await call(); } catch (error) {
               "Retry at most once. If it fails again, check the server’s status and connection.",
           },
         });
-        expect(read.message).toMatch(/ Retryable \(unchanged call\): yes\.$/);
+        expect(read.message).toMatch(
+          / Retryable \(unchanged call\): yes\. Phase: [a-z]+\. Reference: [0-9a-f]{32}\.$/,
+        );
         // The server ran every call exactly once: Executor repeated none of them.
         expect(yield* server.droppedCalls).toEqual(["lookup", "lookup", "peek"]);
       }).pipe(Effect.provide(McpClient.layer)),
     ),
   );
+  it.effect(scenarios.mcpExecuteHintedReadTimedOut.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const server = yield* refusingMcpServer;
+        // `peek` says it only reads, yet the server counts every call it receives and never
+        // answers one. The app has no `kinds` entry for it, so only the server's hint calls it a
+        // query.
+        yield* server.refuse("silent-calls");
+        const app = yield* hostedAppFiles("Hinted MCP read", mcpAppFiles(server.url, 1_000));
+        const peek = `tools[${JSON.stringify(app.slug)}].peek`;
+
+        // A program that follows the retry policy repeats the call only when its error says an
+        // unchanged repeat is safe. The hint does not make it safe, so the call runs once.
+        const followed = yield* executeOnce(
+          app.client,
+          "Repeat a timed-out hinted read only when its error says it is retryable",
+          `const call = () => ${peek}({});
+let retries = 0;
+try { return await call(); } catch (error) {
+  if (!JSON.parse(error.message).retryable) return { retries, retryable: false };
+  retries += 1;
+  try { return await call(); } catch (again) { return { retries, retryable: JSON.parse(again.message).retryable }; }
+}`,
+          "hinted-read-followed.json",
+        );
+        expect(followed.structured).toMatchObject({
+          execution: { ok: true, value: { retries: 0, retryable: false } },
+        });
+        expect(yield* server.silentCalls).toBe(1);
+
+        // The agent is told the call may have changed data, and the read's advice is quoted, not
+        // offered.
+        const executed = yield* executeOnce(
+          app.client,
+          "Call a hinted read whose MCP server never answers",
+          `return await ${peek}({});`,
+          "hinted-read.json",
+        );
+        const { message, response } = (yield* Schema.decodeUnknownEffect(ToolFailed)(
+          executed.structured,
+        )).execution.error;
+        expect(siteless(message)).toBe(
+          `ToolCallFailed (HTTP 502): The app’s MCP server did not answer the tool call in time, so Executor stopped waiting. The server may still finish it. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
+        );
+        expect(response).toMatchObject({ code: "ToolCallFailed", retryable: false });
+        expectUnknownOutcome(
+          response.recovery,
+          "For a call that only reads, the advice for this failure is: “You may retry once.",
+        );
+
+        // A direct call gets the same answer.
+        const direct = yield* app.client.use("Call a hinted read directly", (client, signal) =>
+          client.callTool(
+            { name: "call", arguments: { calls: { path: peek, input: {} } } },
+            undefined,
+            {
+              signal,
+              timeout: 55_000,
+            },
+          ),
+        );
+        const called = yield* Schema.decodeUnknownEffect(
+          Schema.Struct({
+            execution: Schema.Struct({
+              value: Schema.Struct({
+                ok: Schema.Literal(false),
+                error: Schema.Struct({
+                  response: Schema.Struct({
+                    code: Schema.String,
+                    retryable: Schema.Boolean,
+                    recovery: Schema.Struct({ action: Schema.String, instructions: Schema.String }),
+                  }),
+                }),
+              }),
+            }),
+          }),
+        )(direct.structuredContent);
+        expect(called.execution.value.error.response).toMatchObject({
+          code: "ToolCallFailed",
+          retryable: false,
+          recovery: { action: unknownOutcomeAction },
+        });
+
+        // So does an API caller that names the call a query: the caller's kind is not the app's.
+        const rest = yield* api.request(actors.owner, "POST", `${app.path}/tools/call`, {
+          tool: "peek",
+          kind: "query",
+          input: {},
+        });
+        expect(rest.status, JSON.stringify(rest.body)).toBe(502);
+        expect(rest.body).toMatchObject({
+          _tag: "ToolCallFailed",
+          mcp: { phase: "call", reason: "timeout" },
+          mayHaveWritten: true,
+          recovery: { action: unknownOutcomeAction },
+        });
+
+        // Each call reached the server once: neither Executor nor the advice repeated one.
+        expect(yield* server.silentCalls).toBe(4);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+  it.effect(scenarios.mcpExecuteToolReportedError.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const server = yield* refusingMcpServer;
+        yield* server.refuse("error-results");
+        // `remote` and `reviewed` are the same server; `reviewed` asks for approval first.
+        // `lookalike` is the app's own tool, whose result only looks like an MCP failure.
+        const app = yield* hostedAppFiles("Reported MCP error", [
+          {
+            path: "package.json",
+            content: JSON.stringify({
+              dependencies: withApps({ "@modelcontextprotocol/sdk": mcpSdkVersion }),
+            }),
+          },
+          {
+            path: "index.ts",
+            content: `import { defineApp, object, query, router, withApprovals } from "apps";
+import { always } from "apps/operations/approval";
+import { mcpRouter } from "apps/mcp";
+export default defineApp({}, async () => ({ tools: router({
+  remote: await mcpRouter({ url: ${JSON.stringify(server.url)} }),
+  reviewed: withApprovals(await mcpRouter({ url: ${JSON.stringify(server.url)} }), () => always()),
+  lookalike: query({ input: object({}) }, async () => ({ isError: true, content: [] })),
+}) }));`,
+          },
+        ]);
+        const tools = `tools[${JSON.stringify(app.slug)}]`;
+        const Outcomes = Schema.Struct({
+          status: Schema.Literal("completed"),
+          execution: Schema.Struct({
+            ok: Schema.Literal(true),
+            value: Schema.Unknown,
+            toolCalls: Schema.Array(Schema.Struct({ name: Schema.String, outcome: Schema.String })),
+          }),
+        });
+        const outcomes = (structured: unknown) =>
+          Schema.decodeUnknownEffect(Outcomes)(structured).pipe(
+            Effect.map(({ execution }) => ({
+              value: execution.value,
+              calls: execution.toolCalls.map(({ name, outcome }) => [name, outcome]),
+            })),
+          );
+
+        // The program still receives the server's result whole, so one that reads `isError`
+        // works as before; the call that reported failure is no longer listed as a success.
+        const executed = yield* executeOnce(
+          app.client,
+          "Call a remote MCP tool whose result says it failed",
+          `const failed = await ${tools}.remote.lookup({});
+const read = await ${tools}.remote.peek({});
+const lookalike = await ${tools}.lookalike({});
+return { failed: failed.isError, text: failed.content[0].text, read: read.isError ?? false, lookalike: lookalike.isError };`,
+          "reported-error.json",
+        );
+        expect(yield* outcomes(executed.structured)).toEqual({
+          value: { failed: true, text: reportedError, read: false, lookalike: true },
+          calls: [
+            [`${app.slug}.remote.lookup`, "failure"],
+            [`${app.slug}.remote.peek`, "success"],
+            // A field an app returns means what the app says: Executor reads no failure into it.
+            [`${app.slug}.lookalike`, "success"],
+          ],
+        });
+
+        // A direct call returns the same result and lists it the same way.
+        const direct = yield* app.client.use(
+          "Call the remote MCP tool directly",
+          (client, signal) =>
+            client.callTool(
+              {
+                name: "call",
+                arguments: { calls: { path: `${tools}.remote.lookup`, input: {} } },
+              },
+              undefined,
+              { signal, timeout: 55_000 },
+            ),
+        );
+        expect(yield* outcomes(direct.structuredContent)).toEqual({
+          value: {
+            path: `${tools}.remote.lookup`,
+            ok: true,
+            value: { isError: true, content: [{ type: "text", text: reportedError }] },
+          },
+          calls: [[`${tools}.remote.lookup`, "failure"]],
+        });
+
+        // So does a call that ran after its approval.
+        const parked = yield* executeOnce(
+          app.client,
+          "Call a remote MCP tool that asks for approval and then says it failed",
+          `return (await ${tools}.reviewed.lookup({})).isError;`,
+          "reported-error-approval.json",
+        );
+        const pending = yield* Schema.decodeUnknownEffect(Pending)(parked.structured);
+        const resumed = yield* app.client.use("Approve the call", (client, signal) =>
+          client.callTool(
+            {
+              name: "resume",
+              arguments: { requestId: pending.requestId, response: { action: "accept" } },
+            },
+            undefined,
+            { signal, timeout: 55_000 },
+          ),
+        );
+        expect(yield* outcomes(resumed.structuredContent)).toEqual({
+          value: true,
+          calls: [[`${app.slug}.reviewed.lookup`, "failure"]],
+        });
+
+        // Executor repeated none of the calls.
+        expect(yield* server.answeredCalls).toEqual(["lookup", "peek", "lookup", "lookup"]);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
   it.effect(scenarios.mcpExecutePendingWriteRefused.title, (context) =>
     withHostedCase(
       context,
@@ -2360,7 +2724,9 @@ try { return await call(); } catch (error) {
           expectUnknownOutcome(response.recovery);
           expect(message).toContain(`(HTTP ${status}) while calling a tool.`);
           expect(
-            message.endsWith(` Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`),
+            siteless(message).endsWith(
+              ` Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
+            ),
           ).toBe(true);
           // A read right after the failure shows nothing saved, yet the change still lands.
           expect(
@@ -2456,7 +2822,7 @@ try { return await call(); } catch (error) {
             "Try again. If this continues, check the MCP server’s address and status. Use the reported phase and error to identify the failure. Check the server URL, transport or access settings only when relevant. Do not expose credentials.",
           ),
         );
-        expect(write.message).toBe(
+        expect(siteless(write.message)).toBe(
           `AppEvaluationFailed (HTTP 502): ${unreachable} Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         // Both calls saved their record before the MCP connection failed.
@@ -2532,7 +2898,7 @@ try { return await call(); } catch (error) {
         expect(configure.response.recovery.instructions).toContain(
           "For a call that only reads, the advice for this failure is: “Try again. If this continues, investigate this error and fix its cause.",
         );
-        expect(configure.message).toBe(
+        expect(siteless(configure.message)).toBe(
           `AppEvaluationFailed (HTTP 502): ${optionsFailure} Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         // One record for each call: the agent was not told to repeat either.
@@ -2717,7 +3083,7 @@ try { return await call(); } catch (error) {
               `write-failure-${mode}-kind-mismatch.json`,
             )).structured,
           )).execution.error;
-          expect(mismatched.message).toBe(
+          expect(siteless(mismatched.message)).toBe(
             `ToolKindMismatch (HTTP 409): The tool “ToolKindMismatch” is a query, but it was called as a mutation. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
           );
           // A REST caller that cannot present the approval prompt is told the call may have
@@ -2877,7 +3243,7 @@ try { return await call(); } catch (error) {
           .execution.error;
         expect(failed.response).toMatchObject({ code: "StorageError", retryable: false });
         expectUnknownOutcome(failed.response.recovery);
-        expect(failed.message).toBe(
+        expect(siteless(failed.message)).toBe(
           `StorageError (HTTP 500): Executor could not read or write its saved data. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expectNoRepeatAdvice(failed.response.recovery.instructions, "MCP");
@@ -3058,4 +3424,51 @@ try { return await call(); } catch (error) {
       }).pipe(Effect.provide(McpClient.layer)),
     ),
   );
+  it.effect(scenarios.mcpExecuteColdQueryNotReevaluated.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const service = yield* recordingService;
+        const app = yield* hostedApp("Cold query", unnamedKindAppSource(service.url));
+        const check = api.request(actors.owner, "POST", `${app.path}/tools/call`, {
+          tool: "check",
+          kind: "query",
+          input: {},
+        });
+
+        // Nobody has listed the app's tools, so no kept listing confirms that `check` only reads.
+        // The call evaluated the factory, which saved a record, and its handler failed. Executor
+        // does not evaluate the app again to find out: that would save the factory's record twice.
+        // The call is reported as possibly written and not offered as a retry.
+        const cold = yield* check;
+        expect(yield* service.saved).toEqual(["factory", "handler"]);
+        expect(cold.status, JSON.stringify(cold.body)).toBe(502);
+        expect(cold.body).toMatchObject({
+          _tag: "ToolCallFailed",
+          failure: { errorName: "CacheError", code: "unavailable" },
+          mayHaveWritten: true,
+          recovery: { action: unknownOutcomeAction },
+        });
+
+        // Listing the tools keeps a listing in which the app confirms `check` only reads; the same
+        // call keeps the query's own advice, and still evaluates the factory once.
+        const listed = yield* api.request(actors.owner, "GET", `${app.path}/tools`);
+        expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+        expect((yield* service.saved).slice(2)).toEqual(["factory"]);
+        const warm = yield* check;
+        expect(warm.status, JSON.stringify(warm.body)).toBe(502);
+        expect(warm.body).toMatchObject({
+          _tag: "ToolCallFailed",
+          recovery: {
+            action:
+              "Retry once after a short wait. If it fails again, report that the app’s storage is failing.",
+          },
+        });
+        expect(warm.body).not.toHaveProperty("mayHaveWritten");
+        expect((yield* service.saved).slice(3)).toEqual(["factory", "handler"]);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
 });
diff --git a/e2e/tests/mcp-execute-lazy.spec.ts b/e2e/tests/mcp-execute-lazy.spec.ts
index 216eab8379..f996bd71fc 100644
--- a/e2e/tests/mcp-execute-lazy.spec.ts
+++ b/e2e/tests/mcp-execute-lazy.spec.ts
@@ -74,8 +74,8 @@ const SearchPage = Schema.Struct({
 });
 
 /**
- * An organization's apps and an MCP client that runs programs. Each run returns the result and the
- * request's spans, by operation name, once the execute span is delivered.
+ * An organization's apps and an MCP client that runs programs. Each run returns the result, the
+ * request's trace and its spans, by operation name, once the execute span is delivered.
  */
 const setup = (label: string, apps: ReadonlyArray<{ name: string; source: string }>) =>
   Effect.gen(function* () {
@@ -136,7 +136,7 @@ const setup = (label: string, apps: ReadonlyArray<{ name: string; source: string
           ),
           Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 80 }),
         );
-        return { ...completed, spans };
+        return { ...completed, spans, trace: request.traceId };
       });
     return { apps: deployed, execute };
   });
@@ -300,7 +300,19 @@ return await tools[name].missing({});`,
 return await tools[name].echo({ text: "x" });`,
         );
         expect(staticBroken.execution).toMatchObject({ ok: false, error: { kind: "ToolFailure" } });
-        expect(dynamicBroken.execution).toEqual(staticBroken.execution);
+        // Each failure names the trace of the request that met it, so only that reference differs.
+        const reference = (run: { trace: string }) => `Reference: ${run.trace}.`;
+        expect(staticBroken.execution.error?.message).toContain(reference(staticBroken));
+        expect(dynamicBroken.execution).toEqual({
+          ok: false,
+          error: {
+            kind: staticBroken.execution.error?.kind,
+            message: staticBroken.execution.error?.message.replace(
+              reference(staticBroken),
+              reference(dynamicBroken),
+            ),
+          },
+        });
         expect(touched(dynamicBroken)).toBe(true);
       }).pipe(Effect.provide(McpClient.layer)),
     ),
diff --git a/e2e/tests/mcp-failure-reference.spec.ts b/e2e/tests/mcp-failure-reference.spec.ts
new file mode 100644
index 0000000000..0cb2fcd6bb
--- /dev/null
+++ b/e2e/tests/mcp-failure-reference.spec.ts
@@ -0,0 +1,476 @@
+/**
+ * Every failure an MCP agent reads names its cause, the phase it stopped (loading the app,
+ * listing its tools or calling one) and the trace of the request that met it, on search, call
+ * and execute alike. The Executor app relays the explanation of Executor's own server errors.
+ */
+import { expect, layer } from "@effect/vitest";
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { Effect, Layer, Schema } from "effect";
+import { HttpRouter, HttpServer, HttpServerResponse } from "effect/http";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { Evidence } from "../support/evidence.ts";
+import { frameworkSession } from "../support/framework.ts";
+import { McpOAuth } from "../support/mcp-oauth.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { appsManifest, mcpSdkVersion, withApps } from "../support/apps-release.ts";
+
+const factoryMarker = "synthetic factory failure";
+
+/** The factory throws its own error: a cause the app states. */
+const throwingApp = `import { defineApp } from "apps";
+export default defineApp({}, async () => { throw new TypeError(${JSON.stringify(factoryMarker)}); });`;
+
+/**
+ * The app's Worker rejects its listing with the text of a runtime limit. The bridge reads the
+ * framework's answer through `Response.prototype.json`, which the app replaces, so the Worker
+ * stops without an answer from the app's code although nothing failed in the runtime.
+ */
+const forgedLimit = "Worker exceeded CPU time limit.";
+const forgingApp = `import { defineApp, query, object, router } from "apps";
+const json = Response.prototype.json;
+export default defineApp({}, async () => {
+  Response.prototype.json = function () {
+    Response.prototype.json = json;
+    return Promise.reject(new Error(${JSON.stringify(forgedLimit)}));
+  };
+  return { tools: router({ ping: query({ input: object({}) }, async () => "pong") }) };
+});`;
+
+/** A dynamic router that lists one tool twice, which the framework refuses without details. */
+const duplicateApp = `import { defineApp, dynamicRouter, query, object } from "apps";
+const ping = { name: "ping", description: "Return pong", inputSchema: { type: "object", properties: {} }, readOnly: true };
+export default defineApp({}, {
+  tools: dynamicRouter({
+    list: async () => [ping, ping],
+    resolve: async () => query({ input: object({}) }, async () => "pong"),
+  }),
+});`;
+
+/** A module whose top-level code throws, so its build fails while Executor loads it. */
+const buildMarker = "synthetic module failure";
+const throwingModule = `throw new RangeError(${JSON.stringify(buildMarker)});
+export default {};`;
+
+/**
+ * A tool that reports its service as unavailable without naming the phase, and one whose report
+ * claims the service failed while Executor listed the app's tools.
+ */
+const providerApp = `import { defineApp, query, object, router, ProviderError } from "apps";
+export default defineApp({}, { tools: router({
+  quota: query({ input: object({}) }, async () => { throw new ProviderError({ reason: "unavailable", status: 503 }); }),
+  listing: query({ input: object({}) }, async () => { throw new ProviderError({ reason: "unavailable", phase: "discover", status: 503 }); }),
+}) });`;
+
+/** A listing whose service failure claims Executor was calling one of the app's tools. */
+const callClaimingApp = `import { defineApp, dynamicRouter, query, object, ProviderError } from "apps";
+export default defineApp({}, {
+  tools: dynamicRouter({
+    list: async () => { throw new ProviderError({ reason: "unavailable", phase: "call", status: 503 }); },
+    resolve: async () => query({ input: object({}) }, async () => "pong"),
+  }),
+});`;
+
+/** Tools from the MCP server at `url`. */
+const mcpAppFiles = (url: string) => [
+  {
+    path: "package.json",
+    content: JSON.stringify({
+      dependencies: withApps({ "@modelcontextprotocol/sdk": mcpSdkVersion }),
+    }),
+  },
+  {
+    path: "index.ts",
+    content: `import { defineApp } from "apps";
+import { mcpRouter } from "apps/mcp";
+export default defineApp({}, async () => ({ tools: await mcpRouter({ url: ${JSON.stringify(url)} }) }));`,
+  },
+];
+
+/** An MCP server that answers every request with a server error. */
+const failingMcpServer = Effect.gen(function* () {
+  const services = yield* Layer.build(
+    HttpRouter.serve(
+      HttpRouter.add("*", "/mcp", Effect.succeed(HttpServerResponse.text("down", { status: 500 }))),
+      { disableLogger: true, disableListenLog: true },
+    ).pipe(Layer.provideMerge(NodeHttpServer.layer(createServer, { host: "127.0.0.1", port: 0 }))),
+  );
+  const server = yield* HttpServer.HttpServer.pipe(Effect.provideContext(services));
+  if (!("port" in server.address)) return yield* Effect.die("Fixture must listen on TCP");
+  return `http://127.0.0.1:${server.address.port}/mcp`;
+});
+
+/** A failure as an agent reads it, with the phase and reference this change adds. */
+const Response = Schema.Struct({
+  code: Schema.String,
+  status: Schema.Number,
+  message: Schema.String,
+  recovery: Schema.optional(Schema.Struct({ action: Schema.String, instructions: Schema.String })),
+  retryable: Schema.Boolean,
+  phase: Schema.optional(Schema.String),
+  reference: Schema.optional(Schema.String),
+});
+const Unavailable = Schema.Struct({
+  unavailableApps: Schema.Array(
+    Schema.Struct({ app: Schema.String, name: Schema.String, reason: Schema.String }),
+  ),
+});
+const decodeResponse = Schema.decodeUnknownSync(Schema.fromJsonString(Response));
+const Failed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Literal(false),
+    error: Schema.Struct({
+      kind: Schema.String,
+      message: Schema.String,
+      response: Schema.optional(Response),
+    }),
+  }),
+  ...Unavailable.fields,
+});
+const CallFailed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Literal(true),
+    value: Schema.Struct({
+      path: Schema.String,
+      ok: Schema.Literal(false),
+      error: Schema.Struct({
+        kind: Schema.String,
+        message: Schema.String,
+        response: Schema.optional(Response),
+      }),
+    }),
+  }),
+});
+
+/** The summary line's end: the phase and the request's trace, which the agent can share. */
+const located = (phase: string, trace: string) => ` Phase: ${phase}. Reference: ${trace}.`;
+
+/** Deploy an app to the organization for the rest of the scenario. */
+const deployer = Effect.gen(function* () {
+  const api = yield* Api,
+    actors = yield* Actors;
+  const prefix = `/api/organizations/${actors.organization.id}/apps`;
+  const deploy = (label: string, files: ReadonlyArray<{ path: string; content: string }>) =>
+    Effect.gen(function* () {
+      const deployed = yield* api.request(actors.owner, "POST", `${prefix}/deploy`, {
+        name: `${label} ${randomUUID().slice(0, 8)}`,
+        files,
+      });
+      expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+      const app = yield* body(App, deployed);
+      yield* Effect.addFinalizer(() =>
+        api.request(actors.owner, "DELETE", `${prefix}/${app.id}`).pipe(Effect.orDie),
+      );
+      return app;
+    });
+  return deploy;
+});
+
+/** An agent's MCP session, with each failure as that agent reads it and its request's trace. */
+const agentSession = Effect.gen(function* () {
+  const evidence = yield* Evidence;
+  const { client } = yield* frameworkSession;
+  /** The trace the client sent with its latest request, which the server continues. */
+  const latestTrace = evidence.requests.pipe(
+    Effect.map((requests) => {
+      const id = requests.at(-1)?.traceId;
+      if (id === undefined) throw new Error("The request trace was not recorded");
+      return id;
+    }),
+  );
+  const tool = (label: string, name: string, args: Record<string, unknown>) =>
+    Effect.gen(function* () {
+      const result = yield* client.use(label, (client, signal) =>
+        client.callTool({ name, arguments: args }, undefined, { signal }),
+      );
+      const trace = yield* latestTrace;
+      yield* evidence.json(`${label.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-")}.json`, {
+        trace,
+        result: result.structuredContent,
+      });
+      return { trace, result: result.structuredContent };
+    });
+  const root = (app: { readonly slug: string }) => `tools[${JSON.stringify(app.slug)}]`;
+  /** Why search could not list an app, as its agent reads it. */
+  const searched = (app: { readonly id: string; readonly slug: string }) =>
+    Effect.gen(function* () {
+      const { trace, result } = yield* tool(`Search ${app.slug}`, "search", {
+        namespace: app.slug,
+        query: "",
+      });
+      const entry = (yield* Schema.decodeUnknownEffect(Unavailable)(result)).unavailableApps.find(
+        (entry) => entry.app === app.id,
+      );
+      if (entry === undefined) throw new Error(`Search listed ${app.slug} as available`);
+      return { trace, response: decodeResponse(entry.reason) };
+    });
+  /** A call into one of the app's tools, as its agent reads it. */
+  const called = (app: { readonly slug: string }, name: string) =>
+    Effect.gen(function* () {
+      const { trace, result } = yield* tool(`Call ${app.slug}`, "call", {
+        calls: { path: `${root(app)}.${name}`, input: {} },
+      });
+      const { error } = (yield* Schema.decodeUnknownEffect(CallFailed)(result)).execution.value;
+      return { trace, error };
+    });
+  /** An execute program that calls one of the app's tools, as its agent reads it. */
+  const executed = (app: { readonly slug: string }, name: string) =>
+    Effect.gen(function* () {
+      const { trace, result } = yield* tool(`Execute ${app.slug}`, "execute", {
+        code: `return await ${root(app)}.${name}({});`,
+      });
+      const { error } = (yield* Schema.decodeUnknownEffect(Failed)(result)).execution;
+      return { trace, error };
+    });
+  return { tool, searched, called, executed };
+});
+
+layer(HostedLive, { excludeTestServices: true })("MCP failure reference", (it) => {
+  it.effect(scenarios.mcpFailureReference.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const evidence = yield* Evidence;
+        const deploy = yield* deployer;
+        const throwing = yield* deploy("Throwing factory", [
+          { path: "index.ts", content: throwingApp },
+          appsManifest,
+        ]);
+        const forging = yield* deploy("Forged runtime limit", [
+          { path: "index.ts", content: forgingApp },
+          appsManifest,
+        ]);
+        const duplicate = yield* deploy("Duplicate tool names", [
+          { path: "index.ts", content: duplicateApp },
+          appsManifest,
+        ]);
+        const provider = yield* deploy("Unavailable service", [
+          { path: "index.ts", content: providerApp },
+          appsManifest,
+        ]);
+        const server = yield* deploy("Failing MCP server", mcpAppFiles(yield* failingMcpServer));
+        const claiming = yield* deploy("Listing claims a call", [
+          { path: "index.ts", content: callClaimingApp },
+          appsManifest,
+        ]);
+
+        const { tool, searched, called, executed } = yield* agentSession;
+
+        // An app whose factory throws: its own error is the cause, in what Executor was doing.
+        const thrownSearch = yield* searched(throwing);
+        const thrownCall = yield* called(throwing, "anything");
+        const thrownExecute = yield* executed(throwing, "anything");
+        // An app whose Worker stops without an answer from its code.
+        const forgedSearch = yield* searched(forging);
+        const forgedExecute = yield* executed(forging, "ping");
+        // An app whose framework refuses its tool list without saying why.
+        const duplicateSearch = yield* searched(duplicate);
+        // A tool whose service failed without naming the phase: Executor was calling it.
+        const unavailableCall = yield* called(provider, "quota");
+        const unavailableExecute = yield* executed(provider, "quota");
+        // App code that names the opposite phase: a call claiming listing, a listing claiming a call.
+        const listingClaimed = yield* called(provider, "listing");
+        const callClaimed = yield* searched(claiming);
+        // An MCP server that fails while Executor lists the app's tools.
+        const serverSearch = yield* searched(server);
+        // The Executor app relays Executor's own 502 for the throwing app's tool listing.
+        const relayed = yield* tool("Execute tools.index through the Executor app", "execute", {
+          code: `return await tools.executor.tools.index({ path: { app: ${JSON.stringify(throwing.id)} } });`,
+        }).pipe(
+          Effect.flatMap(({ trace, result }) =>
+            Schema.decodeUnknownEffect(Failed)(result).pipe(
+              Effect.map(({ execution }) => ({ trace, error: execution.error })),
+            ),
+          ),
+        );
+        // A build whose module throws while it loads, deployed through the Executor app.
+        const buildName = `Throwing module ${randomUUID().slice(0, 8)}`;
+        const built = yield* tool("Deploy a throwing module through the Executor app", "execute", {
+          code: `return await tools.executor.apps.deploy({ body: { name: ${JSON.stringify(buildName)}, files: ${JSON.stringify([{ path: "index.ts", content: throwingModule }, appsManifest])} } });`,
+        }).pipe(
+          Effect.flatMap(({ trace, result }) =>
+            Schema.decodeUnknownEffect(Failed)(result).pipe(
+              Effect.map(({ execution }) => ({ trace, error: execution.error })),
+            ),
+          ),
+        );
+        yield* evidence.json("agent-failures.json", {
+          thrownSearch,
+          thrownCall,
+          thrownExecute,
+          forgedSearch,
+          forgedExecute,
+          duplicateSearch,
+          unavailableCall,
+          unavailableExecute,
+          listingClaimed,
+          callClaimed,
+          serverSearch,
+          relayed,
+          built,
+        });
+
+        // Search, call and execute name the app's own error, the phase and the request's trace.
+        // The phase is what Executor was doing, here listing the app's tools before any call: that
+        // the app's code reports its definition failed does not make it `evaluate`, which only
+        // Executor's own checks set.
+        expect(thrownSearch.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          phase: "discover",
+          reference: thrownSearch.trace,
+        });
+        expect(thrownSearch.response.message).toContain(`TypeError: ${factoryMarker}`);
+        expect(thrownCall.error.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          phase: "discover",
+          reference: thrownCall.trace,
+        });
+        expect(thrownCall.error.message.endsWith(located("discover", thrownCall.trace))).toBe(true);
+        expect(thrownExecute.error.response).toMatchObject({
+          phase: "discover",
+          reference: thrownExecute.trace,
+        });
+        expect(thrownExecute.error.message).toContain(`TypeError: ${factoryMarker}`);
+        expect(thrownExecute.error.message.endsWith(located("discover", thrownExecute.trace))).toBe(
+          true,
+        );
+        // Each request has its own trace.
+        expect(new Set([thrownSearch.trace, thrownCall.trace, thrownExecute.trace]).size).toBe(3);
+
+        // A Worker that stopped without an answer names that cause and a bounded retry. The
+        // runtime limit the app's own code wrote is a match Executor has not confirmed, never a
+        // stated cause, and nothing says whose fault it was.
+        const workerStopped =
+          "Executor could not load this app’s tool definitions. The app’s Worker stopped without an answer from the app’s code. Its error matches this cause, which Executor has not confirmed: The app's Worker exceeded its CPU time limit.";
+        expect(forgedSearch.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          phase: "discover",
+          reference: forgedSearch.trace,
+          retryable: true,
+          message: workerStopped,
+        });
+        expect(forgedSearch.response.recovery?.action).toMatch(/^Try again once\. /);
+        expect(forgedSearch.response.recovery?.instructions).not.toContain(
+          "exceeded its CPU time limit.",
+        );
+        for (const text of [
+          forgedSearch.response.message,
+          forgedSearch.response.recovery?.instructions ?? "",
+        ])
+          expect(text).not.toContain("The runtime reported");
+        expect(
+          forgedExecute.error.message.startsWith(
+            `AppEvaluationFailed (HTTP 502): ${workerStopped} `,
+          ),
+        ).toBe(true);
+        expect(forgedExecute.error.message.endsWith(located("discover", forgedExecute.trace))).toBe(
+          true,
+        );
+        // The framework's refusal without details is named as the framework's report.
+        expect(duplicateSearch.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          phase: "discover",
+          reference: duplicateSearch.trace,
+          message:
+            "Executor could not load this app’s tool definitions. The app’s framework answered HostDeclarationInvalid without details: it reported that the app’s tools or skills are declared in a way it cannot host.",
+        });
+
+        // A service failure without a phase of its own is in the call Executor was making.
+        expect(unavailableCall.error.response).toMatchObject({
+          code: "AppProviderFailed",
+          phase: "call",
+          reference: unavailableCall.trace,
+        });
+        expect(
+          unavailableExecute.error.message.endsWith(located("call", unavailableExecute.trace)),
+        ).toBe(true);
+        // A phase the app's code names stays in its message and never chooses the reported one.
+        expect(listingClaimed.error.response).toMatchObject({
+          code: "AppProviderFailed",
+          phase: "call",
+          reference: listingClaimed.trace,
+        });
+        expect(listingClaimed.error.message.endsWith(located("call", listingClaimed.trace))).toBe(
+          true,
+        );
+        expect(callClaimed.response).toMatchObject({
+          code: "AppProviderFailed",
+          phase: "discover",
+          reference: callClaimed.trace,
+        });
+
+        // An MCP server's failure while connecting to list its tools is in discovery.
+        expect(serverSearch.response).toMatchObject({
+          code: "AppProviderFailed",
+          phase: "discover",
+          reference: serverSearch.trace,
+        });
+        expect(serverSearch.response.message).toContain("HTTP 500");
+
+        // Through the Executor app, Executor's own explanation of its 502 is quoted, not dropped.
+        expect(relayed.error.response).toMatchObject({
+          code: "AppProviderFailed",
+          phase: "call",
+          reference: relayed.trace,
+        });
+        expect(relayed.error.message).toContain(
+          `The service reported AppEvaluationFailed: "Executor could not load this app’s tool definitions. The app threw TypeError: ${factoryMarker}`,
+        );
+
+        // A failed build names its stage and the module's own error, in the call that deployed it.
+        expect(built.error.response).toMatchObject({ phase: "call", reference: built.trace });
+        expect(built.error.message).toContain(`RangeError: ${buildMarker}`);
+        expect(built.error.message.endsWith(located("call", built.trace))).toBe(true);
+      }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
+    ),
+  );
+
+  // Cloud's runtime keeps the kind it matched in the forged rejection, as self-host's now does. A
+  // cause matched from text the app's isolate can write stays unconfirmed on each target.
+  it.effect(scenarios.mcpFailureReferenceMatchedLimit.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const deploy = yield* deployer;
+        const forging = yield* deploy("Forged runtime limit", [
+          { path: "index.ts", content: forgingApp },
+          appsManifest,
+        ]);
+        const { searched, executed } = yield* agentSession;
+        const forgedSearch = yield* searched(forging);
+        const forgedExecute = yield* executed(forging, "ping");
+
+        const unconfirmed =
+          "Executor could not load this app’s tool definitions. The app’s Worker stopped without an answer from the app’s code. Its error matches this cause, which Executor has not confirmed: The app's Worker exceeded its CPU time limit.";
+        expect(forgedSearch.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          status: 502,
+          message: unconfirmed,
+          retryable: true,
+          phase: "discover",
+          reference: forgedSearch.trace,
+        });
+        expect(forgedExecute.error.response).toMatchObject({
+          code: "AppEvaluationFailed",
+          message: unconfirmed,
+          phase: "discover",
+          reference: forgedExecute.trace,
+        });
+        expect(
+          forgedExecute.error.message.startsWith(`AppEvaluationFailed (HTTP 502): ${unconfirmed} `),
+        ).toBe(true);
+        expect(forgedExecute.error.message.endsWith(located("discover", forgedExecute.trace))).toBe(
+          true,
+        );
+        expect(forgedSearch.trace).not.toBe(forgedExecute.trace);
+      }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
+    ),
+  );
+});
diff --git a/e2e/tests/mcp-large-result.spec.ts b/e2e/tests/mcp-large-result.spec.ts
new file mode 100644
index 0000000000..91a0bbbfae
--- /dev/null
+++ b/e2e/tests/mcp-large-result.spec.ts
@@ -0,0 +1,367 @@
+/**
+ * Executor sets no limit on the size of an `execute` or `call` result. A result far over the
+ * 100,000 bytes Executor once cut values at comes back whole, as a success the agent can parse.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Redacted, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { Actors } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { HostedLive, TestLive, withCase, withHostedCase } from "../support/case.ts";
+import { Evidence } from "../support/evidence.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { Target } from "../support/platform.ts";
+import { expectUnknownOutcome } from "../support/write-outcome.ts";
+import { scenarios } from "../test-plan.ts";
+
+const files = [
+  {
+    path: "index.ts",
+    content: `import { defineApp, number, object, query, router } from "apps";
+export default defineApp({}, async () => ({ tools: router({
+  rows: query({ input: object({ count: number() }), description: "List synthetic rows" },
+    async (_ctx, { count }) => Array.from({ length: count }, (_, id) => ({ id, note: "row " + id + " " + "n".repeat(80) }))),
+}) }));`,
+  },
+  appsManifest,
+];
+
+const App = Schema.Struct({ id: Schema.String, slug: Schema.String });
+
+/** The rows `rows({ count })` returns. */
+const rows = (count: number) =>
+  Array.from({ length: count }, (_, id) => ({ id, note: `row ${id} ${"n".repeat(80)}` }));
+
+const Completed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Boolean,
+    value: Schema.optional(Schema.Unknown),
+    logs: Schema.optional(Schema.Array(Schema.String)),
+    truncated: Schema.optional(Schema.Boolean),
+  }),
+});
+/** The text an MCP client reads when it ignores structured content. */
+const Text = Schema.Struct({
+  content: Schema.Tuple([Schema.Struct({ type: Schema.Literal("text"), text: Schema.String })]),
+});
+
+type Connected = Effect.Success<ReturnType<Effect.Success<typeof McpClient>["connect"]>>;
+
+/** Large program values, logs and direct calls reach the agent whole and parse. */
+const checkLargeResults = (client: Connected, slug: string) =>
+  Effect.gen(function* () {
+    const evidence = yield* Evidence;
+    const tool = `tools[${JSON.stringify(slug)}].rows`;
+    const run = (step: string, name: string, args: Record<string, unknown>) =>
+      client
+        .use(step, (client, signal) =>
+          client.callTool({ name, arguments: args }, undefined, { signal, timeout: 55_000 }),
+        )
+        .pipe(
+          Effect.flatMap((result) =>
+            Effect.gen(function* () {
+              const { execution } = yield* Schema.decodeUnknownEffect(Completed)(
+                result.structuredContent,
+              );
+              // The text block is the same result as JSON, whole, so it parses.
+              const { content } = yield* Schema.decodeUnknownEffect(Text)(result);
+              expect(JSON.parse(content[0].text)).toEqual(result.structuredContent);
+              const bytes = Buffer.byteLength(content[0].text);
+              yield* evidence.json(`${step.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-")}.json`, {
+                ok: execution.ok,
+                truncated: execution.truncated ?? false,
+                textBytes: bytes,
+              });
+              return execution;
+            }),
+          ),
+        );
+
+    // A tool's large result beside a value of the program's own, as the reports returned: about
+    // 1.6 MB of JSON, sixteen times the old 100,000-byte limit. It arrives whole, not as a cut
+    // string, and nothing says it was truncated.
+    const listed = rows(15_000);
+    const expected = { listed, count: listed.length };
+    expect(Buffer.byteLength(JSON.stringify(expected))).toBeGreaterThan(1_500_000);
+    const big = yield* run("Return a large tool result", "execute", {
+      code: `const listed = await ${tool}({ count: 15000 });
+return { listed, count: listed.length };`,
+    });
+    expect(big.ok).toBe(true);
+    expect(big.truncated).toBeUndefined();
+    expect(big.value).toEqual(expected);
+
+    // Multi-byte text and long logs come back whole too.
+    const wide = yield* run("Return wide characters", "execute", {
+      code: `return "é".repeat(60000);`,
+    });
+    expect(wide).toMatchObject({ ok: true, value: "é".repeat(60_000) });
+    const noisy = yield* run("Log far more than 100,000 bytes", "execute", {
+      code: `for (let n = 0; n < 3000; n++) console.log("line " + n + " " + "l".repeat(90));
+return { done: true };`,
+    });
+    expect(noisy).toMatchObject({ ok: true, value: { done: true } });
+    expect(noisy.truncated).toBeUndefined();
+    expect(noisy.logs).toHaveLength(3000);
+    expect(noisy.logs?.at(-1)).toBe(`line 2999 ${"l".repeat(90)}`);
+
+    // A direct call returns its large result whole as well.
+    const direct = yield* run("Call a large tool directly", "call", {
+      calls: { path: tool, input: { count: 15000 } },
+    });
+    expect(direct).toMatchObject({ ok: true, value: { ok: true } });
+    expect(direct.value).toEqual({ path: tool, ok: true, value: listed });
+  });
+
+layer(TestLive, { excludeTestServices: true })("MCP large result", (it) => {
+  it.effect(scenarios.mcpLargeResult.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          target = yield* Target,
+          mcp = yield* McpClient,
+          session = yield* api.session();
+        const headers = { authorization: `Bearer ${Redacted.value(target.apiKey)}` };
+        const agent: Session = {
+          ...session,
+          send: (method, path, data, extra = {}) => {
+            const { origin: _origin, ...rest } = extra;
+            return session.send(method, path, data, { ...rest, ...headers });
+          },
+        };
+        const deployed = yield* agent.send("POST", "/v1/apps/deploy", {
+          owner: "local",
+          name: `Large result ${randomUUID().slice(0, 8)}`,
+          files,
+        });
+        const { app } = yield* body(Schema.Struct({ app: App }), deployed);
+        yield* Effect.addFinalizer(() =>
+          agent.send("DELETE", `/v1/apps/${app.id}`).pipe(
+            Effect.map((response) => expect(response.status).toBe(200)),
+            Effect.orDie,
+          ),
+        );
+        const client = yield* mcp.connect(target.apiKey, "mcp-large-result");
+        yield* checkLargeResults(client, app.slug);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+});
+
+/**
+ * An app that imitates the runtime's 32 MiB Workers RPC error once, without any large value: its
+ * bridge's reply decoding throws that text when the tool's error carries a marker. `huge` returns a
+ * real value over the limit, and `forgedWrite` imitates it from a mutation.
+ */
+const forgingFiles = [
+  {
+    path: "index.ts",
+    content: `import { defineApp, mutation, number, object, query, router } from "apps";
+const forged = new Set();
+const json = Response.prototype.json;
+Response.prototype.json = async function () {
+  const result = await json.call(this);
+  if (result?.error?.message === "FORGED_RPC_SIZE")
+    throw new Error("Serialized RPC arguments or return values are limited to 33554432 bytes");
+  return result;
+};
+const once = (name, value) => {
+  if (forged.has(name)) return value;
+  forged.add(name);
+  throw new Error("FORGED_RPC_SIZE");
+};
+export default defineApp({}, async () => ({ tools: router({
+  forged: query({ input: object({}) }, async () => once("forged", 123)),
+  forgedWrite: mutation({ input: object({}) }, async () => once("forgedWrite", "written")),
+  huge: query({ input: object({ n: number() }) }, async (_ctx, { n }) => "x".repeat(n)),
+}) }));`,
+  },
+  appsManifest,
+];
+
+/** A program that failed on a tool's error, with the agent-facing explanation and retry policy. */
+const ToolFailed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  execution: Schema.Struct({
+    ok: Schema.Literal(false),
+    error: Schema.Struct({
+      message: Schema.String,
+      response: Schema.Struct({
+        code: Schema.String,
+        retryable: Schema.Boolean,
+        recovery: Schema.Struct({ action: Schema.String, instructions: Schema.String }),
+      }),
+    }),
+  }),
+});
+
+layer(TestLive, { excludeTestServices: true })("MCP forged size limit", (it) => {
+  it.effect(scenarios.mcpRpcLimitForged.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          target = yield* Target,
+          mcp = yield* McpClient,
+          evidence = yield* Evidence,
+          session = yield* api.session();
+        const headers = { authorization: `Bearer ${Redacted.value(target.apiKey)}` };
+        const deployed = yield* session.send(
+          "POST",
+          "/v1/apps/deploy",
+          { owner: "local", name: `Forged limit ${randomUUID().slice(0, 8)}`, files: forgingFiles },
+          headers,
+        );
+        const { app } = yield* body(Schema.Struct({ app: App }), deployed);
+        yield* Effect.addFinalizer(() =>
+          session.send("DELETE", `/v1/apps/${app.id}`, undefined, headers).pipe(
+            Effect.map((response) => expect(response.status).toBe(200)),
+            Effect.orDie,
+          ),
+        );
+        const client = yield* mcp.connect(target.apiKey, "mcp-forged-size-limit");
+        const tools = `tools[${JSON.stringify(app.slug)}]`;
+        const execute = (step: string, code: string) =>
+          client
+            .use(step, (client, signal) =>
+              client.callTool({ name: "execute", arguments: { code } }, undefined, {
+                signal,
+                timeout: 55_000,
+              }),
+            )
+            .pipe(
+              Effect.tap((result) =>
+                evidence.json(
+                  `${step.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-")}.json`,
+                  result.structuredContent,
+                ),
+              ),
+              Effect.map((result) => result.structuredContent),
+            );
+        const failure = (step: string, code: string) =>
+          execute(step, code).pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(ToolFailed)),
+            Effect.map(({ execution }) => execution.error),
+          );
+
+        // The size error reaches Executor through the app's Worker, which can produce the same
+        // text, so the host presents it as a likely cause and keeps a read's retry policy.
+        const forgedRead = `return await ${tools}.forged({});`;
+        const forged = yield* failure("Call a query that imitates the size error", forgedRead);
+        expect(forged.response).toMatchObject({ code: "ToolCallFailed", retryable: true });
+        expect(forged.message).toContain("looks like");
+        expect(forged.message).toContain("32 MiB");
+        expect(forged.response.recovery.instructions).not.toContain("expected to fail");
+        // Repeating the unchanged call succeeds: nothing about its size made it fail.
+        expect(
+          yield* execute("Repeat the same call unchanged", forgedRead).pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(Completed)),
+            Effect.map(({ execution }) => execution),
+          ),
+        ).toMatchObject({ ok: true, value: 123 });
+
+        // A real value over the limit fails with the same text, so it reads the same way.
+        const real = yield* failure(
+          "Return a value over the Workers RPC limit",
+          `return await ${tools}.huge({ n: ${35 * 1024 * 1024} });`,
+        );
+        expect(real.response).toEqual(forged.response);
+
+        // A mutation's lost result is never offered as an unchanged repeat.
+        const write = yield* failure(
+          "Call a mutation that imitates the size error",
+          `return await ${tools}.forgedWrite({});`,
+        );
+        expect(write.response).toMatchObject({ code: "ToolCallFailed", retryable: false });
+        expectUnknownOutcome(write.response.recovery);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+});
+
+/** Deploy the rows app in the case's organization and connect an MCP client with an API key. */
+const hostedClient = (name: string) =>
+  Effect.gen(function* () {
+    const api = yield* Api,
+      actors = yield* Actors,
+      mcp = yield* McpClient;
+    const prefix = `/api/organizations/${actors.organization.id}`;
+    const key = yield* body(
+      Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) }),
+      yield* api.request(actors.owner, "POST", "/api/auth/api-key/create", { name }),
+    );
+    const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+      name: `${name} ${randomUUID().slice(0, 8)}`,
+      files,
+    });
+    expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+    const app = yield* body(App, deployed);
+    yield* Effect.addFinalizer(() =>
+      Effect.gen(function* () {
+        yield* api.request(actors.owner, "POST", "/api/auth/api-key/delete", { keyId: key.id });
+        yield* api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`);
+      }).pipe(Effect.orDie),
+    );
+    const client = yield* mcp.connect(key.key, name.toLowerCase().replaceAll(" ", "-"), {
+      organization: actors.organization.id,
+    });
+    return { client, slug: app.slug };
+  });
+
+layer(HostedLive, { excludeTestServices: true })("Hosted MCP large result", (it) => {
+  it.effect(scenarios.mcpLargeResultHosted.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const { client, slug } = yield* hostedClient("Large result");
+        yield* checkLargeResults(client, slug);
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+  it.effect(scenarios.mcpLargeResultMemoryLimit.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const evidence = yield* Evidence;
+        const { client } = yield* hostedClient("Memory limit");
+        // A 40 MiB value, held several times over while the session object sends it, passes the
+        // object's 128 MB memory limit; 30 MiB comes back whole. The client is told so at once
+        // instead of waiting for an answer that will not come.
+        const outcome = yield* client.use("Return 40 MiB from a program", (client, signal) =>
+          client
+            .callTool(
+              { name: "execute", arguments: { code: `return "x".repeat(${40 * 1024 * 1024});` } },
+              undefined,
+              { signal, timeout: 55_000 },
+            )
+            .then(
+              (result) => ({ answered: true as const, isError: result.isError === true }),
+              (error: unknown) => ({
+                answered: false as const,
+                message: error instanceof Error ? error.message : String(error),
+              }),
+            ),
+        );
+        yield* evidence.json("memory-limit.json", outcome);
+        expect(outcome).toMatchObject({
+          answered: false,
+          message: expect.stringContaining("exceeded Cloudflare's 128 MB memory limit"),
+        });
+        expect(outcome.answered === false && outcome.message).toContain("Return less");
+        // The session keeps working once the object restarts.
+        const after = yield* client.use("Run a small program afterwards", (client, signal) =>
+          client.callTool({ name: "execute", arguments: { code: "return 1;" } }, undefined, {
+            signal,
+            timeout: 55_000,
+          }),
+        );
+        expect(
+          (yield* Schema.decodeUnknownEffect(Completed)(after.structuredContent)).execution,
+        ).toMatchObject({ ok: true, value: 1 });
+      }).pipe(Effect.provide(McpClient.layer)),
+    ),
+  );
+});
diff --git a/e2e/tests/mcp-organization-spans.spec.ts b/e2e/tests/mcp-organization-spans.spec.ts
new file mode 100644
index 0000000000..0f83c8e9cd
--- /dev/null
+++ b/e2e/tests/mcp-organization-spans.spec.ts
@@ -0,0 +1,766 @@
+/**
+ * Hosted MCP spans name the organization they run for and the caller by their opaque IDs, so one
+ * organization's failures can be told apart from an outage and the users they reach counted.
+ * Every MCP operation span records both from its start: the tools (`mcp.search`, `mcp.describe`,
+ * `mcp.call`, `mcp.execute`, `mcp.resume`, `mcp.skills`), the event methods (`mcp.events.*`), the
+ * catalog reads under them and the tool calls they make (`mcp.tool.call`, `mcp.tool.resume`),
+ * failed ones included. A tool call's bearer recheck names them from its start too, so a recheck
+ * refused before its statement answers still does.
+ *
+ * A bearer check names only the caller's own organization, with the caller (the grant's or the
+ * key's user), once it knows the organization is theirs. A grant's organization is known when its
+ * statement answers, so a refusal after that, such as a grant used at an organization URL that
+ * names none, keeps both. An unpinned key's is known only once its membership holds, so a key
+ * refused for an organization its user does not belong to names neither, on any span; a pinned key
+ * refused for another organization names its own. A refused request never names the organization
+ * it asked for, so it cannot count against that organization's failures or among its users.
+ *
+ * On Cloud the gateway's forward of a request it authenticated names both even when the session
+ * object never answers; a request routed by its session id learns only the organization, from the
+ * object's answer, so one the object never answers names neither: the gateway never guesses.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Fiber, Layer, Redacted, Schedule, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { randomBytes, randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { Browser } from "../support/browser.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App, Organization, Resource, type SpanQuery } from "../support/contracts.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import {
+  EventList,
+  Granted,
+  RpcError,
+  RpcResult,
+  eventFixtures,
+  secrets,
+} from "../support/events.ts";
+import { holdTools, untilHeld } from "../support/held-call.ts";
+import { McpClient } from "../support/mcp-client.ts";
+import { McpOAuth } from "../support/mcp-oauth.ts";
+import { Target } from "../support/platform.ts";
+
+type Span = (typeof SpanQuery.Type)["data"][number]["span"];
+
+const Key = Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) });
+const organizationId = "executor.organization.id";
+const userId = "executor.user.id";
+
+const Pending = Schema.Struct({
+  status: Schema.Literal("approval-required"),
+  requestId: Schema.String,
+});
+const SessionIdentity = Schema.Struct({
+  user: Schema.Struct({ id: Schema.String, email: Schema.String }),
+});
+
+const appSource = `import { defineApp, query, mutation, object, string, boolean, router } from "apps";
+import { always } from "apps/operations/approval";
+export default defineApp({}, async () => ({
+  tools: router({
+    echo: query({ description: "Echo text", input: object({ text: string() }) }, async (_ctx, { text }) => ({ text })),
+    approved: mutation({ description: "Echo text once approved", input: object({ text: string() }), approval: always() }, async (_ctx, { text }) => ({ text })),
+    ${holdTools}
+  }),
+}));`;
+
+/** The operation spans the tools' calls record; each must name the organization and the caller. */
+const operations = [
+  "mcp.search",
+  "mcp.describe",
+  "mcp.call",
+  "mcp.execute",
+  "mcp.resume",
+  "mcp.skills",
+  "mcp.tool.call",
+  "mcp.tool.resume",
+  "mcp.catalog",
+  "mcp.discovery.apps",
+  "mcp.discovery.accounts",
+  "mcp.discovery.tools",
+];
+/** Operation spans a path records only sometimes; any that is delivered must name it too. */
+const occasional = /^mcp\.(?:discovery\.|search\.discovery$|describe\.discovery$)/u;
+
+/** The stateful revision, whose sessions carry an `Mcp-Session-Id`. */
+const stateful = "2025-06-18";
+/** The stateless revision names itself in every request and has no session. */
+const stateless = "2026-07-28";
+const statelessMeta = {
+  "io.modelcontextprotocol/protocolVersion": stateless,
+  "io.modelcontextprotocol/clientCapabilities": {},
+};
+const initialize = {
+  id: 1,
+  method: "initialize",
+  params: {
+    protocolVersion: stateful,
+    capabilities: {},
+    clientInfo: { name: "organization-spans", version: "1" },
+  },
+};
+
+const named = (spans: ReadonlyArray<Span>, name: string) =>
+  spans.filter((span) => span.operationName === name);
+const exception = (span: Span) =>
+  span.events.find((event) => event.name === "exception")?.attributes["exception.type"];
+
+/** Shared by both scenarios: keys, one raw MCP POST under its own trace, and a trace's spans. */
+const helpers = Effect.gen(function* () {
+  const api = yield* Api,
+    actors = yield* Actors,
+    evidence = yield* Evidence,
+    telemetry = yield* Telemetry,
+    target = yield* Target,
+    http = yield* HttpClient.HttpClient;
+  /** An API key of `actor` (the owner by default), pinned to `pinned` when it names one. */
+  const createKey = (
+    name: string,
+    options: { readonly actor?: Session; readonly pinned?: string } = {},
+  ) =>
+    Effect.gen(function* () {
+      const actor = options.actor ?? actors.owner;
+      const created = yield* api.request(actor, "POST", "/api/auth/api-key/create", {
+        name,
+        ...(options.pinned === undefined ? {} : { metadata: { organization: options.pinned } }),
+      });
+      expect(created.status, JSON.stringify(created.body)).toBe(200);
+      const key = yield* body(Key, created);
+      yield* Effect.addFinalizer(() =>
+        api
+          .request(actor, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+          .pipe(Effect.ignore),
+      );
+      return key;
+    });
+  const post = (input: {
+    readonly credential: Redacted.Redacted<string>;
+    readonly path?: string;
+    readonly session?: string | undefined;
+    readonly protocol?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly message: Readonly<Record<string, unknown>>;
+  }) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const traceId = randomBytes(16).toString("hex");
+        const request = HttpClientRequest.post(
+          `${target.metadata.origin}${input.path ?? "/mcp"}`,
+        ).pipe(
+          HttpClientRequest.setHeaders({
+            accept: "application/json, text/event-stream",
+            authorization: `Bearer ${Redacted.value(input.credential)}`,
+            "x-executor-organization": actors.organization.id,
+            traceparent: `00-${traceId}-${randomBytes(8).toString("hex")}-01`,
+            ...(input.session === undefined ? {} : { "mcp-session-id": input.session }),
+            ...(input.protocol === undefined ? {} : { "mcp-protocol-version": input.protocol }),
+            ...input.headers,
+          }),
+        );
+        const response = yield* http.execute(
+          yield* HttpClientRequest.bodyJson(request, { jsonrpc: "2.0", ...input.message }),
+        );
+        const text = yield* response.text;
+        return { traceId, status: response.status, headers: response.headers, text };
+      }),
+    ).pipe(Effect.provideService(HttpClient.TracerPropagationEnabled, false));
+  /** A trace's delivered spans once `ready` holds for them. */
+  const spans = (traceId: string, ready: (spans: ReadonlyArray<Span>) => boolean) =>
+    telemetry.query(traceId).pipe(
+      Effect.map((result) => result.data.map(({ span }) => span)),
+      Effect.flatMap((all) =>
+        ready(all)
+          ? Effect.succeed(all)
+          : Effect.fail(new Error("The request's spans have not reached the collector")),
+      ),
+      Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
+      Effect.tap((all) => evidence.json(`trace-${traceId}.json`, all)),
+    );
+  /** The Better Auth user ID and email of `actor`'s session. */
+  const identity = (actor: Session) =>
+    api.request(actor, "GET", "/api/auth/get-session").pipe(
+      Effect.flatMap((response) => body(SessionIdentity, response)),
+      Effect.map(({ user }) => user),
+    );
+  return { createKey, identity, post, spans };
+});
+
+layer(HostedLive, { excludeTestServices: true })("MCP organization spans", (it) => {
+  it.effect(
+    scenarios.mcpOrganizationSpans.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors,
+            browser = yield* Browser,
+            evidence = yield* Evidence,
+            telemetry = yield* Telemetry,
+            oauth = yield* McpOAuth,
+            mcp = yield* McpClient,
+            target = yield* Target;
+          const { createKey, identity, post, spans } = yield* helpers;
+          const organization = actors.organization.id;
+          // Every key and grant below is the owner's unless it names another actor.
+          const owner = (yield* identity(actors.owner)).id;
+          const prefix = `/api/organizations/${organization}`;
+          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+            name: `Organization spans ${randomUUID().slice(0, 8)}`,
+            files: [{ path: "index.ts", content: appSource }, appsManifest],
+          });
+          expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+          const app = yield* body(App, deployed),
+            path = `${prefix}/apps/${app.id}`;
+          yield* Effect.addFinalizer(() =>
+            api.request(actors.owner, "DELETE", path).pipe(Effect.ignore),
+          );
+          const tool = (name: string) => `tools[${JSON.stringify(app.slug)}].${name}`;
+          /** The delivered spans of every MCP request since `before`, once `ready` holds for them. */
+          const deliveredSince = (before: number, ready: (spans: ReadonlyArray<Span>) => boolean) =>
+            evidence.requests.pipe(
+              Effect.map((requests) =>
+                requests
+                  .slice(before)
+                  .filter((request) => request.path === "/mcp")
+                  .map((request) => request.traceId),
+              ),
+              Effect.flatMap((traces) => Effect.forEach(traces, (trace) => telemetry.query(trace))),
+              Effect.map((results) => results.flatMap(({ data }) => data.map(({ span }) => span))),
+              Effect.flatMap((all) =>
+                ready(all)
+                  ? Effect.succeed(all)
+                  : Effect.fail(new Error("The requests' spans have not reached the collector")),
+              ),
+              Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
+            );
+
+          const key = yield* createKey("Organization spans");
+          const client = yield* mcp.connect(key.key, "organization-spans", { organization });
+
+          yield* evidence.step(
+            "Each MCP operation span and the catalog reads under it name the organization and the caller",
+            Effect.gen(function* () {
+              const before = (yield* evidence.requests).length;
+              const callTool = (label: string, name: string, args: Record<string, unknown>) =>
+                client.use(label, (client, signal) =>
+                  client.callTool({ name, arguments: args }, undefined, { signal }),
+                );
+              yield* callTool("Search", "search", { query: "echo" });
+              yield* callTool("Describe", "describe", { paths: [tool("echo")] });
+              const called = yield* callTool("Call", "call", {
+                calls: { path: tool("echo"), input: { text: "called" } },
+              });
+              expect(JSON.stringify(called.structuredContent)).toContain("called");
+              const executed = yield* callTool("Execute", "execute", {
+                code: `return (await ${tool("echo")}({ text: "executed" })).text;`,
+              });
+              expect(JSON.stringify(executed.structuredContent)).toContain("executed");
+              yield* callTool("Execute a program that fails", "execute", {
+                code: `throw new Error("A synthetic program failure");`,
+              });
+              yield* callTool("List skills", "skills", {});
+              // No app has this slug, so the read fails before it rechecks the grant, which would
+              // name the organization itself.
+              const missingSkill = yield* callTool("Read a skill of a missing app", "skills", {
+                app: `missing-${randomUUID().slice(0, 8)}`,
+                name: "missing-skill",
+              });
+              expect(missingSkill.isError, "The skill read fails").toBe(true);
+              // The approved call runs when the answer arrives, as `mcp.tool.resume`.
+              const paused = yield* callTool("Execute a call that needs approval", "execute", {
+                code: `return (await ${tool("approved")}({ text: "approved" })).text;`,
+              });
+              const { requestId } = yield* Schema.decodeUnknownEffect(Pending)(
+                paused.structuredContent,
+              );
+              const resumed = yield* callTool("Approve the call and resume", "resume", {
+                requestId,
+                response: { action: "accept" },
+              });
+              expect(JSON.stringify(resumed.structuredContent)).toContain("approved");
+              const delivered = yield* deliveredSince(
+                before,
+                (all) =>
+                  operations.every((name) => named(all, name).length > 0) &&
+                  named(all, "mcp.execute").length === 3 &&
+                  named(all, "mcp.skills").length === 2,
+              );
+              const recorded = delivered.filter(
+                (span) =>
+                  operations.includes(span.operationName) || occasional.test(span.operationName),
+              );
+              yield* evidence.json(
+                "operation-spans.json",
+                recorded.map((span) => ({ name: span.operationName, tags: span.tags })),
+              );
+              expect(
+                recorded
+                  .filter(
+                    (span) =>
+                      span.tags[organizationId] !== organization || span.tags[userId] !== owner,
+                  )
+                  .map((span) => [
+                    span.operationName,
+                    span.tags[organizationId],
+                    span.tags[userId],
+                  ]),
+                "Every MCP operation span names the organization and the key's user",
+              ).toEqual([]);
+              expect(
+                named(delivered, "mcp.execute")
+                  .map((span) => span.tags["executor.outcome"])
+                  .sort(),
+                "The failed program's span is among them",
+              ).toEqual(["completed", "failed", "pending"]);
+              expect(
+                named(delivered, "mcp.skills")
+                  .map((span) => [span.tags["executor.skill.operation"], span.status])
+                  .sort(),
+                "So is the failed skill read's",
+              ).toEqual([
+                ["list", "ok"],
+                ["read", "error"],
+              ]);
+              expect(
+                named(delivered, "mcp.tool.resume").map((span) => span.tags["executor.tool.name"]),
+                "The approved call ran as a resume",
+              ).toEqual(["approved"]);
+            }),
+          );
+
+          yield* evidence.step(
+            "Each event method's span names the organization and the caller, a refused subscription included",
+            Effect.gen(function* () {
+              const { callbackUrl, name } = yield* eventFixtures;
+              // Events are a stateless-revision extension, sent as a client such as ChatGPT sends them.
+              const rpc = (method: string, params: Readonly<Record<string, unknown>>) =>
+                post({
+                  credential: key.key,
+                  protocol: stateless,
+                  headers: { "mcp-method": method },
+                  message: { id: 1, method, params: { ...params, _meta: statelessMeta } },
+                });
+              const answered = <A>(schema: Schema.Decoder<A>, text: string) =>
+                Schema.decodeUnknownEffect(Schema.fromJsonString(RpcResult))(text).pipe(
+                  Effect.flatMap(({ result }) => Schema.decodeUnknownEffect(schema)(result)),
+                );
+              const delivery = { mode: "webhook", url: callbackUrl };
+              const filters = { repo: "acme/widgets" };
+              const listed = yield* rpc("events/list", {});
+              expect(
+                (yield* answered(EventList, listed.text)).events.map((event) => event.name),
+              ).toContain(name);
+              const subscribed = yield* rpc("events/subscribe", {
+                name,
+                arguments: filters,
+                delivery: { ...delivery, secret: secrets[0] },
+                ttlMs: 60 * 60_000,
+              });
+              yield* answered(Granted, subscribed.text);
+              // No app has this slug, so the subscription is refused before it rechecks the grant,
+              // which would name the organization itself.
+              const refused = yield* rpc("events/subscribe", {
+                name: `missing-${randomUUID().slice(0, 8)}.issue.opened`,
+                arguments: filters,
+                delivery: { ...delivery, secret: secrets[0] },
+              });
+              expect(
+                (yield* Schema.decodeUnknownEffect(Schema.fromJsonString(RpcError))(refused.text))
+                  .error.code,
+                "No app has such an event",
+              ).toBe(-32011);
+              const unsubscribed = yield* rpc("events/unsubscribe", {
+                name,
+                arguments: filters,
+                delivery,
+              });
+              yield* answered(Schema.Struct({}), unsubscribed.text);
+              const recorded = yield* Effect.forEach(
+                [listed, subscribed, refused, unsubscribed],
+                ({ traceId }) =>
+                  spans(traceId, (all) =>
+                    all.some((span) => span.operationName.startsWith("mcp.events.")),
+                  ).pipe(
+                    Effect.map((all) =>
+                      all
+                        .filter((span) => span.operationName.startsWith("mcp.events."))
+                        .map((span) => [
+                          span.operationName,
+                          span.status,
+                          span.tags[organizationId],
+                          span.tags[userId],
+                        ]),
+                    ),
+                  ),
+              );
+              expect(recorded, "Each method's span names the organization and the caller").toEqual([
+                [["mcp.events.list", "ok", organization, owner]],
+                [["mcp.events.subscribe", "ok", organization, owner]],
+                [["mcp.events.subscribe", "error", organization, owner]],
+                [["mcp.events.unsubscribe", "ok", organization, owner]],
+              ]);
+            }),
+          );
+
+          yield* evidence.step(
+            "A tool call's recheck refused before its statement answers names the organization and the caller",
+            Effect.gen(function* () {
+              // Its own key, revoked while its program is held between two calls: the next call's
+              // recheck finds no key, so it fails before it reads any organization from a row.
+              const held = yield* createKey("Organization spans, revoked while held");
+              const heldClient = yield* mcp.connect(held.key, "organization-spans-held", {
+                organization,
+              });
+              const before = (yield* evidence.requests).length;
+              const run = yield* heldClient
+                .use("Execute a program held between two calls", (client, signal) =>
+                  client.callTool(
+                    {
+                      name: "execute",
+                      arguments: {
+                        code: `await ${tool("enter")}({});
+await ${tool("hold")}({});
+try { return await ${tool("echo")}({ text: "after" }); } catch { return "refused"; }`,
+                      },
+                    },
+                    undefined,
+                    { signal },
+                  ),
+                )
+                .pipe(Effect.forkChild);
+              const call = (name: string, kind: "query" | "mutation") =>
+                api
+                  .request(actors.owner, "POST", `${path}/tools/call`, {
+                    tool: name,
+                    kind,
+                    input: {},
+                  })
+                  .pipe(
+                    Effect.tap((response) =>
+                      Effect.sync(() =>
+                        expect(response.status, JSON.stringify(response.body)).toBe(200),
+                      ),
+                    ),
+                  );
+              yield* untilHeld(
+                call("entered", "query").pipe(
+                  Effect.flatMap((response) => body(Schema.Boolean, response)),
+                ),
+              );
+              const revoked = yield* api.request(actors.owner, "POST", "/api/auth/api-key/delete", {
+                keyId: held.id,
+              });
+              expect(revoked.status).toBe(200);
+              yield* call("release", "mutation");
+              const result = yield* Fiber.join(run);
+              expect(JSON.stringify(result.structuredContent)).toContain("refused");
+              const delivered = yield* deliveredSince(
+                before,
+                (all) =>
+                  named(all, "auth.authenticate").some((span) => span.status === "error") &&
+                  named(all, "mcp.tool.call").length === 3,
+              );
+              const checks = named(delivered, "auth.authenticate");
+              yield* evidence.json(
+                "held-checks.json",
+                checks.map((span) => ({ status: span.status, tags: span.tags })),
+              );
+              expect(
+                named(delivered, "mcp.tool.call")
+                  .map((span) => [
+                    span.tags["executor.tool.name"],
+                    span.status,
+                    span.tags[organizationId],
+                    span.tags[userId],
+                  ])
+                  .sort(),
+                "Each of the program's tool calls names the organization and the caller, the refused one included",
+              ).toEqual([
+                ["echo", "error", organization, owner],
+                ["enter", "ok", organization, owner],
+                ["hold", "ok", organization, owner],
+              ]);
+              expect(
+                checks
+                  .filter((span) => span.status === "error")
+                  .map((span) => [exception(span), span.tags[organizationId], span.tags[userId]]),
+                "The refused recheck names the organization and the user it was checking",
+              ).toEqual([["McpUnauthorized", organization, owner]]);
+              expect(
+                checks.map((span) => [span.tags[organizationId], span.tags[userId]]),
+                "So do the request's own check and the rechecks that passed",
+              ).toEqual(checks.map(() => [organization, owner]));
+            }),
+          );
+
+          yield* browser.login(actors.owner);
+          const grant = yield* evidence.step(
+            "Authorize an MCP grant in the browser",
+            oauth.authorize,
+          );
+          yield* evidence.step(
+            "A bearer check refused after it resolves the organization names it and the grant's user",
+            Effect.gen(function* () {
+              // The grant resolves its organization; the URL then names no organization at all.
+              const refused = yield* post({
+                credential: Redacted.make(Redacted.value(grant.tokens).access_token),
+                path: `/org/missing-${randomUUID().slice(0, 8)}/mcp`,
+                message: initialize,
+              });
+              expect(refused.status).toBe(403);
+              const checks = named(
+                yield* spans(refused.traceId, (all) => named(all, "auth.authenticate").length > 0),
+                "auth.authenticate",
+              );
+              expect(
+                checks.map((span) => [
+                  span.status,
+                  exception(span),
+                  span.tags[organizationId],
+                  span.tags[userId],
+                ]),
+                "The refused check names the grant's organization and user by their IDs",
+              ).toEqual([["error", "McpForbidden", organization, owner]]);
+            }),
+          );
+
+          yield* evidence.step(
+            "A key refused for an organization its user does not belong to never names that organization or its user",
+            Effect.gen(function* () {
+              /**
+               * The bearer check of a request that names `reference`, which refuses it, and every
+               * span of that request that names an organization or a user.
+               */
+              const refusedCheck = (credential: Redacted.Redacted<string>, reference: string) =>
+                Effect.gen(function* () {
+                  const refused = yield* post({
+                    credential,
+                    headers: { "x-executor-organization": reference },
+                    message: initialize,
+                  });
+                  expect(refused.status).toBe(403);
+                  const all = yield* spans(
+                    refused.traceId,
+                    (all) => named(all, "auth.authenticate").length > 0,
+                  );
+                  return {
+                    checks: named(all, "auth.authenticate").map((span) => [
+                      span.status,
+                      exception(span),
+                      span.tags[organizationId],
+                      span.tags[userId],
+                    ]),
+                    naming: all
+                      .filter(
+                        (span) =>
+                          span.tags[organizationId] !== undefined ||
+                          span.tags[userId] !== undefined,
+                      )
+                      .map((span) => span.operationName),
+                  };
+                });
+              const member = yield* identity(actors.member);
+              const memberKey = yield* createKey("Organization spans, member", {
+                actor: actors.member,
+              });
+              if (target.metadata.target === "cloud") {
+                // Only Cloud lets a user hold several organizations, so only there can a key name
+                // one its user never joined, or a key pinned to one name another.
+                const created = yield* api.request(
+                  actors.owner,
+                  "POST",
+                  "/api/auth/organization/create",
+                  {
+                    name: "Organization spans, another",
+                    slug: `organization-spans-${randomUUID().slice(0, 8)}`,
+                    keepCurrentActiveOrganization: true,
+                  },
+                );
+                expect(created.status, JSON.stringify(created.body)).toBe(200);
+                const other = yield* body(Organization, created);
+                yield* Effect.addFinalizer(() =>
+                  api
+                    .request(actors.owner, "DELETE", `/api/organizations/${other.id}`)
+                    .pipe(Effect.ignore),
+                );
+                expect(
+                  yield* refusedCheck(memberKey.key, other.slug),
+                  "An unpinned key names no organization its user never joined, nor its user",
+                ).toEqual({
+                  checks: [["error", "McpForbidden", undefined, undefined]],
+                  naming: [],
+                });
+                const pinned = yield* createKey("Organization spans, pinned", {
+                  pinned: organization,
+                });
+                expect(
+                  yield* refusedCheck(pinned.key, other.id),
+                  "A pinned key refused for another organization names only its own, with its user",
+                ).toEqual({
+                  checks: [["error", "McpForbidden", organization, owner]],
+                  naming: ["auth.authenticate"],
+                });
+              }
+              // On both products the member leaves the organization. Its unpinned key outlives
+              // the membership, and names the organization it left by its slug.
+              const rejoin = Effect.gen(function* () {
+                const invited = yield* api.request(
+                  actors.owner,
+                  "POST",
+                  "/api/auth/organization/invite-member",
+                  {
+                    organizationId: organization,
+                    email: member.email,
+                    role: "member",
+                    resend: true,
+                  },
+                );
+                expect(invited.status, JSON.stringify(invited.body)).toBe(200);
+                const accepted = yield* api.request(
+                  actors.member,
+                  "POST",
+                  "/api/auth/organization/accept-invitation",
+                  { invitationId: (yield* body(Resource, invited)).id },
+                );
+                expect(accepted.status, JSON.stringify(accepted.body)).toBe(200);
+              });
+              yield* Effect.acquireUseRelease(
+                api
+                  .request(actors.owner, "POST", "/api/auth/organization/remove-member", {
+                    organizationId: organization,
+                    memberIdOrEmail: member.email,
+                  })
+                  .pipe(
+                    Effect.tap((response) =>
+                      Effect.sync(() =>
+                        expect(response.status, JSON.stringify(response.body)).toBe(200),
+                      ),
+                    ),
+                  ),
+                () =>
+                  Effect.gen(function* () {
+                    expect(
+                      yield* refusedCheck(memberKey.key, actors.organization.slug),
+                      "An unpinned key names no organization its user left, nor its user",
+                    ).toEqual({
+                      checks: [["error", "McpForbidden", undefined, undefined]],
+                      naming: [],
+                    });
+                  }),
+                () => rejoin.pipe(Effect.orDie),
+              );
+            }),
+          );
+        }).pipe(Effect.provide(Layer.mergeAll(McpOAuth.layer, McpClient.layer))),
+      ),
+    { timeout: 180_000 },
+  );
+
+  it.effect(
+    scenarios.cloudMcpForwardOrganization.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const actors = yield* Actors,
+            evidence = yield* Evidence;
+          const { createKey, identity, post, spans } = yield* helpers;
+          const organization = actors.organization.id;
+          const owner = (yield* identity(actors.owner)).id;
+          const key = yield* createKey("Forward organization");
+          // The session object fails the request before its handler runs, so its answer is an
+          // empty 500 without the organization the object would have named.
+          const lost = { "x-executor-test-fault": "request-lost" };
+          const forwarded = (traceId: string) =>
+            spans(traceId, (all) => named(all, "mcp.session.forward").length > 0).pipe(
+              Effect.map((all) =>
+                named(all, "mcp.session.forward").map((span) => [
+                  span.tags["executor.mcp.route"],
+                  span.tags[organizationId],
+                  span.tags[userId],
+                ]),
+              ),
+            );
+
+          yield* evidence.step(
+            "The forward of a request the gateway authenticated names its organization and user though the object never answers",
+            Effect.gen(function* () {
+              const answer = yield* post({
+                credential: key.key,
+                protocol: stateless,
+                headers: { ...lost, "mcp-method": "tools/list" },
+                message: { id: 1, method: "tools/list", params: { _meta: statelessMeta } },
+              });
+              expect(answer.status).toBe(500);
+              expect(yield* forwarded(answer.traceId)).toEqual([
+                ["authenticated", organization, owner],
+              ]);
+            }),
+          );
+
+          const opened = yield* post({ credential: key.key, message: initialize });
+          expect(opened.status).toBe(200);
+          const session = opened.headers["mcp-session-id"];
+          expect(session, "The object issued a session").toBeDefined();
+
+          yield* evidence.step(
+            "The forward of a request routed by its session id names the organization the object answers with; the object's own span names the user",
+            Effect.gen(function* () {
+              const answer = yield* post({
+                credential: key.key,
+                session,
+                protocol: stateful,
+                message: { id: 2, method: "tools/list", params: {} },
+              });
+              expect(answer.status).toBe(200);
+              const all = yield* spans(
+                answer.traceId,
+                (all) =>
+                  named(all, "mcp.session.forward").length > 0 &&
+                  named(all, "mcp.session.request").length > 0,
+              );
+              expect(
+                named(all, "mcp.session.forward").map((span) => [
+                  span.tags["executor.mcp.route"],
+                  span.tags[organizationId],
+                  span.tags[userId],
+                ]),
+                "The gateway names the organization the object authenticated, and no user",
+              ).toEqual([["session", organization, undefined]]);
+              expect(
+                named(all, "mcp.session.request").map((span) => [
+                  span.tags[organizationId],
+                  span.tags[userId],
+                ]),
+                "So does the object's own request span",
+              ).toEqual([[organization, owner]]);
+            }),
+          );
+
+          yield* evidence.step(
+            "The forward of a request routed by its session id names neither when the object never answers",
+            Effect.gen(function* () {
+              const answer = yield* post({
+                credential: key.key,
+                session,
+                protocol: stateful,
+                headers: lost,
+                message: { id: 2, method: "tools/list", params: {} },
+              });
+              expect(answer.status).toBe(500);
+              expect(
+                yield* forwarded(answer.traceId),
+                "The gateway does not guess the organization or user of a request it did not authenticate",
+              ).toEqual([["session", undefined, undefined]]);
+            }),
+          );
+        }),
+      ),
+    { timeout: 120_000 },
+  );
+});
diff --git a/e2e/tests/mcp-search-concise.spec.ts b/e2e/tests/mcp-search-concise.spec.ts
index 56ad0279f5..34c55eeb34 100644
--- a/e2e/tests/mcp-search-concise.spec.ts
+++ b/e2e/tests/mcp-search-concise.spec.ts
@@ -1,4 +1,4 @@
-/** A broad tools.search stays inside the execute output budget; describe returns full detail. */
+/** A broad tools.search stays inside its page budget; describe returns full detail. */
 import { expect, layer } from "@effect/vitest";
 import { Effect, Redacted, Schema } from "effect";
 import { randomUUID } from "node:crypto";
@@ -11,8 +11,8 @@ import { connectLocalAccount } from "../support/app-accounts.ts";
 import { scenarios } from "../test-plan.ts";
 import { appsManifest } from "../support/apps-release.ts";
 
-/** Execute's default output budget; a search page may use a quarter of it. */
-const outputBytes = 100_000;
+/** UTF-8 bytes of JSON one search page holds at most. */
+const pageBytes = 25_000;
 const records = 100;
 const kinds = 300;
 
@@ -185,7 +185,7 @@ layer(TestLive, { excludeTestServices: true })("MCP search concise", (it) => {
         yield* evidence.json("search-first-page.json", first.value);
         const text = JSON.stringify(first.value);
         const page = yield* Schema.decodeUnknownEffect(Page)(first.value);
-        expect(Buffer.byteLength(text)).toBeLessThanOrEqual(outputBytes / 4);
+        expect(Buffer.byteLength(text)).toBeLessThanOrEqual(pageBytes);
         expect(page.items.length).toBeGreaterThan(0);
         expect(page.items.length).toBeLessThan(tools);
         expect(page.remaining).toBe(tools - page.items.length);
diff --git a/e2e/tests/npm-launcher.spec.ts b/e2e/tests/npm-launcher.spec.ts
index 1f2108c4e6..768a264ab0 100644
--- a/e2e/tests/npm-launcher.spec.ts
+++ b/e2e/tests/npm-launcher.spec.ts
@@ -15,7 +15,7 @@ import { Config, Deferred, Effect, FileSystem, Option, Path, Schema, Stream } fr
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { FetchHttpClient } from "effect/http";
 import { localNpmRegistry } from "../support/npm-registry.ts";
-import { freePort } from "../support/ports.ts";
+import { connectionRefused, freePort } from "../support/ports.ts";
 
 const Manifest = Schema.fromJsonString(
   Schema.Struct({
@@ -162,14 +162,15 @@ it.live(
             }),
           );
           // The server ran its own shutdown, which ends an interrupted program with 130, and the
-          // launcher exited with it. Nothing listens on its port any more.
+          // launcher exited with it. It removed its registration, and nothing listens on its port.
           expect(Number(stopped)).toBe(130);
-          const answered = yield* run(executable, ["pair"], root, {
+          expect(yield* fs.exists(path.join(root, "data", "server.json"))).toBe(false);
+          const status = yield* run(executable, ["service", "status"], root, {
             EXECUTOR_DATA_DIR: path.join(root, "data"),
-            EXECUTOR_PORT: String(port),
           });
-          expect(answered.code).toBe(1);
-          expect(answered.stderr).toContain(`No server answered on 127.0.0.1:${port}`);
+          expect(status.code, status.stderr).toBe(0);
+          expect(status.stdout).toBe("stopped");
+          expect(yield* connectionRefused(port)).toBe(true);
         }
 
         // npm skips optional dependencies with --omit=optional; the launcher says how to fix it.
diff --git a/e2e/tests/oauth-client-authentication.spec.ts b/e2e/tests/oauth-client-authentication.spec.ts
index 2bfcc2cea2..973bb5bca1 100644
--- a/e2e/tests/oauth-client-authentication.spec.ts
+++ b/e2e/tests/oauth-client-authentication.spec.ts
@@ -150,6 +150,8 @@ export default defineApp({user: { accounts:{service} }},async({user: { accounts
             const account = yield* body(Resource, completed);
 
             const refreshes = exchanged.refreshes;
+            // Services such as GitLab ask for the sign-in's callback again on refresh.
+            yield* issuer.configure({ requireRefreshRedirectUri: redirect.redirectUri });
             const read = yield* api.request(
               actors.owner,
               "POST",
@@ -163,6 +165,8 @@ export default defineApp({user: { accounts:{service} }},async({user: { accounts
             ).toBe(200);
             expect(yield* body(Read, read)).toEqual({ refreshed: true });
             expect(renewed.refreshes).toBeGreaterThan(refreshes);
+            expect(renewed.refreshRedirectUri).toBe(redirect.redirectUri);
+            expect(renewed.refreshChecks).toMatchObject({ redirect: true });
 
             const revocations = renewed.revocations.length;
             expect(
diff --git a/e2e/tests/oauth-client-issuer-migration.spec.ts b/e2e/tests/oauth-client-issuer-migration.spec.ts
index 5bae377d69..b290a7ea8e 100644
--- a/e2e/tests/oauth-client-issuer-migration.spec.ts
+++ b/e2e/tests/oauth-client-issuer-migration.spec.ts
@@ -361,7 +361,7 @@ layer(TestLive, { excludeTestServices: true })("OAuth client issuer migration",
           },
         ]);
         yield* serverControl("start");
-        expect(version).toEqual([{ value: "4.0.15" }]);
+        expect(version).toEqual([{ value: "4.0.16" }]);
         expect(credentials).toEqual([
           { client: ids.a },
           { client: ids.a },
diff --git a/e2e/tests/oauth-client-setup.spec.ts b/e2e/tests/oauth-client-setup.spec.ts
index 86db380afe..4207bb17ad 100644
--- a/e2e/tests/oauth-client-setup.spec.ts
+++ b/e2e/tests/oauth-client-setup.spec.ts
@@ -20,6 +20,7 @@ const AppProvider = Schema.Struct({
 });
 const Setup = Schema.Struct({
   mode: Schema.Literals(["automatic", "client-required"]),
+  resource: Schema.Struct({ value: Schema.NullOr(Schema.String), source: Schema.String }),
   clients: Schema.Array(Schema.Unknown),
 });
 
@@ -63,8 +64,19 @@ export default defineApp({user: { accounts:{service} }},async()=>({tools: router
             expect(response.status).toBe(200);
             expect(
               Object.keys(yield* body(Schema.Record(Schema.String, Schema.Unknown), response)),
-            ).toEqual(["mode", "scopes", "grant", "issuer", "tokenEndpointAuthMethod", "clients"]);
+            ).toEqual([
+              "mode",
+              "scopes",
+              "resource",
+              "grant",
+              "issuer",
+              "tokenEndpointAuthMethod",
+              "clients",
+            ]);
             const setup = yield* body(Setup, response);
+            // The provider declares no `resource`, so sign-in sends the one the server's
+            // protected-resource metadata names.
+            expect(setup.resource).toEqual({ value: `${issuer.origin}/mcp`, source: "metadata" });
             // No one registered a client for its server, so none is offered.
             expect(setup.clients).toEqual([]);
             return setup;
diff --git a/e2e/tests/oauth-clients.spec.ts b/e2e/tests/oauth-clients.spec.ts
index d5e1339275..b76a2adb5d 100644
--- a/e2e/tests/oauth-clients.spec.ts
+++ b/e2e/tests/oauth-clients.spec.ts
@@ -397,106 +397,149 @@ layer(HostedLive, { excludeTestServices: true })("OAuth clients", (it) => {
     withHostedCase(
       context,
       Effect.gen(function* () {
-        const { actors, deploy, options } = yield* organizationOAuth;
+        const { api, actors, issuer, prefix, deploy, options, connection, start } =
+          yield* organizationOAuth;
         const browser = yield* Browser;
         const app = yield* deploy;
         expect(yield* options(actors.admin, app.provider)).toEqual({
           mode: "client-required",
           clients: [],
         });
-        const notice = `No OAuth client is registered for ${app.name}, and Executor doesn’t provide one.`;
+        const dialog = (page: Page) => page.getByRole("dialog");
+        const sharing = (page: Page) =>
+          dialog(page).getByRole("combobox", { name: "Who can use this client", exact: true });
         const openConnect = (actor: string) =>
           browser.use(`Open the connect form as ${actor}`, (page) =>
             page
               .goto(`/org/${actors.organization.slug}/apps/${app.id}?view=accounts`)
               .then(() =>
                 page.getByRole("button", { name: "Connect new account", exact: true }).click(),
+              )
+              .then(() => dialog(page).getByLabel("Client ID", { exact: true }).waitFor())
+              .then(() =>
+                page.waitForFunction(() =>
+                  document.getAnimations().every((animation) => animation.playState !== "running"),
+                ),
               ),
           );
+        const registered = Effect.gen(function* () {
+          return (yield* body(
+            Directory,
+            yield* api.request(actors.admin, "GET", `${prefix}/oauth-clients`),
+          )).clients.filter((entry) => entry.client.clientId === teamClient.clientId);
+        });
+        // Entering details for one account saves nothing for the organization.
+        const entered = yield* body(
+          Redirect,
+          yield* start(actors.member, yield* connection(actors.member, app.id), teamClient),
+        );
+        expect(yield* registered).toEqual([]);
+        yield* issuer.allowClient({ ...teamClient, redirect: entered.redirectUri });
+        yield* Effect.addFinalizer(() =>
+          issuer.configure({ authorizeError: null, browserReturn: null }),
+        );
         yield* browser.omitNetworkTrace;
 
         // Members cannot register clients, so they enter their own OAuth app's details.
         yield* browser.login(actors.member);
         yield* openConnect("a member");
-        yield* browser.use("Members enter client details", (page) =>
-          page
-            .getByRole("dialog")
-            .getByLabel("Client ID", { exact: true })
-            .waitFor({ state: "visible" }),
-        );
         expect(
-          yield* browser.use("Members are not offered registration", (page) =>
-            page
-              .getByRole("dialog")
-              .getByRole("button", { name: "Register OAuth client", exact: true })
-              .count(),
+          yield* browser.use("Members are not asked who can use the client", (page) =>
+            sharing(page).count(),
           ),
         ).toBe(0);
+        yield* browser.checkpoint("Connect form without an OAuth client, as a member");
 
-        // Administrators are told why they cannot connect yet, and how to fix it.
+        // Administrators enter the client in the connect form; there is no separate step.
         yield* browser.login(actors.admin);
         yield* openConnect("an administrator");
-        yield* browser.use("Administrators are told no client exists", (page) =>
-          page.getByRole("dialog").getByText(notice, { exact: true }).waitFor({ state: "visible" }),
-        );
         expect(
-          yield* browser.use("Connecting waits for a client", (page) =>
+          yield* browser.use("Administrators share the client with everyone by default", (page) =>
             Promise.all([
-              page
-                .getByRole("dialog")
-                .getByRole("button", { name: "Connect " + app.name, exact: true })
+              sharing(page).filter({ hasText: "Everyone in the organization" }).count(),
+              dialog(page).getByRole("button", { name: "Register OAuth client" }).count(),
+              dialog(page)
+                .getByRole("region", { name: "Permissions to add to the OAuth app", exact: true })
                 .count(),
-              page.getByRole("dialog").getByLabel("Client ID", { exact: true }).count(),
             ]),
           ),
-        ).toEqual([0, 0]);
-        yield* browser.use("Let the dialog finish opening", (page) =>
-          page.waitForFunction(() =>
-            document.getAnimations().every((animation) => animation.playState !== "running"),
-          ),
-        );
-        yield* browser.checkpoint("Connect form without an OAuth client");
-        yield* browser.use("Register a client from the connect form", (page) =>
-          page
-            .getByRole("dialog")
-            .getByRole("button", { name: "Register OAuth client", exact: true })
-            .click(),
-        );
-        // The service being connected is already chosen.
-        yield* browser.use("The form registers a client for this service", (page) =>
-          page
-            .getByRole("form", { name: "Register OAuth client" })
-            .getByRole("combobox", { name: "Service", exact: true })
-            .filter({ hasText: app.name })
-            .waitFor({ state: "visible" })
-            .then(() => page.getByLabel("Client ID", { exact: true }).fill(teamClient.clientId))
+        ).toEqual([1, 0, 1]);
+        // The secret is mistyped, which the service would refuse when exchanging the code.
+        yield* browser.use("Enter the client with a mistyped secret", (page) =>
+          dialog(page)
+            .getByLabel("Client ID", { exact: true })
+            .fill(teamClient.clientId)
             .then(() =>
-              page
-                .getByLabel("Client secret (optional)", { exact: true })
-                .fill(teamClient.clientSecret),
+              dialog(page)
+                .getByLabel(/^Client secret/)
+                .fill("synthetic-mistyped-secret"),
             ),
         );
-        yield* browser.checkpoint("Register OAuth client from the connect form");
-        // Registering returns to connecting, now with the client to sign in with.
-        yield* browser.use("Register and return to connecting", (page) =>
-          page
-            .getByRole("button", { name: "Register", exact: true })
+        yield* browser.checkpoint("Connect form without an OAuth client, as an administrator");
+
+        // Connect registers the client, then signs in with it; this sign-in is cancelled.
+        const origin = yield* browser.use("Read the dashboard origin", (page) =>
+          page.evaluate(() => location.origin),
+        );
+        yield* issuer.configure({ authorizeError: "access_denied", browserReturn: origin });
+        yield* browser.use("Connect and return cancelled from the service", (page) =>
+          dialog(page)
+            .getByRole("button", { name: "Connect " + app.name, exact: true })
             .click()
-            .then(() =>
-              page
-                .getByRole("dialog")
-                .getByRole("button", { name: "Connect " + app.name, exact: true })
-                .waitFor({ state: "visible" }),
-            ),
+            .then(() => page.waitForURL((url) => url.pathname === "/oauth/callback"))
+            .then(() => page.getByText("Connection cancelled").waitFor()),
+        );
+        const [client] = yield* registered;
+        expect(client).toEqual(
+          expect.objectContaining({
+            client: expect.objectContaining({ source: "manual" }),
+            access: expect.objectContaining({ audience: { kind: "everyone" } }),
+          }),
         );
+        yield* browser.use("The cancelled sign-in offers to edit the client", (page) =>
+          page.getByRole("link", { name: "Edit client details", exact: true }).waitFor(),
+        );
+        yield* browser.checkpoint("Sign-in cancelled after registering the client");
+
+        // Editing reopens the registered client's details and updates it in place.
+        yield* issuer.configure({ authorizeError: null });
+        expect(
+          yield* browser.use("Edit the registered client's details", (page) =>
+            page
+              .getByRole("link", { name: "Edit client details", exact: true })
+              .click()
+              .then(() => dialog(page).getByLabel("Client ID", { exact: true }).inputValue()),
+          ),
+        ).toBe(teamClient.clientId);
         expect(
-          yield* browser.use("The notice is gone", (page) =>
-            page.getByRole("dialog").getByText(notice, { exact: true }).count(),
+          yield* browser.use("The registered client keeps who can use it", (page) =>
+            sharing(page).count(),
           ),
         ).toBe(0);
-        expect((yield* options(actors.admin, app.provider)).clients).toEqual([
-          expect.objectContaining({ clientId: teamClient.clientId }),
-        ]);
+        yield* browser.use("Correct the secret", (page) =>
+          dialog(page)
+            .getByLabel("Client secret (optional)", { exact: true })
+            .fill(teamClient.clientSecret),
+        );
+        yield* browser.checkpoint("Edit the registered client's details");
+        yield* browser.use("Connect, sign in and return to the app's accounts", (page) =>
+          dialog(page)
+            .getByRole("button", { name: "Connect " + app.name, exact: true })
+            .click()
+            .then(() =>
+              page
+                .getByRole("dialog", { name: "Name this account" })
+                .getByRole("textbox")
+                .first()
+                .waitFor(),
+            ),
+        );
+        yield* browser.checkpoint("Connected with the corrected client");
+        expect((yield* registered).map((entry) => entry.client.id)).toEqual([client?.client.id]);
+        expect(yield* options(actors.member, app.provider)).toEqual({
+          mode: "client-required",
+          clients: [{ id: client?.client.id, clientId: teamClient.clientId }],
+        });
       }),
     ),
   );
diff --git a/e2e/tests/oauth-connect-storyboard.spec.ts b/e2e/tests/oauth-connect-storyboard.spec.ts
index 6145ba2a82..da225cde9f 100644
--- a/e2e/tests/oauth-connect-storyboard.spec.ts
+++ b/e2e/tests/oauth-connect-storyboard.spec.ts
@@ -571,11 +571,11 @@ export default defineApp({user: { accounts:{service} }},async()=>({tools: router
           page.goto(`/org/${actors.organization.slug}/apps/${manual.id}?view=accounts`),
         );
         yield* click("Connect new account");
-        // No client is registered, so the administrator is told so and offered registration.
-        yield* browser.use("Wait for the missing client notice", (page) =>
+        // No client is registered, so the administrator enters one and chooses who can use it.
+        yield* browser.use("Wait for the client details", (page) =>
           page
             .getByRole("dialog")
-            .getByRole("button", { name: "Register OAuth client", exact: true })
+            .getByRole("combobox", { name: "Who can use this client", exact: true })
             .waitFor(),
         );
         yield* capture("Client-required-first-connection");
diff --git a/e2e/tests/oauth-declared-endpoints.spec.ts b/e2e/tests/oauth-declared-endpoints.spec.ts
index 49a594fa7a..3f13a3a603 100644
--- a/e2e/tests/oauth-declared-endpoints.spec.ts
+++ b/e2e/tests/oauth-declared-endpoints.spec.ts
@@ -204,6 +204,7 @@ export default defineApp({user: { accounts:{service} }},async({user: { accounts
           scopes: ["openid", "read"],
           grant: "authorization_code",
           issuer: `${issuer.origin}/token`,
+          resource: { value: null, source: "none" },
           clients: [],
         });
         // Executor never reads ID tokens, so sign-in and refresh succeed even though these name
@@ -427,6 +428,7 @@ export default defineApp({user: { accounts:{service} }},async({user: { accounts
           scopes: ["read"],
           grant: "authorization_code",
           issuer: issuer.origin,
+          resource: { value: `${issuer.origin}/mcp`, source: "metadata" },
           clients: [],
         });
         const signInWith = (
diff --git a/e2e/tests/oauth-google-renewable-grant.spec.ts b/e2e/tests/oauth-google-renewable-grant.spec.ts
new file mode 100644
index 0000000000..78373eeda6
--- /dev/null
+++ b/e2e/tests/oauth-google-renewable-grant.spec.ts
@@ -0,0 +1,119 @@
+/**
+ * Google issues a refresh token only for `access_type=offline`, and on a later sign-in only with
+ * `prompt=consent`, and its metadata says neither. Every sign-in at Google's authorization endpoint
+ * asks for both, so an app that declares only Google's endpoints, as an app imported from Executor
+ * v1 does, still keeps its accounts signed in past the first hour. An app's own values win, and
+ * no other server receives them. Starting a sign-in never contacts Google.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Resource } from "../support/contracts.ts";
+import { connectionsPath } from "../support/app-accounts.ts";
+import { scenarios } from "../test-plan.ts";
+import { appsManifest } from "../support/apps-release.ts";
+
+const SignIn = Schema.Struct({ authorizationUrl: Schema.String });
+const google = "https://accounts.google.com/o/oauth2/v2/auth";
+
+layer(HostedLive, { excludeTestServices: true })("Google renewable grant", (it) => {
+  it.effect(scenarios.oauthGoogleRenewableGrant.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        /** The sign-in URL for an app whose one OAuth method has these settings. */
+        const signIn = (config: object) =>
+          Effect.gen(function* () {
+            const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+              name: `Google sign-in ${randomUUID().slice(0, 8)}`,
+              files: [
+                {
+                  path: "index.ts",
+                  content: `import { defineApp, defineProvider, oauth2, router } from "apps";
+const service=defineProvider({name:"Calendar",auth:{oauth:oauth2(${JSON.stringify({
+                    tokenUrl: "https://oauth2.googleapis.com/token",
+                    scopes: ["https://www.googleapis.com/auth/calendar"],
+                    tokenEndpointAuthMethod: "client_secret_post",
+                    ...config,
+                  })})}});
+export default defineApp({user: { accounts:{service} }},async()=>({tools: router({})}));`,
+                },
+                appsManifest,
+              ],
+            });
+            expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+            const app = yield* body(Resource, deployed);
+            yield* Effect.addFinalizer(() =>
+              api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+            );
+            const connection = yield* body(
+              Resource,
+              yield* api.request(
+                actors.owner,
+                "POST",
+                connectionsPath(`${prefix}/apps/${app.id}`, "user", "service"),
+                {},
+              ),
+            );
+            const started = yield* api.request(
+              actors.owner,
+              "POST",
+              `${prefix}/connections/${connection.id}/oauth/start`,
+              {
+                method: "oauth",
+                label: "Calendar",
+                client: {
+                  clientId: "synthetic-google-client",
+                  clientSecret: "synthetic-google-secret",
+                },
+              },
+            );
+            expect(started.status, JSON.stringify(started.body)).toBe(200);
+            const url = new URL((yield* body(SignIn, started)).authorizationUrl);
+            expect(url.searchParams.get("client_id")).toBe("synthetic-google-client");
+            return url;
+          });
+        const sent = (url: URL) => ({
+          access_type: url.searchParams.getAll("access_type"),
+          prompt: url.searchParams.getAll("prompt"),
+        });
+
+        // Only Google's endpoints, as v1 stored them and its import declares them.
+        const plain = yield* signIn({ authorizationUrl: google });
+        expect(`${plain.origin}${plain.pathname}`).toBe(google);
+        expect(sent(plain)).toEqual({ access_type: ["offline"], prompt: ["consent"] });
+
+        // A declared parameter replaces the default it names and keeps the other.
+        expect(
+          sent(
+            yield* signIn({
+              authorizationUrl: google,
+              authorizationParams: { prompt: "select_account consent" },
+            }),
+          ),
+        ).toEqual({ access_type: ["offline"], prompt: ["select_account consent"] });
+        // So does the declared URL's own query.
+        expect(sent(yield* signIn({ authorizationUrl: `${google}?access_type=online` }))).toEqual({
+          access_type: ["online"],
+          prompt: ["consent"],
+        });
+
+        // Another server, even one whose name starts with Google's, receives neither.
+        expect(
+          sent(
+            yield* signIn({
+              authorizationUrl: "https://accounts.google.com.example.test/o/oauth2/v2/auth",
+              tokenUrl: "https://accounts.google.com.example.test/token",
+            }),
+          ),
+        ).toEqual({ access_type: [], prompt: [] });
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/oauth-refresh-redirect-uri.spec.ts b/e2e/tests/oauth-refresh-redirect-uri.spec.ts
new file mode 100644
index 0000000000..772bd6f139
--- /dev/null
+++ b/e2e/tests/oauth-refresh-redirect-uri.spec.ts
@@ -0,0 +1,199 @@
+/**
+ * Services such as GitLab and Yahoo ask for the sign-in's callback again when a token is
+ * refreshed. A grant keeps the callback its sign-in used and sends it on every refresh. A grant an
+ * earlier release saved has none, and refreshes as it did before, without one.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Redacted, Schema } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/http";
+import { randomUUID } from "node:crypto";
+import { Api, body, type Session } from "../support/api.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { TestLive, withCase } from "../support/case.ts";
+import { Resource } from "../support/contracts.ts";
+import { legacyStorage } from "../support/legacy-storage.ts";
+import { oauthSetupIssuer } from "../support/oauth-setup-issuer.ts";
+import { Target } from "../support/platform.ts";
+import { serverControl } from "../support/server-control.ts";
+import { scenarios } from "../test-plan.ts";
+
+const Published = Schema.Struct({ app: Schema.Struct({ id: Schema.String }) });
+const Link = Schema.Struct({ connection: Schema.String, url: Schema.String });
+const Redirect = Schema.Struct({
+  status: Schema.Literal("redirect"),
+  authorizationUrl: Schema.String,
+});
+const Completed = Schema.Struct({
+  status: Schema.Literal("completed"),
+  value: Schema.Struct({ service: Schema.Struct({ refreshed: Schema.Boolean }) }),
+});
+const StoredResponse = Schema.Struct({ response: Schema.Record(Schema.String, Schema.Json) });
+
+layer(TestLive, { excludeTestServices: true })("OAuth refresh redirect URI", (it) => {
+  it.effect(scenarios.oauthRefreshRedirectUri.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          target = yield* Target,
+          http = yield* HttpClient.HttpClient,
+          session = yield* api.session();
+        const headers = { authorization: `Bearer ${Redacted.value(target.apiKey)}` };
+        const agent: Session = {
+          ...session,
+          send: (method, path, data, extra = {}) => {
+            const { origin: _origin, ...rest } = extra;
+            return session.send(method, path, data, { ...rest, ...headers });
+          },
+        };
+        const issuer = yield* oauthSetupIssuer;
+        const client = {
+          clientId: "synthetic-redirect-client",
+          clientSecret: "synthetic-redirect-secret",
+        };
+        // Tokens are issued inside the host's renewal window, so using the account refreshes it.
+        yield* issuer.configure({ refreshTokens: true, expiresIn: 20, registeredClient: client });
+        const name = `Refresh callback ${randomUUID().slice(0, 8)}`;
+        const deployed = yield* api.request(agent, "POST", "/v1/apps/deploy", {
+          owner: "local",
+          name,
+          files: [
+            {
+              path: "index.ts",
+              content: `import { defineApp, defineProvider, oauth2, query, object, router } from "apps";
+const service = defineProvider({ name: ${JSON.stringify(name)}, auth: { oauth: oauth2({ discover: ${JSON.stringify(`${issuer.origin}/mcp`)} }) } });
+export default defineApp({ user: { accounts: { service } } }, async ({ user: { accounts } }) => ({
+  tools: router({
+    read: query({ input: object({}) }, async ({ fetch }) => ({ service: await (await fetch(${JSON.stringify(`${issuer.origin}/resource`)}, { headers: { authorization: "Bearer " + accounts.service.fields.access_token } })).json() })),
+  }),
+}));`,
+            },
+            appsManifest,
+          ],
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const { app } = yield* body(Published, deployed);
+        let account: string | undefined;
+        // A legacy storage write leaves the product stopped, so start it before cleaning up.
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            yield* serverControl("start");
+            yield* api.request(agent, "DELETE", `/v1/apps/${app.id}`);
+            if (account !== undefined)
+              yield* api.request(agent, "DELETE", `/v1/accounts/${account}`);
+          }).pipe(Effect.orDie),
+        );
+        const link = yield* body(
+          Link,
+          yield* api.request(agent, "POST", "/account-connect/api/requests", {
+            owner: "local",
+            target: { app: app.id, requirement: "service" },
+          }),
+        );
+        const grant = {
+          connection: link.connection,
+          token: new URLSearchParams(new URL(link.url).hash.slice(1)).get("token"),
+        };
+        const started = yield* api.request(session, "POST", "/account-connect/api/oauth/start", {
+          ...grant,
+          method: "oauth",
+          label: "Synthetic refresh callback account",
+        });
+        expect(started.status, JSON.stringify(started.body)).toBe(200);
+        const { authorizationUrl } = yield* body(Redirect, started);
+        const redirectUri = new URL(authorizationUrl).searchParams.get("redirect_uri");
+        if (redirectUri === null) return yield* Effect.die("Sign-in sent no redirect_uri");
+        const callbackUrl = yield* Effect.scoped(
+          Effect.gen(function* () {
+            const consent = yield* HttpClient.withScope(http).get(authorizationUrl);
+            expect(consent.status).toBe(302);
+            const location = consent.headers.location;
+            if (location === undefined)
+              return yield* Effect.die("Issuer did not return a callback");
+            return location;
+          }),
+        ).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }));
+        const completed = yield* api.request(
+          session,
+          "POST",
+          "/account-connect/api/oauth/complete",
+          { ...grant, callbackUrl },
+        );
+        expect(completed.status, JSON.stringify(completed.body)).toBe(200);
+        const connected = (yield* body(Resource, completed)).id;
+        account = connected;
+
+        const read = Effect.gen(function* () {
+          const before = (yield* issuer.metrics).refreshesIssued;
+          const response = yield* api.request(agent, "POST", "/v1/tools/call", {
+            app: app.id,
+            tool: "read",
+            input: {},
+          });
+          const metrics = yield* issuer.metrics;
+          expect(
+            response.status,
+            `${JSON.stringify(response.body)}, checks=${JSON.stringify(metrics.refreshChecks)}`,
+          ).toBe(200);
+          expect((yield* body(Completed, response)).value.service.refreshed).toBe(true);
+          expect(metrics.refreshesIssued).toBeGreaterThan(before);
+          return metrics;
+        });
+
+        // The service refuses a refresh that does not repeat the sign-in's callback.
+        yield* issuer.configure({ requireRefreshRedirectUri: redirectUri });
+        expect((yield* read).refreshRedirectUri).toBe(redirectUri);
+
+        // An earlier release saved the grant without its callback, with a refresh token the
+        // service issued at sign-in and an access token that is due for renewal.
+        const registration = (yield* issuer.metrics).lastRegistration;
+        if (registration === undefined) return yield* Effect.die("Sign-in registered no client");
+        const refreshToken = yield* issuer.issueRefreshToken(client.clientId);
+        const [stored = []] = yield* legacyStorage([
+          {
+            sql: `SELECT p.definition->'auth'->'oauth'->'response' AS response
+              FROM executor_providers p JOIN executor_accounts a ON a.provider = p.id
+              WHERE a.id = $1`,
+            params: [connected],
+          },
+        ]);
+        const [{ response }] = Schema.decodeUnknownSync(Schema.Tuple([StoredResponse]))(stored);
+        yield* legacyStorage([
+          {
+            sql: `UPDATE executor_oauth_grants SET encrypted = $2 WHERE id = $1`,
+            params: [
+              connected,
+              {
+                sealed: {
+                  id: connected,
+                  value: {
+                    server: {
+                      issuer: issuer.origin,
+                      authorization_endpoint: `${issuer.origin}/authorize`,
+                      token_endpoint: `${issuer.origin}/token`,
+                    },
+                    client: {
+                      client_id: client.clientId,
+                      token_endpoint_auth_method: registration.method,
+                      ...(registration.method === "none"
+                        ? {}
+                        : { client_secret: client.clientSecret }),
+                    },
+                    response,
+                    fields: { access_token: "synthetic-access-token", token_type: "Bearer" },
+                    refreshToken,
+                    expiresAt: Date.now(),
+                  },
+                },
+              },
+            ],
+          },
+        ]);
+        // The service accepts a refresh without a callback, as RFC 6749 section 6 defines it.
+        yield* issuer.configure({ requireRefreshRedirectUri: null });
+        yield* serverControl("start");
+        expect((yield* read).refreshRedirectUri).toBeNull();
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/oauth-refresh-resilience.spec.ts b/e2e/tests/oauth-refresh-resilience.spec.ts
index 154ea87ec7..5dce10c2e1 100644
--- a/e2e/tests/oauth-refresh-resilience.spec.ts
+++ b/e2e/tests/oauth-refresh-resilience.spec.ts
@@ -85,6 +85,41 @@ const refreshFailures = {
     body: { ok: false, error: "internal_error", ...privateError },
   },
   invalid_grant: { status: 400, body: { error: "invalid_grant", ...privateError } },
+  // Supabase Auth's OAuth server refuses a refresh with its own body instead of RFC 6749's
+  // `error`. Its `refresh_token_already_used` means the grant has ended; other codes do not.
+  supabase_refusal: {
+    status: 400,
+    body: { code: 400, error_code: "validation_failed", msg: "PRIVATE_PROVIDER_ERROR" },
+  },
+  supabase_already_used: {
+    status: 400,
+    body: { code: 400, error_code: "refresh_token_already_used", msg: "PRIVATE_PROVIDER_ERROR" },
+  },
+  // GitHub answers an invalid or expired refresh token with HTTP 200 and its own code. Slack
+  // answers HTTP 200 with `ok: false` and its own codes for an invalid refresh token and for a
+  // deleted user or workspace or a removed app.
+  github_bad_refresh_token: { status: 200, body: { error: "bad_refresh_token", ...privateError } },
+  slack_invalid_refresh_token: {
+    status: 200,
+    body: { ok: false, error: "invalid_refresh_token", ...privateError },
+  },
+  slack_token_revoked: {
+    status: 200,
+    body: { ok: false, error: "token_revoked", ...privateError },
+  },
+  // AWS Sign-In answers a refresh token whose session has ended with HTTP 401 and a code of its
+  // own, uppercase, with a `message` instead of `error_description`, and one revoked by a password
+  // change with HTTP 403. Tesla answers a refresh token used again, or one the user revoked, with
+  // HTTP 401 and OpenID Connect's `login_required`.
+  aws_token_expired: {
+    status: 401,
+    body: { error: "TOKEN_EXPIRED", message: "PRIVATE_PROVIDER_ERROR" },
+  },
+  aws_user_credentials_changed: {
+    status: 403,
+    body: { error: "USER_CREDENTIALS_CHANGED", message: "PRIVATE_PROVIDER_ERROR" },
+  },
+  tesla_login_required: { status: 401, body: { error: "login_required", ...privateError } },
 } satisfies Record<string, TokenError>;
 type RefreshFailure = keyof typeof refreshFailures;
 /** Seconds a token lasts when a scenario needs it to expire before the next call. */
@@ -120,9 +155,10 @@ const renewalFixture = Effect.gen(function* () {
   /**
    * Deploy an app whose query presents each listed slot's token to the issuer's resource, and
    * whose mutation posts the first slot's token. A refused token is reported as an
-   * authentication failure of the account that presented it, as provider helpers do.
+   * authentication failure of the account that presented it, as provider helpers do. `manifest`
+   * pins the `apps` release it is built with.
    */
-  const deploy = (appName: string, slots: ReadonlyArray<string>) =>
+  const deploy = (appName: string, slots: ReadonlyArray<string>, manifest = appsManifest) =>
     Effect.gen(function* () {
       const reads = slots
         .map((slot) => `${slot}: await call(fetch, accounts.${slot}, "GET")`)
@@ -146,7 +182,7 @@ export default defineApp({ user: { accounts: { ${slots.map((slot) => `${slot}: s
   }),
 }));`,
           },
-          appsManifest,
+          manifest,
         ],
       });
       expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
@@ -211,12 +247,21 @@ export default defineApp({ user: { accounts: { ${slots.map((slot) => `${slot}: s
    * Read with the app's linked account. Connecting another account from the app replaces the
    * link, so each call uses the account connected last.
    */
-  const read = () =>
-    api.request(actors.owner, "POST", `${prefix}/apps/${app.id}/tools/call`, {
+  const read = (appId = app.id) =>
+    api.request(actors.owner, "POST", `${prefix}/apps/${appId}/tools/call`, {
       tool: "read",
       kind: "query",
       input: {},
     });
+  /**
+   * List the app's tools, as a caller discovering them does. The listing is kept, and only a kept
+   * listing confirms that a query only reads, so a refused query is repeated after renewal.
+   */
+  const list = (appId = app.id) =>
+    Effect.gen(function* () {
+      const listed = yield* api.request(actors.owner, "GET", `${prefix}/apps/${appId}/tools`);
+      expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+    });
   const expectRead = (generation: number) =>
     Effect.gen(function* () {
       const response = yield* read();
@@ -261,6 +306,7 @@ export default defineApp({ user: { accounts: { ${slots.map((slot) => `${slot}: s
     provider,
     connect,
     read,
+    list,
     expectRead,
     refreshes,
     assertPrivate,
@@ -388,6 +434,7 @@ layer(HostedLive, { excludeTestServices: true })("OAuth refresh resilience", (it
             providerError: "invalid_scope",
           },
           { failure: "slack_internal_error", reason: "renewal_rejected", status: 200 },
+          { failure: "supabase_refusal", reason: "renewal_rejected", status: 400 },
         ];
         for (const scenario of transient) {
           yield* Effect.sleep(pastShortLifetime);
@@ -510,6 +557,79 @@ layer(HostedLive, { excludeTestServices: true })("OAuth refresh resilience", (it
       }),
     ),
   );
+  it.effect(scenarios.oauthRenewalEndedGrantCodes.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const { issuer, provider, connect, read, refreshes, assertPrivate, spans, evidence } =
+          yield* renewalFixture;
+        // A service's own code for a refresh token that can never be used again ends the grant
+        // as `invalid_grant` does, at any HTTP status, so the account asks to reconnect instead of
+        // renewing on every use: Supabase Auth's for a token used again, GitHub's for an invalid
+        // or expired one, Slack's for an invalid one or a removed installation, AWS Sign-In's for
+        // an ended session or changed password, and Tesla's for one used again or revoked. A 401
+        // with one of these is not a refusal of the client. The trace names the code.
+        const ended: ReadonlyArray<{
+          readonly failure: RefreshFailure;
+          readonly status: number;
+          readonly code: string;
+        }> = [
+          { failure: "supabase_already_used", status: 400, code: "refresh_token_already_used" },
+          { failure: "github_bad_refresh_token", status: 200, code: "bad_refresh_token" },
+          { failure: "slack_invalid_refresh_token", status: 200, code: "invalid_refresh_token" },
+          { failure: "slack_token_revoked", status: 200, code: "token_revoked" },
+          { failure: "aws_token_expired", status: 401, code: "token_expired" },
+          {
+            failure: "aws_user_credentials_changed",
+            status: 403,
+            code: "user_credentials_changed",
+          },
+          { failure: "tesla_login_required", status: 401, code: "login_required" },
+        ];
+        for (const scenario of ended) {
+          const account = yield* connect(`Synthetic ${scenario.failure} account`);
+          yield* issuer.configure({ tokenError: refreshFailures[scenario.failure] });
+          const before = yield* refreshes;
+          const refusedRead = yield* read();
+          expect(
+            refusedRead.status,
+            `${scenario.failure}: ${JSON.stringify(refusedRead.body)}`,
+          ).toBe(409);
+          expect(yield* body(Failure, refusedRead), scenario.failure).toMatchObject({
+            _tag: "OAuthReconnectRequired",
+            account,
+            cause: { stage: "refresh", status: scenario.status },
+          });
+          assertPrivate(refusedRead.body);
+          const trace = yield* spans;
+          expect(
+            trace.data.find(
+              ({ span }) =>
+                span.operationName === "oauth.resolve" &&
+                span.tags["oauth.renewal.outcome"] !== undefined,
+            )?.span.tags,
+            scenario.failure,
+          ).toMatchObject({
+            "oauth.provider.id": provider,
+            "oauth.renewal.outcome": "reconnect",
+            "oauth.reconnect.reason": "renewal_refused",
+          });
+          expect(
+            trace.data.find(({ span }) => span.operationName === "oauth.refresh")?.span.tags,
+            scenario.failure,
+          ).toMatchObject({ "oauth.error.known_provider_code": scenario.code });
+          assertPrivate(trace);
+          yield* evidence.json(`refresh-${scenario.failure}-trace.json`, trace);
+          yield* issuer.configure({ tokenError: null });
+          const stillEnded = yield* read();
+          expect(stillEnded.status, `${scenario.failure}: ${JSON.stringify(stillEnded.body)}`).toBe(
+            409,
+          );
+          expect(yield* refreshes, scenario.failure).toBe(before + 1);
+        }
+      }),
+    ),
+  );
   it.effect(scenarios.oauthRenewalAheadOfExpiry.title, (context) =>
     withHostedCase(
       context,
@@ -593,15 +713,17 @@ layer(HostedLive, { excludeTestServices: true })("OAuth refresh resilience", (it
           app,
           connect,
           read,
+          list,
           expectRead,
           refreshes,
           assertPrivate,
         } = yield* renewalFixture;
         // Salesforce issues a refresh token but no `expires_in`, then ends the session later, and
         // its API answers the old token with 401. Executor renews the grant once and repeats a
-        // query, which only reads; later calls keep the renewed token.
+        // query the app's kept listing confirms only reads; later calls keep the renewed token.
         yield* issuer.configure({ expiresIn: null });
         const session = yield* connect("Synthetic Salesforce-style account");
+        yield* list();
         const beforeExpiry = yield* refreshes;
         yield* expectRead(0);
         yield* expectRead(0);
@@ -659,11 +781,77 @@ layer(HostedLive, { excludeTestServices: true })("OAuth refresh resilience", (it
       }),
     ),
   );
+  it.effect(scenarios.oauthUnconfirmedReadRenewal.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const { issuer, name, deploy, app, connect, read, list, refreshes, assertPrivate } =
+          yield* renewalFixture;
+        // No `expires_in`, so only the service's refusal starts a renewal.
+        yield* issuer.configure({ expiresIn: null });
+        /**
+         * The service refuses `read` once. Executor renews the grant but, with no kept listing
+         * confirming the query only reads, does not repeat it: one failed call that may have
+         * written. The next call uses the renewed token.
+         */
+        const refusedOnce = (appId: string, session: string) =>
+          Effect.gen(function* () {
+            yield* issuer.expireAccessTokens;
+            const before = yield* refreshes;
+            const gets = (yield* issuer.metrics).resourceRequests.GET;
+            const refused = yield* read(appId);
+            expect(refused.status, JSON.stringify(refused.body)).toBe(502);
+            expect(refused.body).toMatchObject({
+              _tag: "AppProviderFailed",
+              reason: "unauthorized",
+              status: 401,
+              credentialsRenewed: true,
+              mayHaveWritten: true,
+              account: { id: session },
+              recovery: { action: unknownOutcomeAction },
+            });
+            assertPrivate(refused.body);
+            expect(yield* refreshes).toBe(before + 1);
+            expect((yield* issuer.metrics).resourceRequests.GET).toBe(gets + 1);
+            const next = yield* read(appId);
+            expect(next.status, JSON.stringify(next.body)).toBe(200);
+            expect(yield* body(Read, next)).toEqual({ service: presented(before + 1) });
+            expect(yield* refreshes).toBe(before + 1);
+            expect((yield* issuer.metrics).resourceRequests.GET).toBe(gets + 2);
+          });
+
+        // Nobody has listed the app's tools yet.
+        const session = yield* connect("Synthetic unlisted account");
+        yield* refusedOnce(app.id, session);
+
+        // The same app built on `apps` beta.95, from before `kindConfirmed`: its kept listing names
+        // `read` a query, but nothing confirms it.
+        const legacy = yield* deploy(`${name} beta.95`, ["service"], {
+          path: "package.json",
+          content: JSON.stringify({ dependencies: { apps: "0.0.1-beta.95" } }),
+        });
+        const legacySession = yield* connect("Synthetic beta.95 account", legacy.id);
+        yield* list(legacy.id);
+        yield* refusedOnce(legacy.id, legacySession);
+
+        // Built on the current release and listed, the app confirms `read`, so the refused call
+        // is repeated with the renewed token and succeeds.
+        yield* list();
+        yield* issuer.expireAccessTokens;
+        const before = yield* refreshes;
+        const gets = (yield* issuer.metrics).resourceRequests.GET;
+        const repeated = yield* read();
+        expect(repeated.status, JSON.stringify(repeated.body)).toBe(200);
+        expect(yield* body(Read, repeated)).toEqual({ service: presented(before + 1) });
+        expect((yield* issuer.metrics).resourceRequests.GET).toBe(gets + 2);
+      }),
+    ),
+  );
   it.effect(scenarios.oauthRenewalFailedAfterWrite.title, (context) =>
     withHostedCase(
       context,
       Effect.gen(function* () {
-        const { api, actors, issuer, prefix, name, connect, refreshes, assertPrivate } =
+        const { api, actors, issuer, prefix, name, connect, list, refreshes, assertPrivate } =
           yield* renewalFixture;
         const records = yield* recordingService;
         // `save` hands a record to a service that saves it later, then presents the account's
@@ -719,6 +907,8 @@ export default defineApp({ user: { accounts: { service } } }, async ({ user: { a
         // token endpoint is down when it does.
         yield* issuer.configure({ expiresIn: null });
         const session = yield* connect("Synthetic records account", app.id);
+        // The kept listing confirms that `check` and `records` only read.
+        yield* list(app.id);
         yield* issuer.expireAccessTokens;
         yield* issuer.configure({ tokenError: refreshFailures.unavailable });
 
diff --git a/e2e/tests/oauth-resource-indicator.spec.ts b/e2e/tests/oauth-resource-indicator.spec.ts
new file mode 100644
index 0000000000..396a179c1e
--- /dev/null
+++ b/e2e/tests/oauth-resource-indicator.spec.ts
@@ -0,0 +1,578 @@
+/**
+ * Executor sends one RFC 8707 resource indicator on a sign-in's authorization request, its code
+ * exchange and every renewal: the provider's declared `resource`, the one the service's
+ * protected-resource metadata names, or the operator client's own. The setup check reports which
+ * one and where it came from, or why none is sent. A refused indicator, or its absence, fails
+ * sign-in naming that and sends recovery to whoever can change it; a declared one replaces it
+ * everywhere. Only a refusal is: a 429 or an outage keeps its own failure.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/http";
+import { randomUUID } from "node:crypto";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { Browser } from "../support/browser.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { connectionsPath } from "../support/app-accounts.ts";
+import { oauthInteropIssuer } from "../support/oauth-interop-issuer.ts";
+import { serverControl } from "../support/server-control.ts";
+import {
+  resourceIndicatorIssuer,
+  unknownResourceDescription,
+} from "../support/resource-indicator-issuer.ts";
+import { scenarios } from "../test-plan.ts";
+
+const App = Schema.Struct({
+  id: Schema.String,
+  requirements: Schema.Struct({
+    accounts: Schema.Record(Schema.String, Schema.Struct({ provider: Schema.String })),
+  }),
+});
+const Resource = Schema.Struct({ id: Schema.String });
+const SignIn = Schema.Struct({ authorizationUrl: Schema.String });
+const Indicator = Schema.Struct({ value: Schema.NullOr(Schema.String), source: Schema.String });
+const Setup = Schema.Struct({
+  scopes: Schema.Array(Schema.String),
+  resource: Indicator,
+});
+const Failure = Schema.Struct({
+  _tag: Schema.String,
+  reason: Schema.String,
+  message: Schema.String,
+  cause: Schema.optional(
+    Schema.Struct({ stage: Schema.String, status: Schema.optional(Schema.Number) }),
+  ),
+  retryAfter: Schema.optional(Schema.String),
+  recovery: Schema.Struct({ action: Schema.String, instructions: Schema.String }),
+  resource: Schema.optional(Indicator),
+  serviceError: Schema.optional(
+    Schema.Struct({ error: Schema.String, description: Schema.optional(Schema.String) }),
+  ),
+});
+const Health = Schema.Struct({
+  apps: Schema.Array(
+    Schema.Struct({
+      app: Schema.String,
+      check: Schema.NullOr(Schema.Struct({ status: Schema.String })),
+    }),
+  ),
+});
+
+/** The app's own settings can change what its sign-in sends. */
+const appRecovery = "Set the resource the service documents in the app’s OAuth settings.";
+/** The operator's client is the instance's, so its administrator can change what it sends. */
+const administratorRecovery =
+  "Ask the instance administrator to check the OAuth client’s resource.";
+
+/**
+ * The operator's OAuth client for the service, with its own resource or none. An E2E host adds it
+ * to the reviewed clients from `EXECUTOR_TEST_OAUTH_CLIENT_DEFINITIONS`.
+ */
+const operatorSettings = (origin: string, resource: string | undefined) => ({
+  EXECUTOR_TEST_OAUTH_CLIENT_DEFINITIONS: JSON.stringify([
+    {
+      id: "synthetic-mail",
+      label: "Executor for the resource service",
+      server: {
+        issuer: origin,
+        authorizationUrl: `${origin}/authorize`,
+        tokenUrl: `${origin}/token`,
+        ...(resource === undefined ? {} : { resource }),
+      },
+      tokenEndpointAuthMethod: "client_secret_basic",
+      defaultScopes: ["read"],
+      allowedScopes: ["read"],
+      placement: { hosts: [new URL(origin).host] },
+    },
+  ]),
+  EXECUTOR_OAUTH_SYNTHETIC_MAIL_CLIENT_ID: "first-party-client",
+  EXECUTOR_OAUTH_SYNTHETIC_MAIL_CLIENT_SECRET: "first-party-secret",
+});
+const noOperatorClients = {
+  EXECUTOR_TEST_OAUTH_CLIENT_DEFINITIONS: "",
+  EXECUTOR_OAUTH_SYNTHETIC_MAIL_CLIENT_ID: "",
+  EXECUTOR_OAUTH_SYNTHETIC_MAIL_CLIENT_SECRET: "",
+};
+/** Restart the product with the operator's client settings changed to `settings`. */
+const restartWith = (settings: Readonly<Record<string, string>>) =>
+  Effect.gen(function* () {
+    yield* serverControl("stop");
+    yield* serverControl("environment", 200, settings);
+    yield* serverControl("start");
+  });
+
+/** An app whose one OAuth account reads the service's API, and whose check does the same read. */
+const source = (
+  config: object,
+  api: string,
+) => `import { ProviderError, defineApp, defineProvider, oauth2, object, query, router } from "apps";
+const api = ${JSON.stringify(api)};
+const headers = (account) => ({ authorization: "Bearer " + account.fields.access_token });
+const service = defineProvider({
+  name: "Resource service",
+  auth: { oauth: oauth2(${JSON.stringify(config)}) },
+  async health({ account, fetch, signal }) {
+    const response = await fetch(api, { signal, headers: headers(account) });
+    if (response.status === 401) throw new ProviderError({ reason: "unauthorized", status: 401 });
+    return {};
+  },
+});
+export default defineApp({ user: { accounts: { service } } }, async ({ user: { accounts } }) => ({
+  tools: router({
+    read: query({ input: object({}) }, async ({ fetch }) => {
+      const response = await fetch(api, { headers: headers(accounts.service) });
+      return { status: response.status };
+    }),
+  }),
+}));
+`;
+
+const resourceApp = Effect.gen(function* () {
+  const api = yield* Api,
+    actors = yield* Actors,
+    http = yield* HttpClient.HttpClient;
+  const prefix = `/api/organizations/${actors.organization.id}`;
+  const deploy = (config: object, apiUrl: string) =>
+    Effect.gen(function* () {
+      const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+        name: `Resource indicator ${randomUUID().slice(0, 8)}`,
+        files: [{ path: "index.ts", content: source(config, apiUrl) }, appsManifest],
+      });
+      expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+      const app = yield* body(App, deployed);
+      yield* Effect.addFinalizer(() =>
+        api.request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`).pipe(Effect.orDie),
+      );
+      const provider = app.requirements.accounts["service"]?.provider;
+      if (provider === undefined) return yield* Effect.die("The app declares no account");
+      return { app: app.id, provider };
+    });
+  /** What account setup reports it will send, before any sign-in. */
+  const setup = (provider: string) =>
+    Effect.gen(function* () {
+      const response = yield* api.request(
+        actors.owner,
+        "GET",
+        `${prefix}/providers/${provider}/oauth/oauth/setup`,
+      );
+      expect(response.status, JSON.stringify(response.body)).toBe(200);
+      return yield* body(Setup, response);
+    });
+  /** Start a sign-in, consent at the service and complete it with the callback it returns. */
+  const connect = (app: string) =>
+    Effect.gen(function* () {
+      const connection = yield* body(
+        Resource,
+        yield* api.request(
+          actors.owner,
+          "POST",
+          connectionsPath(`${prefix}/apps/${app}`, "user", "service"),
+          {},
+        ),
+      );
+      const started = yield* api.request(
+        actors.owner,
+        "POST",
+        `${prefix}/connections/${connection.id}/oauth/start`,
+        { method: "oauth", label: "Resource account" },
+      );
+      expect(started.status, JSON.stringify(started.body)).toBe(200);
+      const authorizationUrl = new URL((yield* body(SignIn, started)).authorizationUrl);
+      const callbackUrl = yield* Effect.scoped(
+        Effect.gen(function* () {
+          const response = yield* HttpClient.withScope(http).get(authorizationUrl.href);
+          expect(response.status).toBe(302);
+          const location = response.headers.location;
+          if (location === undefined) return yield* Effect.die("Service did not return a callback");
+          return location;
+        }),
+      ).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }));
+      const completed = yield* api.request(
+        actors.owner,
+        "POST",
+        `${prefix}/connections/${connection.id}/oauth/complete`,
+        { callbackUrl },
+      );
+      if (completed.status === 200) {
+        const account = yield* body(Resource, completed);
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "DELETE", `${prefix}/accounts/${account.id}`)
+            .pipe(Effect.orDie),
+        );
+      }
+      return { authorizationUrl, completed };
+    });
+  const check = (account: string, app: string) =>
+    Effect.gen(function* () {
+      const response = yield* api.request(
+        actors.owner,
+        "POST",
+        `${prefix}/accounts/${account}/health`,
+        { apps: [app] },
+      );
+      expect(response.status, JSON.stringify(response.body)).toBe(200);
+      return (yield* body(Health, response)).apps.find((entry) => entry.app === app)?.check;
+    });
+  const read = (app: string) =>
+    api.request(actors.owner, "POST", `${prefix}/apps/${app}/tools/call`, {
+      tool: "read",
+      kind: "query",
+      input: {},
+    });
+  return { deploy, setup, connect, check, read };
+});
+
+layer(HostedLive, { excludeTestServices: true })("OAuth resource indicators", (it) => {
+  it.effect(scenarios.oauthResourceRefused.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const app = yield* resourceApp;
+        const service = yield* resourceIndicatorIssuer("refuses-unknown");
+
+        // The service's metadata names its origin, so setup reports that it will send it.
+        const discovered = yield* app.deploy({ discover: service.origin }, service.apiResource);
+        expect((yield* app.setup(discovered.provider)).resource).toEqual({
+          value: service.origin,
+          source: "metadata",
+        });
+
+        // Its token endpoint does not know that resource. The failure names what was sent, where
+        // it came from, and that declaring the same value would send the same request.
+        const refused = yield* app.connect(discovered.app);
+        expect(refused.authorizationUrl.searchParams.get("resource")).toBe(service.origin);
+        expect(refused.completed.status, JSON.stringify(refused.completed.body)).toBe(400);
+        const failure = yield* body(Failure, refused.completed);
+        expect(failure).toMatchObject({
+          _tag: "OAuthCompletionFailed",
+          reason: "resource_rejected",
+          resource: { value: service.origin, source: "metadata" },
+          serviceError: { error: "invalid_target", description: unknownResourceDescription },
+        });
+        expect(failure.message).toContain("resource");
+        expect(failure.recovery.instructions).toContain(service.origin);
+        expect(failure.recovery.instructions).toContain("protected-resource metadata");
+        expect(failure.recovery.instructions).toContain("resource: null");
+        // The previous copy pointed at the client and the callback instead.
+        expect(failure.recovery.instructions).not.toContain("callback configuration");
+
+        // A provider that declares the same value sends the same request, and is told so.
+        const same = yield* app.deploy(
+          { discover: service.origin, resource: service.origin },
+          service.apiResource,
+        );
+        expect((yield* app.setup(same.provider)).resource).toEqual({
+          value: service.origin,
+          source: "declared",
+        });
+        const again = yield* body(Failure, (yield* app.connect(same.app)).completed);
+        expect(again).toMatchObject({
+          reason: "resource_rejected",
+          resource: { value: service.origin, source: "declared" },
+        });
+
+        // Declaring the resource the service serves replaces the discovered one everywhere.
+        const declared = yield* app.deploy(
+          { discover: service.origin, resource: service.apiResource },
+          service.apiResource,
+        );
+        const signIn = yield* app.connect(declared.app);
+        expect(signIn.completed.status, JSON.stringify(signIn.completed.body)).toBe(200);
+        expect(signIn.authorizationUrl.searchParams.get("resource")).toBe(service.apiResource);
+        const read = yield* app.read(declared.app);
+        expect(read.status, JSON.stringify(read.body)).toBe(200);
+        expect(read.body).toMatchObject({ status: 200 });
+        expect((yield* service.metrics).tokenRequests).toEqual([
+          { grant: "authorization_code", resource: service.origin, issued: false },
+          { grant: "authorization_code", resource: service.origin, issued: false },
+          { grant: "authorization_code", resource: service.apiResource, issued: true },
+        ]);
+      }),
+    ),
+  );
+
+  it.effect(scenarios.oauthResourceAudience.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const app = yield* resourceApp;
+        const service = yield* resourceIndicatorIssuer("binds-audience");
+
+        // Sign-in completes with the resource the metadata names, but the API refuses the token.
+        const discovered = yield* app.deploy({ discover: service.origin }, service.apiResource);
+        const signIn = yield* app.connect(discovered.app);
+        expect(signIn.completed.status, JSON.stringify(signIn.completed.body)).toBe(200);
+        const account = (yield* body(Resource, signIn.completed)).id;
+        expect((yield* app.check(account, discovered.app))?.status).toBe("credentials_rejected");
+        // The dashboard says the credentials don't work, not that sign-in was rejected: the
+        // sign-in completed. The same status also covers a sign-in that expired before any
+        // request, so the label does not say the service refused them.
+        const actors = yield* Actors,
+          browser = yield* Browser;
+        yield* browser.login(actors.owner);
+        yield* browser.use("Open the account the service refused", (page) =>
+          page
+            .goto(`/org/${actors.organization.slug}/accounts`)
+            .then(() => page.getByRole("button", { name: "Manage Resource account" }).click())
+            .then(() => page.getByRole("menuitem", { name: "Check health" }).click()),
+        );
+        expect(
+          yield* browser.use("The check says the credentials don't work", (page) =>
+            page
+              .getByRole("dialog")
+              .locator('[data-check-status="credentials_rejected"][data-check-current="true"]')
+              .first()
+              .innerText(),
+          ),
+        ).toBe("Credentials not working");
+        yield* browser.checkpoint("Credentials not working after a completed sign-in");
+        yield* browser.use("Close the account's health", (page) =>
+          page.getByRole("button", { name: "Close", exact: true }).first().click(),
+        );
+        // The refusal renews the grant once, with the same resource, and the API refuses that too.
+        const metrics = yield* service.metrics;
+        expect(metrics.tokenRequests).toEqual([
+          { grant: "authorization_code", resource: service.origin, issued: true },
+          { grant: "refresh_token", resource: service.origin, issued: true },
+        ]);
+        expect(new Set(metrics.apiRequests.map((request) => request.audience))).toEqual(
+          new Set([service.origin]),
+        );
+        // Setup reports the resource the token was issued for, which the agent can compare with
+        // the API's own identifier.
+        expect((yield* app.setup(discovered.provider)).resource).toEqual({
+          value: service.origin,
+          source: "metadata",
+        });
+
+        // With the API's resource declared, the token it issues is accepted.
+        const declared = yield* app.deploy(
+          { discover: service.origin, resource: service.apiResource },
+          service.apiResource,
+        );
+        const fixed = yield* app.connect(declared.app);
+        expect(fixed.completed.status, JSON.stringify(fixed.completed.body)).toBe(200);
+        const fixedAccount = (yield* body(Resource, fixed.completed)).id;
+        expect((yield* app.check(fixedAccount, declared.app))?.status).toBe("healthy");
+      }),
+    ),
+  );
+  it.effect(scenarios.oauthResourceOmitted.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const app = yield* resourceApp;
+
+        // `resource: null` sends none although the service's metadata names one. Its refusal says
+        // the provider declared none, not that nothing names one.
+        const service = yield* resourceIndicatorIssuer("refuses-unknown");
+        const declaredNone = yield* app.deploy(
+          { discover: service.origin, resource: null },
+          service.apiResource,
+        );
+        expect((yield* app.setup(declaredNone.provider)).resource).toEqual({
+          value: null,
+          source: "declared",
+        });
+        const refused = yield* app.connect(declaredNone.app);
+        expect(refused.authorizationUrl.searchParams.has("resource")).toBe(false);
+        expect(refused.completed.status, JSON.stringify(refused.completed.body)).toBe(400);
+        const failure = yield* body(Failure, refused.completed);
+        expect(failure).toMatchObject({
+          _tag: "OAuthCompletionFailed",
+          reason: "resource_rejected",
+          cause: { stage: "exchange", status: 400 },
+          resource: { value: null, source: "declared" },
+          serviceError: { error: "invalid_target", description: unknownResourceDescription },
+        });
+        expect(failure.message).toContain("This sign-in sent none");
+        expect(failure.recovery.action).toBe(appRecovery);
+        expect(failure.recovery.instructions).toContain("declares `resource: null`");
+        expect(failure.recovery.instructions).not.toContain("declares no `resource`");
+        expect(failure.recovery.instructions).not.toContain(service.origin);
+        expect((yield* service.metrics).tokenRequests).toEqual([
+          { grant: "authorization_code", resource: null, issued: false },
+        ]);
+
+        // A service that publishes no protected-resource metadata, for a provider that declares
+        // no resource: nothing names one.
+        const unnamed = yield* resourceIndicatorIssuer("refuses-unknown", { metadata: false });
+        const undeclared = yield* app.deploy({ discover: unnamed.origin }, unnamed.apiResource);
+        expect((yield* app.setup(undeclared.provider)).resource).toEqual({
+          value: null,
+          source: "none",
+        });
+        const none = yield* body(Failure, (yield* app.connect(undeclared.app)).completed);
+        expect(none).toMatchObject({
+          reason: "resource_rejected",
+          resource: { value: null, source: "none" },
+        });
+        expect(none.recovery.action).toBe(appRecovery);
+        expect(none.recovery.instructions).toContain(
+          "the provider declares no `resource`, and no protected-resource metadata it discovers from names one",
+        );
+
+        // Microsoft's authorization server takes the audience from the scopes, so the resource
+        // its metadata names is not sent, and setup says that Executor inferred why.
+        const entra = yield* oauthInteropIssuer("entra-tenant");
+        const scoped = yield* app.deploy(
+          { discover: `${entra.origin}/mcp` },
+          `${entra.origin}/mcp`,
+        );
+        expect((yield* app.setup(scoped.provider)).resource).toEqual({
+          value: null,
+          source: "inferred_scope_audience",
+        });
+
+        // Any service can publish that metadata. One that still requires its resource refuses the
+        // sign-in, which then reports the omission as Executor's inference, not the server's
+        // behavior, and points at declaring the resource.
+        const claims = yield* resourceIndicatorIssuer("refuses-unknown", {
+          scopeAudienceClaim: true,
+        });
+        const inferred = yield* app.deploy({ discover: claims.origin }, claims.apiResource);
+        expect((yield* app.setup(inferred.provider)).resource).toEqual({
+          value: null,
+          source: "inferred_scope_audience",
+        });
+        const withheld = yield* app.connect(inferred.app);
+        expect(withheld.authorizationUrl.searchParams.has("resource")).toBe(false);
+        expect(withheld.completed.status, JSON.stringify(withheld.completed.body)).toBe(400);
+        const guessed = yield* body(Failure, withheld.completed);
+        expect(guessed).toMatchObject({
+          _tag: "OAuthCompletionFailed",
+          reason: "resource_rejected",
+          cause: { stage: "exchange", status: 400 },
+          resource: { value: null, source: "inferred_scope_audience" },
+          serviceError: { error: "invalid_target", description: unknownResourceDescription },
+        });
+        expect(guessed.message).toContain("This sign-in sent none");
+        expect(guessed.recovery.action).toBe(appRecovery);
+        expect(guessed.recovery.instructions).toContain("Executor inferred");
+        expect(guessed.recovery.instructions).toContain("Executor did not verify this");
+        expect(guessed.recovery.instructions).toContain(
+          "declare the identifier the service documents as the provider's `resource`",
+        );
+        // The service's metadata is its own claim, so the copy does not state it as fact.
+        expect(guessed.recovery.instructions).not.toContain("authorization server takes");
+        // The declared resource is sent despite the metadata, and the service issues a token.
+        const declaredApi = yield* app.deploy(
+          { discover: claims.origin, resource: claims.apiResource },
+          claims.apiResource,
+        );
+        expect((yield* app.setup(declaredApi.provider)).resource).toEqual({
+          value: claims.apiResource,
+          source: "declared",
+        });
+        const fixed = yield* app.connect(declaredApi.app);
+        expect(fixed.completed.status, JSON.stringify(fixed.completed.body)).toBe(200);
+        expect(fixed.authorizationUrl.searchParams.get("resource")).toBe(claims.apiResource);
+        expect((yield* claims.metrics).tokenRequests).toEqual([
+          { grant: "authorization_code", resource: null, issued: false },
+          { grant: "authorization_code", resource: claims.apiResource, issued: true },
+        ]);
+      }),
+    ),
+  );
+
+  it.effect(scenarios.oauthResourceOperator.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const app = yield* resourceApp;
+        const service = yield* resourceIndicatorIssuer("refuses-unknown");
+        yield* service.addClient("first-party-client", "first-party-secret");
+        // Whatever happens, the next scenario finds the product without the operator's client.
+        yield* Effect.addFinalizer(() => restartWith(noOperatorClients).pipe(Effect.orDie));
+
+        // The provider declares the resource the service accepts, but the operator's client, which
+        // signs in for it, sends its own. Only the administrator can change that.
+        for (const [operatorResource, expected] of [
+          [service.origin, { value: service.origin, source: "operator" }],
+          [undefined, { value: null, source: "operator" }],
+        ] as const) {
+          yield* restartWith(operatorSettings(service.origin, operatorResource));
+          const declared = yield* app.deploy(
+            { discover: service.origin, resource: service.apiResource },
+            service.apiResource,
+          );
+          expect((yield* app.setup(declared.provider)).resource).toEqual(expected);
+          const refused = yield* app.connect(declared.app);
+          expect(refused.authorizationUrl.searchParams.get("resource")).toBe(expected.value);
+          expect(refused.completed.status, JSON.stringify(refused.completed.body)).toBe(400);
+          const failure = yield* body(Failure, refused.completed);
+          expect(failure).toMatchObject({
+            _tag: "OAuthCompletionFailed",
+            reason: "resource_rejected",
+            resource: expected,
+          });
+          expect(failure.recovery.action).toBe(administratorRecovery);
+          expect(failure.recovery.instructions).toContain(
+            "a provider's `resource` does not apply to that client, so changing the app does not change this request",
+          );
+          expect(failure.recovery.instructions).not.toContain(appRecovery);
+          expect(failure.recovery.instructions).not.toContain("Declare the provider's `resource`");
+        }
+        expect((yield* service.metrics).tokenRequests).toEqual([
+          { grant: "authorization_code", resource: service.origin, issued: false },
+          { grant: "authorization_code", resource: null, issued: false },
+        ]);
+      }),
+    ),
+  );
+
+  it.effect(scenarios.oauthResourceTransient.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const app = yield* resourceApp;
+        const service = yield* resourceIndicatorIssuer("refuses-unknown");
+        const discovered = yield* app.deploy({ discover: service.origin }, service.apiResource);
+
+        // A 429 is the service limiting requests, whatever its body says: the failure keeps the
+        // time its Retry-After names and asks for no configuration change.
+        yield* service.refuseWith({ status: 429, retryAfter: "120" });
+        const limited = yield* app.connect(discovered.app);
+        expect(limited.completed.status, JSON.stringify(limited.completed.body)).toBe(400);
+        const rateLimited = yield* body(Failure, limited.completed);
+        expect(rateLimited).toMatchObject({
+          _tag: "OAuthCompletionFailed",
+          reason: "rate_limited",
+          cause: { stage: "exchange", status: 429 },
+          serviceError: { error: "invalid_target" },
+        });
+        expect(rateLimited.retryAfter).toBeDefined();
+        expect(rateLimited.resource).toBeUndefined();
+        expect(rateLimited.recovery.instructions).toContain("Retry-After");
+
+        // A 503 is an outage, not a refusal of the resource.
+        yield* service.refuseWith({ status: 503 });
+        const unavailable = yield* body(Failure, (yield* app.connect(discovered.app)).completed);
+        expect(unavailable).toMatchObject({
+          reason: "service_unavailable",
+          cause: { stage: "exchange", status: 503 },
+          serviceError: { error: "invalid_target" },
+        });
+        expect(unavailable.retryAfter).toBeUndefined();
+        expect(unavailable.resource).toBeUndefined();
+
+        // The same answer with a 400 is a refusal of the resource the sign-in sent.
+        yield* service.refuseWith({ status: 400 });
+        const refused = yield* body(Failure, (yield* app.connect(discovered.app)).completed);
+        expect(refused).toMatchObject({
+          reason: "resource_rejected",
+          cause: { stage: "exchange", status: 400 },
+          resource: { value: service.origin, source: "metadata" },
+        });
+        expect((yield* service.metrics).tokenRequests).toEqual([
+          { grant: "authorization_code", resource: service.origin, issued: false },
+          { grant: "authorization_code", resource: service.origin, issued: false },
+          { grant: "authorization_code", resource: service.origin, issued: false },
+        ]);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/oauth-token-telemetry.spec.ts b/e2e/tests/oauth-token-telemetry.spec.ts
index 236eff00d4..0e119c06d6 100644
--- a/e2e/tests/oauth-token-telemetry.spec.ts
+++ b/e2e/tests/oauth-token-telemetry.spec.ts
@@ -5,6 +5,8 @@
  * whether refresh-token reuse detection ended a whole grant, how long ago a refused token was
  * replaced, and the family of MCP client the registration names.
  * Authorization and consent spans name that family too, so re-logins can be counted per client.
+ * Registration spans name the family the body declares, the OAuth error a refusal carried and the
+ * rule that refused it, never the description that quotes the client's input.
  */
 import { randomBytes } from "node:crypto";
 import { expect, layer } from "@effect/vitest";
@@ -95,6 +97,50 @@ const register = (client: { readonly name?: string; readonly redirect?: string }
     );
   });
 
+/** A registration under a new trace. Only its status leaves this function; never its body. */
+const registrationRequest = (body: Record<string, unknown>) =>
+  Effect.gen(function* () {
+    const target = yield* Target,
+      http = yield* HttpClient.HttpClient;
+    const origin = target.metadata.origin;
+    const traceId = randomBytes(16).toString("hex");
+    const status = yield* Effect.scoped(
+      Effect.gen(function* () {
+        const request = yield* HttpClientRequest.post(`${origin}/api/auth/oauth2/register`).pipe(
+          HttpClientRequest.setHeaders({
+            origin,
+            traceparent: `00-${traceId}-${randomBytes(8).toString("hex")}-01`,
+          }),
+          HttpClientRequest.bodyJson(body),
+        );
+        const response = yield* http.execute(request);
+        yield* response.text;
+        return response.status;
+      }),
+    ).pipe(Effect.provideService(HttpClient.TracerPropagationEnabled, false));
+    return { traceId, status };
+  });
+
+/** The registration's server span, once the collector has it. */
+const registrationSpan = (traceId: string) =>
+  Effect.flatMap(Telemetry, (telemetry) => telemetry.query(traceId)).pipe(
+    Effect.map((found) =>
+      found.data
+        .map(({ span }) => span)
+        .find(
+          (span) =>
+            span.tags["url.path"] === "/api/auth/oauth2/register" &&
+            span.tags["auth.register.error"] !== undefined,
+        ),
+    ),
+    Effect.flatMap((span) =>
+      span === undefined
+        ? Effect.fail(new Error(`The registration span of trace ${traceId} has not arrived`))
+        : Effect.succeed(span),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("250 millis"), times: 80 }),
+  );
+
 /** Server spans of one operation on one path that name this client family, newest last. */
 const familySpans = (operation: string, path: string, family: string, since: number) =>
   Effect.flatMap(Telemetry, (telemetry) =>
@@ -417,6 +463,103 @@ layer(HostedLive, { excludeTestServices: true })("OAuth token telemetry", (it) =
             "unknown",
           );
 
+        // A refused registration records its OAuth error and the rule that refused it; the
+        // description, which quotes the client's input, stays out of the span.
+        const grants = {
+          token_endpoint_auth_method: "none",
+          grant_types: ["authorization_code", "refresh_token"],
+          response_types: ["code"],
+        };
+        const registrationCases = [
+          {
+            // A private-use callback without `application_type` registers as a web client.
+            body: {
+              ...grants,
+              client_name: "Cursor",
+              redirect_uris: ["cursor://anysphere.cursor-retrieval/oauth/callback"],
+            },
+            expected: {
+              status: 400,
+              error: "invalid_redirect_uri",
+              rejection: "redirect_uri_web_requires_https",
+              family: "cursor",
+            },
+          },
+          {
+            // The schema refuses a callback that is not a URL before any rule runs.
+            body: { ...grants, client_name: "Cursor", redirect_uris: [`cursor://${grantMarker}`] },
+            expected: {
+              status: 400,
+              error: "invalid_redirect_uri",
+              rejection: "redirect_uris",
+              family: "cursor",
+            },
+          },
+          {
+            body: {
+              ...grants,
+              client_name: "Codex",
+              redirect_uris: [loopback],
+              token_endpoint_auth_method: "tls_client_auth",
+            },
+            expected: {
+              status: 400,
+              error: "invalid_client_metadata",
+              rejection: "token_endpoint_auth_method",
+              family: "codex",
+            },
+          },
+          {
+            body: {
+              ...grants,
+              client_name: "Codex",
+              redirect_uris: [loopback],
+              scope: grantMarker,
+            },
+            expected: {
+              status: 400,
+              error: "invalid_scope",
+              rejection: "scope",
+              family: "codex",
+            },
+          },
+          {
+            // The schema refuses the field before any rule runs; a malformed name names no client.
+            body: { ...grants, client_name: 42, redirect_uris: [loopback] },
+            expected: {
+              status: 400,
+              error: "invalid_client_metadata",
+              rejection: "client_name",
+              family: "unknown",
+            },
+          },
+          {
+            body: { ...grants, client_name: clientName, redirect_uris: [loopback] },
+            expected: { status: 201, error: "none", rejection: "none", family: "claude-code" },
+          },
+        ];
+        const registered = yield* Effect.forEach(registrationCases, ({ body }) =>
+          registrationRequest(body),
+        );
+        expect(registered.map(({ status }) => status)).toEqual(
+          registrationCases.map(({ expected }) => expected.status),
+        );
+        const registrationSpans = yield* Effect.forEach(registered, ({ traceId }) =>
+          registrationSpan(traceId),
+        );
+        expect(
+          registrationSpans.map((span) => ({
+            status: Number(span.tags["http.response.status_code"]),
+            error: span.tags["auth.register.error"],
+            rejection: span.tags["auth.register.rejection"],
+            family: span.tags["auth.token.client_family"],
+          })),
+        ).toEqual(registrationCases.map(({ expected }) => expected));
+        const registrationText = JSON.stringify(registrationSpans);
+        expect([grantMarker, clientName].some((value) => registrationText.includes(value))).toBe(
+          false,
+        );
+
         // Each answer is the client's to act on: none is reported as an Executor failure.
         yield* Effect.sleep("2 seconds");
         const traces = new Set(
@@ -431,6 +574,7 @@ layer(HostedLive, { excludeTestServices: true })("OAuth token telemetry", (it) =
             lastUnsupported,
             padded,
             uppercase,
+            ...registered,
           ].map(({ traceId }) => traceId),
         );
         const reported = (yield* sentryExceptions).filter(
diff --git a/e2e/tests/observability-outcomes.spec.ts b/e2e/tests/observability-outcomes.spec.ts
index 8f23b8ca1d..3740d54412 100644
--- a/e2e/tests/observability-outcomes.spec.ts
+++ b/e2e/tests/observability-outcomes.spec.ts
@@ -38,6 +38,10 @@ layer(HostedLive, { excludeTestServices: true })("Observability outcomes", (it)
           target = yield* Target,
           fs = yield* FileSystem.FileSystem;
         expect(target.metadata.mode).toBe("managed");
+        const cloud = target.metadata.target === "cloud";
+        // Each runtime operation's span names the app it ran and, on Cloud, the organization of
+        // a signed-in caller, so one app's or organization's failures can be told apart.
+        const runtime = cloud ? "runtime.cloud" : "runtime.workerd";
         const upstream = yield* mcpOutcomeFixture;
         const prefix = `/api/organizations/${actors.organization.id}`;
         const response = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
@@ -111,6 +115,18 @@ export default defineApp({}, async () => {
           expect(
             trace.data.find(({ span }) => span.operationName === "sdk.tools.call")?.span.status,
           ).toBe(failed ? "error" : "ok");
+          const tenant = {
+            "executor.app.id": app.id,
+            ...(cloud ? { "executor.organization.id": actors.organization.id } : {}),
+          };
+          expect(
+            trace.data.find(({ span }) => span.operationName === `${runtime}.call`)?.span.tags,
+          ).toMatchObject(tenant);
+          if (cloud)
+            expect(
+              trace.data.find(({ span }) => span.operationName === "runtime.app.remote.invoke")
+                ?.span.tags,
+            ).toMatchObject(tenant);
           yield* evidence.json(`${tool}-trace.json`, trace);
           if (target.metadata.target === "cloud") {
             const events = yield* fs.readFileString(`${target.directory}/analytics.ndjson`).pipe(
diff --git a/e2e/tests/openapi-errors.spec.ts b/e2e/tests/openapi-errors.spec.ts
index 2b222bcd3e..291095bffa 100644
--- a/e2e/tests/openapi-errors.spec.ts
+++ b/e2e/tests/openapi-errors.spec.ts
@@ -1,5 +1,5 @@
 import { expect, layer } from "@effect/vitest";
-import { Effect, Layer, Redacted, Schema } from "effect";
+import { Clock, Effect, Layer, Redacted, Schema } from "effect";
 import { openapiAppFiles } from "../support/authored-templates.ts";
 import { scenarios } from "../test-plan.ts";
 import { Actors } from "../support/actors.ts";
@@ -17,6 +17,8 @@ import {
   openapiMemoryRecovery,
   openapiConflictRecovery,
   openapiDeniedMessage,
+  openapiSessionMessage,
+  openapiChallengeMessage,
   openapiOAuthMessage,
   openapiConflictMessage,
   openapiRetryRecovery,
@@ -28,6 +30,7 @@ import {
   unknownOutcomeAction,
   unknownOutcomeRecovery,
 } from "../support/write-outcome.ts";
+import { siteless } from "../support/failure-site.ts";
 
 const Recovery = Schema.Struct({ action: Schema.String, instructions: Schema.String });
 const Failure = Schema.Struct({
@@ -159,7 +162,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         expect(error.response?.status).toBe(422);
         expect(error.response?.message).toBe(openapiMemoryMessage);
         expect(error.response?.recovery).toEqual(openapiMemoryRecovery);
-        expect(error.message).toBe(
+        expect(siteless(error.message)).toBe(
           `BuildMemoryExceeded (HTTP 422): ${openapiMemoryMessage} Recovery: ${openapiMemoryRecovery.action} Retryable (unchanged call): no.`,
         );
         // A declared 4xx error is not one a repeat of the same call can fix.
@@ -199,11 +202,17 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
           .execution.error;
         expect(extrasError.response?.recovery).toEqual(declaredRecovery("Conflict", 422));
         const conflict = yield* invoke("conflict-recovery");
+        const conflictError = (yield* Schema.decodeUnknownEffect(Failure)(
+          conflict.structuredContent,
+        )).execution.error;
+        expect(siteless(conflictError.message)).toBe(
+          `Conflict (HTTP 422): Read the current revision before saving again. Recovery: ${openapiConflictRecovery.action} Retryable (unchanged call): no.`,
+        );
+        expect(conflictError.message).toMatch(/ Phase: call\. Reference: [0-9a-f]{32}\.$/u);
         expect(conflict.structuredContent).toMatchObject({
           execution: {
             ok: false,
             error: {
-              message: `Conflict (HTTP 422): Read the current revision before saving again. Recovery: ${openapiConflictRecovery.action} Retryable (unchanged call): no.`,
               response: {
                 code: "Conflict",
                 status: 422,
@@ -219,7 +228,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         const deniedError = (yield* Schema.decodeUnknownEffect(Failure)(
           denied403.structuredContent,
         )).execution.error;
-        expect(deniedError.message).toBe(
+        expect(siteless(deniedError.message)).toBe(
           `ExportDenied (HTTP 403): ${openapiDeniedMessage} Recovery: ${declaredRecovery("ExportDenied", 403).action} Retryable (unchanged call): no.`,
         );
         expect(deniedError.response).toEqual({
@@ -236,6 +245,28 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         )).execution.error;
         expect(limited403.response).toMatchObject({ code: "AppProviderFailed", status: 502 });
         expect(limited403.message).toContain("limiting requests");
+        // A declared 401 keeps the credential refusal and quotes the service's own explanation.
+        const session401 = (yield* Schema.decodeUnknownEffect(Failure)(
+          (yield* invoke("declared-unauthorized")).structuredContent,
+        )).execution.error;
+        expect(session401.response).toMatchObject({ code: "AppProviderFailed", status: 502 });
+        expect(session401.response?.message).toContain(
+          `The service reported SessionExpired: ${JSON.stringify(openapiSessionMessage)}.`,
+        );
+        // A Bearer challenge's error takes precedence, so the declared body is not read: a body
+        // that never finishes does not hold the failure for the 2-second error-body read bound.
+        const challengedAt = yield* Clock.currentTimeMillis;
+        const challenged = yield* invoke("challenged-stalled");
+        const challengedMs = (yield* Clock.currentTimeMillis) - challengedAt;
+        yield* evidence.json("openapi-challenged-stalled-401.json", { challengedMs, challenged });
+        const challenged401 = (yield* Schema.decodeUnknownEffect(Failure)(
+          challenged.structuredContent,
+        )).execution.error;
+        expect(challenged401.response).toMatchObject({ code: "AppProviderFailed", status: 502 });
+        expect(challenged401.response?.message).toContain(
+          `invalid_token: ${JSON.stringify(openapiChallengeMessage)}.`,
+        );
+        expect(challengedMs).toBeLessThan(2_000);
         // Input validation names the failing field and expected type without echoing the value.
         const invalidInput = yield* client.use(
           "Call the OpenAPI tool with invalid input",
@@ -255,7 +286,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         const inputError = (yield* Schema.decodeUnknownEffect(Failure)(
           invalidInput.structuredContent,
         )).execution.error;
-        expect(inputError.message).toBe(
+        expect(siteless(inputError.message)).toBe(
           "InputInvalid (HTTP 422): Input failed validation: input.query.mode: Expected string Recovery: Change the input to the shape each problem expects, then call the tool again. Retryable (unchanged call): no.",
         );
         expect(inputError.response).toMatchObject({ code: "InputInvalid", status: 422 });
@@ -284,7 +315,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         )).execution.error;
         // The generated tool is a mutation, and the app's code refused the input after it received
         // the call, so the refusal leads with the instruction not to repeat the call.
-        expect(bodyError.message).toBe(
+        expect(siteless(bodyError.message)).toBe(
           `InputInvalid (HTTP 422): Input failed validation: input: Expected object {path, cookie?, body, contentType?} or object {path, cookie?, body, contentType}, told apart by contentType. Closest is alternative 1, whose problems follow; input.body.ids: Expected array Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(JSON.stringify(invalidBody)).not.toContain(openapiSecretMarker);
@@ -308,7 +339,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         yield* evidence.json("mcp-discriminated-body-invalid.json", invalidPet);
         const petError = (yield* Schema.decodeUnknownEffect(Failure)(invalidPet.structuredContent))
           .execution.error;
-        expect(petError.message).toBe(
+        expect(siteless(petError.message)).toBe(
           `InputInvalid (HTTP 422): Input failed validation: input.body: Expected object {petType, meow, ...} or object {petType, bark, ...}, told apart by petType. Closest is alternative 2, whose problems follow; input.body.bark: Missing key. Expected boolean Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(petError.message.toLowerCase()).not.toContain("dog");
@@ -433,7 +464,9 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
                 ),
               },
             });
-            expect(failure.message).toMatch(/ Retryable \(unchanged call\): yes\.$/);
+            expect(failure.message).toMatch(
+              / Retryable \(unchanged call\): yes\. Phase: [a-z]+\. Reference: [0-9a-f]{32}\.$/,
+            );
             yield* evidence.json("mcp-provider-bad-gateway.json", result);
             continue;
           }
@@ -520,8 +553,10 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
         );
         yield* evidence.json("openapi-undeclared-404.json", missing);
         expect(
-          (yield* Schema.decodeUnknownEffect(Failure)(missing.structuredContent)).execution.error
-            .message,
+          siteless(
+            (yield* Schema.decodeUnknownEffect(Failure)(missing.structuredContent)).execution.error
+              .message,
+          ),
         ).toBe(
           `ToolCallFailed (HTTP 502): The app's API call failed: GET /items/{item} responded with HTTP 404 (text/plain, ${openapiSecretMarker.length} bytes), which matches no error with a message in the API's OpenAPI document. Recovery: Read the reported error and check the corresponding request or configuration. Retryable (unchanged call): no.`,
         );
@@ -558,7 +593,7 @@ layer(HostedLive, { excludeTestServices: true })("OpenAPI errors", (it) => {
           write.response?.recovery,
           "For a call that only reads, the advice for this failure is: “Wait at least 30 seconds before trying again, at most twice.",
         );
-        expect(write.message).toBe(
+        expect(siteless(write.message)).toBe(
           `AppProviderFailed (HTTP 502): ${write.response?.message} Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         expect(JSON.stringify(created)).not.toContain(openapiSecretMarker);
@@ -745,7 +780,7 @@ export default defineApp({}, async () => {
             declaredAdvice(`${openapiRetryRecovery.action} ${openapiRetryRecovery.instructions}`),
           ),
         );
-        expect(conflict.message).toBe(
+        expect(siteless(conflict.message)).toBe(
           `StoreConflict (HTTP 409): ${openapiConflictMessage} Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
         // A program can read the same from a caught error.
@@ -775,7 +810,7 @@ export default defineApp({}, async () => {
           invalid.response?.recovery,
           "An API the app calls returned an error its OpenAPI document declares (InvalidRecord, HTTP 422).",
         );
-        expect(invalid.message).toBe(
+        expect(siteless(invalid.message)).toBe(
           `InvalidRecord (HTTP 422): Record names must not be empty. Recovery: ${unknownOutcomeAction} Retryable (unchanged call): no.`,
         );
 
diff --git a/e2e/tests/organization-request-spans.spec.ts b/e2e/tests/organization-request-spans.spec.ts
new file mode 100644
index 0000000000..d976df8991
--- /dev/null
+++ b/e2e/tests/organization-request-spans.spec.ts
@@ -0,0 +1,301 @@
+/**
+ * The hosted management API's request span names the organization it serves and the caller by
+ * their opaque IDs, so one organization's failures can be told apart from another's and the users
+ * they reach counted. A route names its organization by slug or ID, and any signed-in caller can
+ * send one, so the span names both only once the organization is the caller's own: a signed-in
+ * session's once its membership there holds, a bearer's once its check authorized it. A request
+ * refused after that, such as for an icon the organization does not have, keeps both. A request
+ * refused for an organization the caller never joined (only Cloud lets a user hold several) or one
+ * it left names neither, so it cannot count against that organization or among its users. A
+ * batched dashboard read's span (`dashboard.batch.read`) follows the same rule, and so does a
+ * bearer's check (`auth.authenticate`), which names only its own organization and user.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Redacted, Schedule, Schema } from "effect";
+import { randomBytes, randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body, type Session } from "../support/api.ts";
+import { Browser } from "../support/browser.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { Organization, type SpanQuery } from "../support/contracts.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { McpOAuth } from "../support/mcp-oauth.ts";
+import { Target } from "../support/platform.ts";
+
+type Span = (typeof SpanQuery.Type)["data"][number]["span"];
+
+const Key = Schema.Struct({ id: Schema.String, key: Schema.RedactedFromValue(Schema.String) });
+const SessionIdentity = Schema.Struct({
+  user: Schema.Struct({ id: Schema.String, email: Schema.String }),
+});
+const BatchAnswer = Schema.Struct({ id: Schema.Number, status: Schema.Number });
+const organizationId = "executor.organization.id";
+const userId = "executor.user.id";
+const accessRoute = "/api/organizations/:organization/access";
+const iconRoute = "/api/organizations/:organization/icons/:key";
+
+layer(HostedLive, { excludeTestServices: true })("Organization request spans", (it) => {
+  it.effect(
+    scenarios.organizationRequestSpans.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors,
+            browser = yield* Browser,
+            evidence = yield* Evidence,
+            oauth = yield* McpOAuth,
+            telemetry = yield* Telemetry,
+            target = yield* Target;
+          const organization = actors.organization;
+          const identity = (actor: Session) =>
+            api
+              .request(actor, "GET", "/api/auth/get-session")
+              .pipe(Effect.flatMap((response) => body(SessionIdentity, response)));
+          const traced = () => {
+            const traceId = randomBytes(16).toString("hex");
+            return { traceId, traceparent: `00-${traceId}-${randomBytes(8).toString("hex")}-01` };
+          };
+          /** A trace's delivered spans, once `ready` holds for them. */
+          const delivered = (
+            label: string,
+            traceId: string,
+            ready: (spans: ReadonlyArray<Span>) => boolean,
+          ) =>
+            telemetry.query(traceId).pipe(
+              Effect.map((result) => result.data.map(({ span }) => span)),
+              Effect.flatMap((spans) =>
+                ready(spans)
+                  ? Effect.succeed(spans)
+                  : Effect.fail(new Error("The request's spans have not reached the collector")),
+              ),
+              Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 40 }),
+              Effect.tap((spans) => evidence.json(`${label}.json`, spans)),
+            );
+          const names = (span: Span) => [span.tags[organizationId], span.tags[userId]];
+          /**
+           * `GET path` (whose route is `route`) as `actor`'s session or with `credential`, the status
+           * and the organization and user its delivered request span records, and for a bearer the
+           * status, organization and user its check (`auth.authenticate`) records.
+           */
+          const request = (
+            label: string,
+            actor: Session,
+            path: string,
+            route: string,
+            credential?: Redacted.Redacted<string>,
+          ) =>
+            Effect.gen(function* () {
+              const { traceId, traceparent } = traced();
+              const response = yield* api.request(actor, "GET", path, undefined, {
+                traceparent,
+                ...(credential === undefined
+                  ? {}
+                  : { authorization: `Bearer ${Redacted.value(credential)}` }),
+              });
+              const served = (span: Span) =>
+                span.operationName.startsWith("http.server ") && span.tags["http.route"] === route;
+              const checked = (span: Span) => span.operationName === "auth.authenticate";
+              const spans = yield* delivered(
+                label,
+                traceId,
+                (all) => all.some(served) && (credential === undefined || all.some(checked)),
+              );
+              return {
+                status: response.status,
+                spans: spans
+                  .filter(served)
+                  .map((span) => [span.tags["http.response.status_code"], ...names(span)]),
+                checks: spans.filter(checked).map((span) => [span.status, ...names(span)]),
+              };
+            });
+          const access = (
+            label: string,
+            actor: Session,
+            reference: string,
+            credential?: Redacted.Redacted<string>,
+          ) =>
+            request(
+              label,
+              actor,
+              `/api/organizations/${reference}/access`,
+              accessRoute,
+              credential,
+            );
+          /** `GET /access` of `reference` as one batched dashboard read of `actor`'s session. */
+          const batched = (label: string, actor: Session, reference: string) =>
+            Effect.gen(function* () {
+              const { traceId, traceparent } = traced();
+              const response = yield* api.request(actor, "POST", "/api/dashboard/batch", {
+                reads: [
+                  {
+                    id: 0,
+                    group: "organization",
+                    endpoint: "access",
+                    params: { organization: reference },
+                    query: {},
+                    traceparent,
+                  },
+                ],
+              });
+              expect(response.status, "The batch itself is answered").toBe(200);
+              const answer = yield* body(BatchAnswer, response);
+              const read = (span: Span) => span.operationName === "dashboard.batch.read";
+              const spans = yield* delivered(label, traceId, (all) => all.some(read));
+              return {
+                status: answer.status,
+                spans: spans
+                  .filter(read)
+                  .map((span) => [span.tags["http.response.status_code"], ...names(span)]),
+              };
+            });
+          const created = yield* api.request(actors.member, "POST", "/api/auth/api-key/create", {
+            name: "Organization request spans",
+          });
+          expect(created.status, JSON.stringify(created.body)).toBe(200);
+          const key = yield* body(Key, created);
+          yield* Effect.addFinalizer(() =>
+            api
+              .request(actors.member, "POST", "/api/auth/api-key/delete", { keyId: key.id })
+              .pipe(Effect.ignore),
+          );
+          const member = (yield* identity(actors.member)).user;
+          const owner = (yield* identity(actors.owner)).user;
+
+          yield* evidence.step(
+            "A member's request names their organization and them by ID, a refused one included",
+            Effect.gen(function* () {
+              expect(
+                yield* access("member", actors.member, organization.slug),
+                "The route names the organization by slug; the span names its ID and the session's user",
+              ).toEqual({ status: 200, spans: [["200", organization.id, member.id]], checks: [] });
+              expect(
+                yield* access("member-key", actors.member, organization.slug, key.key),
+                "So does a request with the member's API key, and its check names the key's user",
+              ).toEqual({
+                status: 200,
+                spans: [["200", organization.id, member.id]],
+                checks: [["ok", organization.id, member.id]],
+              });
+              expect(
+                yield* batched("member-batch", actors.member, organization.slug),
+                "So does a batched dashboard read",
+              ).toEqual({ status: 200, spans: [["200", organization.id, member.id]] });
+              // The organization has no icon under this key, so the request is refused after its
+              // membership holds.
+              const icon = `/api/organizations/${organization.slug}/icons/${randomBytes(32).toString("hex")}`;
+              expect(
+                yield* request("member-icon", actors.member, icon, iconRoute),
+                "A request refused in the caller's own organization names both",
+              ).toEqual({ status: 404, spans: [["404", organization.id, member.id]], checks: [] });
+            }),
+          );
+
+          yield* browser.login(actors.owner);
+          const grant = yield* evidence.step(
+            "Authorize an API grant in the browser",
+            oauth.authorizeApi,
+          );
+          const grantToken = Redacted.make(Redacted.value(grant.tokens).access_token);
+          yield* evidence.step(
+            "An OAuth grant's request names the grant's user",
+            Effect.gen(function* () {
+              expect(
+                yield* access("owner-grant", actors.owner, organization.slug, grantToken),
+              ).toEqual({
+                status: 200,
+                spans: [["200", organization.id, owner.id]],
+                checks: [["ok", organization.id, owner.id]],
+              });
+            }),
+          );
+
+          if (target.metadata.target === "cloud")
+            yield* evidence.step(
+              "A request for an organization the caller never joined names neither",
+              Effect.gen(function* () {
+                const response = yield* api.request(
+                  actors.owner,
+                  "POST",
+                  "/api/auth/organization/create",
+                  {
+                    name: "Organization request spans, another",
+                    slug: `organization-request-spans-${randomUUID().slice(0, 8)}`,
+                    keepCurrentActiveOrganization: true,
+                  },
+                );
+                expect(response.status, JSON.stringify(response.body)).toBe(200);
+                const other = yield* body(Organization, response);
+                yield* Effect.addFinalizer(() =>
+                  api
+                    .request(actors.owner, "DELETE", `/api/organizations/${other.id}`)
+                    .pipe(Effect.ignore),
+                );
+                expect(
+                  yield* access("owner-other", actors.owner, other.slug),
+                  "Its own member's request names it and them",
+                ).toEqual({ status: 200, spans: [["200", other.id, owner.id]], checks: [] });
+                expect(
+                  yield* access("member-other", actors.member, other.slug),
+                  "A signed-in session refused for it names neither",
+                ).toEqual({ status: 403, spans: [["403", undefined, undefined]], checks: [] });
+                expect(
+                  yield* access("member-key-other", actors.member, other.slug, key.key),
+                  "Nor does an API key refused for it, or its check",
+                ).toEqual({
+                  status: 403,
+                  spans: [["403", undefined, undefined]],
+                  checks: [["error", undefined, undefined]],
+                });
+                expect(
+                  yield* batched("member-batch-other", actors.member, other.slug),
+                  "Nor does a batched read refused for it",
+                ).toEqual({ status: 403, spans: [["403", undefined, undefined]] });
+                expect(
+                  yield* access("owner-grant-other", actors.owner, other.slug, grantToken),
+                  "A grant used for another organization names neither on the request; its check names only the grant's own",
+                ).toEqual({
+                  status: 403,
+                  spans: [["403", undefined, undefined]],
+                  checks: [["error", organization.id, owner.id]],
+                });
+              }),
+            );
+
+          // On both products the member then leaves the organization. Its session and its key
+          // outlive the membership.
+          yield* evidence.step(
+            "A request for an organization the caller left names neither",
+            Effect.gen(function* () {
+              const removed = yield* api.request(
+                actors.owner,
+                "POST",
+                "/api/auth/organization/remove-member",
+                { organizationId: organization.id, memberIdOrEmail: member.email },
+              );
+              expect(removed.status, JSON.stringify(removed.body)).toBe(200);
+              expect(
+                yield* access("member-left", actors.member, organization.slug),
+                "A signed-in session refused for it names neither",
+              ).toEqual({ status: 403, spans: [["403", undefined, undefined]], checks: [] });
+              expect(
+                yield* access("member-key-left", actors.member, organization.slug, key.key),
+                "Nor does an API key refused for it, or its check",
+              ).toEqual({
+                status: 403,
+                spans: [["403", undefined, undefined]],
+                checks: [["error", undefined, undefined]],
+              });
+              expect(
+                yield* batched("member-batch-left", actors.member, organization.slug),
+                "Nor does a batched read refused for it",
+              ).toEqual({ status: 403, spans: [["403", undefined, undefined]] });
+            }),
+          );
+        }).pipe(Effect.provide(McpOAuth.layer)),
+      ),
+    { timeout: 180_000 },
+  );
+});
diff --git a/e2e/tests/provider-errors.spec.ts b/e2e/tests/provider-errors.spec.ts
index 81d18b1d5a..56d4185c95 100644
--- a/e2e/tests/provider-errors.spec.ts
+++ b/e2e/tests/provider-errors.spec.ts
@@ -29,6 +29,27 @@ const Failure = Schema.Struct({
   ),
 });
 
+/** A listing whose routers report what could not be listed beside the tools that could. */
+const Listing = Schema.Struct({
+  items: Schema.Array(Schema.Struct({ name: Schema.String, inputSchema: Schema.Unknown })),
+  routers: Schema.Array(
+    Schema.Struct({
+      path: Schema.String,
+      title: Schema.optional(Schema.String),
+      error: Schema.optional(
+        Schema.Struct({
+          _tag: Schema.String,
+          reason: Schema.optional(Schema.String),
+          status: Schema.optional(Schema.Number),
+          accountId: Schema.optional(Schema.String),
+          phase: Schema.optional(Schema.String),
+          upstream: Schema.optional(Schema.Unknown),
+        }),
+      ),
+    }),
+  ),
+});
+
 type Kind = "graphql" | "mcp" | "openapi" | "custom";
 
 const providerErrors = (kind: Kind) =>
@@ -196,16 +217,50 @@ export default defineApp({ user: { accounts: { service: provider.many() } } }, a
         delayMs: 1_500,
         ...(kind === "custom" ? {} : { headers: challenge }),
       });
-      const listed = yield* assertFailure(yield* catalog(), "unauthorized", 401, listing);
-      if (kind !== "custom")
-        expectStated(listed, kind === "mcp" ? "while connecting" : "while listing its tools");
+      if (kind === "mcp") {
+        // Each linked account is its own MCP session. The refused account's error is reported
+        // on the app's router, and the other account's tools stay listed. Like a failure, that
+        // listing is not kept, so the next read finds the account recovered.
+        const response = yield* catalog();
+        expect(response.status, `${kind}: ${JSON.stringify(response.body)}`).toBe(200);
+        const partial = yield* body(Listing, response);
+        expect(partial.items.map((item) => item.name)).toEqual([tool]);
+        expect(partial.routers).toEqual([
+          {
+            path: "",
+            title: "accounts",
+            error: {
+              _tag: "ProviderError",
+              reason: "unauthorized",
+              status: 401,
+              accountId: affected,
+              phase: listing,
+              upstream: {
+                code: "invalid_token",
+                message: "Token [redacted] belongs to another organization",
+              },
+            },
+          },
+        ]);
+        expect(JSON.stringify(response.body)).not.toMatch(
+          new RegExp(`${providerSecretMarker}|synthetic-personal`),
+        );
+      } else {
+        const listed = yield* assertFailure(yield* catalog(), "unauthorized", 401, listing);
+        if (kind !== "custom") expectStated(listed, "while listing its tools");
+      }
       // Lazy MCP sources do not discover tools when listing unrelated webhooks.
       const setup = yield* api.request(actors.owner, "GET", `${path}/webhook-definitions`);
       expect(setup.status, JSON.stringify(setup.body)).toBe(kind === "mcp" ? 200 : 502);
       if (kind === "mcp") expect(setup.body).toEqual([]);
     }
     yield* upstream.configure({ status: 401, phase: "call" });
-    expect((yield* catalog()).status).toBe(200);
+    const recovered = yield* catalog();
+    expect(recovered.status, JSON.stringify(recovered.body)).toBe(200);
+    const whole = yield* body(Listing, recovered);
+    expect(whole.routers.filter((router) => router.error !== undefined)).toEqual([]);
+    // The recovered account can be selected again.
+    if (kind === "mcp") expect(JSON.stringify(whole.items[0]?.inputSchema)).toContain(affected);
     yield* assertFailure(yield* call(), "unauthorized", 401, "call");
     if (kind === "mcp") {
       yield* upstream.configure({ status: 401, phase: "call", headers: challenge });
@@ -388,8 +443,13 @@ export default defineApp({ user: { accounts: { service: provider.many() } } }, a
         .then(() => page.getByRole("button", { name: "Run tool", exact: true }).waitFor()),
     );
     const input = JSON.stringify({ accountId: affected, input: {} });
+    // The accounts share one schema, so the runner opens on the form; the call is entered as JSON.
     yield* browser.use("Enter tool input", (page) =>
-      page.getByLabel("Input", { exact: true }).fill(input),
+      page
+        .getByRole("tablist", { name: "Input format", exact: true })
+        .getByRole("tab", { name: "JSON", exact: true })
+        .click()
+        .then(() => page.getByLabel("Input", { exact: true }).fill(input)),
     );
     yield* upstream.configure({ status: 401, phase: "call" });
     yield* browser.use("Run the failing tool", (page) =>
diff --git a/e2e/tests/registry-failures.spec.ts b/e2e/tests/registry-failures.spec.ts
index 7522bfe197..de79356b8b 100644
--- a/e2e/tests/registry-failures.spec.ts
+++ b/e2e/tests/registry-failures.spec.ts
@@ -1,75 +1,87 @@
 /** The public app catalog reads a configured remote registry and reports each failure distinctly. */
 import { expect, layer } from "@effect/vitest";
-import { Effect, Layer, Schema } from "effect";
-import { Api, body, SessionClients } from "../support/api.ts";
+import { Effect, FileSystem, Layer, Schedule, Schema } from "effect";
+import { Api, body, currentClient, releasedClient, SessionClients } from "../support/api.ts";
 import { TestLive, withCase } from "../support/case.ts";
-import { startFreshSelfHost } from "../support/managed-server.ts";
+import { startLoggedSelfHost } from "../support/managed-server.ts";
 import { Target } from "../support/platform.ts";
 import {
+  registryCatalog,
   registryFixtureNames,
+  registryMixedName,
   registryPublication,
+  registryScopedListing,
+  registryTwinListings,
   registryUpstream,
 } from "../support/registry-upstream.ts";
 import { scenarios } from "../test-plan.ts";
 
 const Organizations = Schema.NonEmptyArray(Schema.Struct({ id: Schema.String }));
+const Failure = Schema.Struct({
+  _tag: Schema.Literal("RegistryError"),
+  reason: Schema.String,
+  status: Schema.optional(Schema.Number),
+});
+const Copy = Schema.Struct({
+  activeDeployment: Schema.NullOr(Schema.String),
+  copiedFrom: Schema.Struct({ name: Schema.String, commit: Schema.String }),
+});
+const Apps = Schema.Array(Schema.Struct({ id: Schema.String }));
+
+/** A fresh self-host reading the registry fixture, with its owner signed in. */
+const registryCase = Effect.gen(function* () {
+  const target = yield* Target;
+  const registry = yield* registryUpstream;
+  const server = yield* startLoggedSelfHost(target, { EXECUTOR_REGISTRY_URL: registry.origin });
+  const api = yield* Api.pipe(
+    Effect.provide(Layer.fresh(Api.layer)),
+    Effect.provide(Layer.fresh(SessionClients.layer)),
+    Effect.provideService(Target, {
+      ...target,
+      metadata: { ...target.metadata, origin: server.origin },
+    }),
+  );
+  const owner = yield* api.session();
+  expect(
+    (yield* api.request(owner, "POST", "/api/auth/self-host/setup", {
+      name: "Registry Owner",
+      email: "registry-owner@example.test",
+      password: "Synthetic-registry-password-123!",
+      organizationName: "Registry lab",
+    })).status,
+  ).toBe(200);
+  const [organization] = yield* body(
+    Organizations,
+    yield* api.request(owner, "GET", "/api/auth/organization/list"),
+  );
+  const prefix = `/api/organizations/${organization.id}`;
+  const catalog = (name?: string, client: Record<string, string> = {}) =>
+    api.request(
+      owner,
+      "GET",
+      `${prefix}/app-publications${name === undefined ? "" : `?name=${encodeURIComponent(name)}`}`,
+      undefined,
+      client,
+    );
+  return { api, owner, prefix, registry, catalog, log: server.log };
+});
+
+const failed = (response: { readonly status: number; readonly body: unknown }) => {
+  expect(response.status, JSON.stringify(response.body)).toBe(400);
+  return body(Failure, response);
+};
 
 layer(TestLive, { excludeTestServices: true })("Remote registry failures", (it) => {
   it.effect(scenarios.remoteRegistryFailures.title, (context) =>
     withCase(
       context,
       Effect.gen(function* () {
-        const target = yield* Target;
-        const registry = yield* registryUpstream;
-        const origin = yield* startFreshSelfHost(target, {
-          EXECUTOR_REGISTRY_URL: registry.origin,
-        });
-        const api = yield* Api.pipe(
-          Effect.provide(Layer.fresh(Api.layer)),
-          Effect.provide(Layer.fresh(SessionClients.layer)),
-          Effect.provideService(Target, { ...target, metadata: { ...target.metadata, origin } }),
-        );
-        const owner = yield* api.session();
-        expect(
-          (yield* api.request(owner, "POST", "/api/auth/self-host/setup", {
-            name: "Registry Owner",
-            email: "registry-owner@example.test",
-            password: "Synthetic-registry-password-123!",
-            organizationName: "Registry lab",
-          })).status,
-        ).toBe(200);
-        const [organization] = yield* body(
-          Organizations,
-          yield* api.request(owner, "GET", "/api/auth/organization/list"),
-        );
-        const catalog = (name?: string) =>
-          api.request(
-            owner,
-            "GET",
-            `/api/organizations/${organization.id}/app-publications${name === undefined ? "" : `?name=${encodeURIComponent(name)}`}`,
-          );
-        const failure = (name: string) =>
-          catalog(name).pipe(
-            Effect.tap((response) =>
-              Effect.sync(() =>
-                expect(response.status, `${name}: ${JSON.stringify(response.body)}`).toBe(400),
-              ),
-            ),
-            Effect.flatMap((response) =>
-              body(
-                Schema.Struct({
-                  _tag: Schema.Literal("RegistryError"),
-                  reason: Schema.String,
-                  status: Schema.optional(Schema.Number),
-                }),
-                response,
-              ),
-            ),
-          );
+        const { registry, catalog, log } = yield* registryCase;
+        const failure = (name: string) => Effect.flatMap(catalog(name), failed);
 
         const listed = yield* catalog();
         expect(listed.status).toBe(200);
-        expect(listed.body).toEqual([registryPublication]);
+        expect(listed.body).toEqual(registryCatalog);
         expect(yield* failure(registryFixtureNames.redirect), "redirects are not followed").toEqual(
           { _tag: "RegistryError", reason: "status", status: 302 },
         );
@@ -93,6 +105,38 @@ layer(TestLive, { excludeTestServices: true })("Remote registry failures", (it)
               `/api/registry/apps${name === undefined ? "" : `?name=${encodeURIComponent(name)}`}`,
           ),
         );
+        expect(
+          yield* registry.revisions,
+          "each read states the wire revision this release reads",
+        ).toEqual(paths.map(() => "1"));
+
+        // A listing this release cannot read is left out; the others are still listed. The log
+        // names each one and what failed to decode, and promises an upgrade only for new formats.
+        const mixed = yield* catalog(registryMixedName);
+        expect(mixed.status, JSON.stringify(mixed.body)).toBe(200);
+        expect(mixed.body).toEqual([registryPublication]);
+        // The server's output reaches its log file after the response, so wait for both lines.
+        const fs = yield* FileSystem.FileSystem;
+        const warnings = yield* fs.readFileString(log).pipe(
+          Effect.map((text) =>
+            text.split("\n").filter((line) => line.includes("Left out public registry listing")),
+          ),
+          Effect.repeat({
+            until: (lines) => lines.length >= 2,
+            schedule: Schedule.spaced("250 millis"),
+            times: 80,
+          }),
+        );
+        expect(warnings).toHaveLength(2);
+        expect(warnings[0]).toContain("@fixture/future+format");
+        expect(warnings[0]).toContain("$.name: Filter");
+        expect(warnings[1]).toContain("@fixture/malformed");
+        expect(warnings[1]).toContain("$.description: InvalidType");
+        for (const warning of warnings)
+          expect(warning).toContain(
+            "A newer release reads listings in formats added since this one, not malformed ones.",
+          );
+
         yield* registry.close;
         expect(yield* failure(registryPublication.name), "an unreachable registry").toEqual({
           _tag: "RegistryError",
@@ -101,4 +145,168 @@ layer(TestLive, { excludeTestServices: true })("Remote registry failures", (it)
       }),
     ),
   );
+
+  it.effect(scenarios.remoteRegistryReleasedClients.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const { api, owner, prefix, registry, catalog } = yield* registryCase;
+        const [dotless, scoped] = registryTwinListings;
+        const sent = Effect.map(registry.paths, (all) => all.length);
+        const since = (count: number) => Effect.map(registry.paths, (all) => all.slice(count));
+        const lookup = (name: string) => `/api/registry/apps?name=${encodeURIComponent(name)}`;
+        const source = (listing: { readonly name: string; readonly commit: string }) =>
+          `/api/registry/source?name=${encodeURIComponent(listing.name)}&commit=${listing.commit}`;
+        const copy = (name: string, commit: string, client: Record<string, string>) =>
+          api.request(
+            owner,
+            "POST",
+            `${prefix}/apps/copies`,
+            { from: { package: name, commit }, name: `Copy of ${name}` },
+            client,
+          );
+
+        // A client released before publisher scopes lists each listing by a name it decodes: an
+        // older registry's `@fixture/example` as it is, a publishing scope's under its slug. The
+        // twins would read as one name, so neither is listed to it.
+        const listed = yield* catalog(undefined, releasedClient);
+        expect(listed.status, JSON.stringify(listed.body)).toBe(200);
+        expect(listed.body).toEqual([
+          registryPublication,
+          { ...registryScopedListing, name: "@scoped/notes" },
+        ]);
+
+        // Each name it was shown selects that listing, looked up by every name it could stand for.
+        let before = yield* sent;
+        const example = yield* catalog(registryPublication.name, releasedClient);
+        expect(example.status, JSON.stringify(example.body)).toBe(200);
+        expect(example.body).toEqual([registryPublication]);
+        expect(yield* since(before)).toEqual([
+          lookup(registryPublication.name),
+          lookup("@fixture.executor.community/example"),
+        ]);
+        const notes = yield* catalog("@scoped/notes", releasedClient);
+        expect(notes.status, JSON.stringify(notes.body)).toBe(200);
+        expect(notes.body).toEqual([{ ...registryScopedListing, name: "@scoped/notes" }]);
+        // A later release that states no revision reads names under publisher scopes and may send
+        // one. The full name means only that listing, and the answer names it as it was sent.
+        before = yield* sent;
+        const full = yield* catalog(registryScopedListing.name, releasedClient);
+        expect(full.status, JSON.stringify(full.body)).toBe(200);
+        expect(full.body).toEqual([registryScopedListing]);
+        expect(yield* since(before)).toEqual([lookup(registryScopedListing.name)]);
+        // When nothing reads as the name, it is answered as the registry answers that name itself.
+        before = yield* sent;
+        expect(
+          yield* failed(yield* catalog(registryFixtureNames.missing, releasedClient)),
+          "registry errors pass through",
+        ).toEqual({ _tag: "RegistryError", reason: "not-found" });
+        expect(yield* since(before)).toEqual([
+          lookup(registryFixtureNames.missing),
+          lookup("@fixture.executor.community/missing"),
+        ]);
+
+        // Copying reads the source of the listing it was shown, under its published name.
+        before = yield* sent;
+        const exampleCopy = yield* copy(
+          registryPublication.name,
+          registryPublication.commit,
+          releasedClient,
+        );
+        expect(exampleCopy.status, JSON.stringify(exampleCopy.body)).toBe(200);
+        const copiedExample = yield* body(Copy, exampleCopy);
+        expect(copiedExample.copiedFrom).toMatchObject({
+          name: registryPublication.name,
+          commit: registryPublication.commit,
+        });
+        expect(copiedExample.activeDeployment).not.toBeNull();
+        expect(yield* since(before)).toContain(source(registryPublication));
+        before = yield* sent;
+        const notesCopy = yield* copy(
+          "@scoped/notes",
+          registryScopedListing.commit,
+          releasedClient,
+        );
+        expect(notesCopy.status, JSON.stringify(notesCopy.body)).toBe(200);
+        expect((yield* body(Copy, notesCopy)).copiedFrom).toMatchObject({
+          name: registryScopedListing.name,
+          commit: registryScopedListing.commit,
+        });
+        expect(yield* since(before)).toContain(source(registryScopedListing));
+        const fullCopy = yield* copy(
+          registryScopedListing.name,
+          registryScopedListing.commit,
+          releasedClient,
+        );
+        expect(fullCopy.status, JSON.stringify(fullCopy.body)).toBe(200);
+        expect((yield* body(Copy, fullCopy)).copiedFrom).toMatchObject({
+          name: registryScopedListing.name,
+          commit: registryScopedListing.commit,
+        });
+
+        // A name two listings read as is refused, never sent to either; no source is read.
+        before = yield* sent;
+        expect(yield* failed(yield* catalog(dotless.name, releasedClient))).toEqual({
+          _tag: "RegistryError",
+          reason: "conflict",
+        });
+        for (const listing of [dotless, scoped])
+          expect(yield* failed(yield* copy(dotless.name, listing.commit, releasedClient))).toEqual({
+            _tag: "RegistryError",
+            reason: "conflict",
+          });
+        expect(
+          (yield* since(before)).filter((path) => path.startsWith("/api/registry/source")),
+        ).toEqual([]);
+
+        // This release's clients name each twin by its own name.
+        for (const listing of [dotless, scoped]) {
+          const own = yield* catalog(listing.name);
+          expect(own.status, JSON.stringify(own.body)).toBe(200);
+          expect(own.body).toEqual([listing]);
+        }
+
+        // A self-host removes no listing from the registry it reads, for either revision, and
+        // never looks the name up.
+        before = yield* sent;
+        for (const [name, client] of [
+          ["@scoped/notes", releasedClient],
+          [registryScopedListing.name, currentClient],
+        ] as const) {
+          const removed = yield* api.request(
+            owner,
+            "POST",
+            `${prefix}/app-publications/unpublish`,
+            { package: name },
+            client,
+          );
+          expect(removed.status, JSON.stringify(removed.body)).toBe(403);
+          expect(removed.body).toMatchObject({ _tag: "AppAccessDenied", reason: "forbidden" });
+        }
+        expect(yield* since(before)).toEqual([]);
+
+        // The listing it was shown as `@scoped/notes` changes before it copies that commit. The
+        // name then selects a replacement with another commit, or nothing once the scope is
+        // renamed; the copy is refused and makes no app.
+        const apps = Effect.flatMap(api.request(owner, "GET", `${prefix}/apps`), (response) =>
+          body(Apps, response),
+        );
+        const made = (yield* apps).length;
+        const others = registryCatalog.filter((listing) => listing !== registryScopedListing);
+        const replacement = { ...registryScopedListing, commit: "e".repeat(40) };
+        yield* registry.publish([...others, replacement]);
+        expect(
+          yield* failed(yield* copy("@scoped/notes", registryScopedListing.commit, releasedClient)),
+        ).toEqual({ _tag: "RegistryError", reason: "changed" });
+        const renamed = { ...registryScopedListing, name: "@renamed.executor.community/notes" };
+        yield* registry.publish([...others, renamed]);
+        before = yield* sent;
+        expect(
+          yield* failed(yield* copy("@scoped/notes", registryScopedListing.commit, releasedClient)),
+        ).toEqual({ _tag: "RegistryError", reason: "not-found" });
+        expect(yield* since(before)).not.toContain(source(renamed));
+        expect((yield* apps).length).toBe(made);
+      }),
+    ),
+  );
 });
diff --git a/e2e/tests/released-client-package-names.spec.ts b/e2e/tests/released-client-package-names.spec.ts
new file mode 100644
index 0000000000..005652d19a
--- /dev/null
+++ b/e2e/tests/released-client-package-names.spec.ts
@@ -0,0 +1,452 @@
+/**
+ * Clients of release 2.0.0-beta.15 still call Cloud: its local servers read the public registry,
+ * and its CLI reads app source. They state no wire revision, so Cloud answers them with package
+ * names they decode, `@acme/notes` for `@acme.executor.community/notes`, takes those names back, and
+ * withholds publication readiness they cannot read. This release's clients state revision 1 and read
+ * names under publisher scopes. `release-f5f3256ab.ts` is that release's decoding, frozen.
+ *
+ * Releases 2.0.0-beta.16 through beta.29 state no revision either but read names under publisher
+ * scopes, so their clients may send a full name. A listing a client names is answered by the name
+ * it sent, which their local servers require before installing (`release-6ba6219e6.ts`).
+ *
+ * A name such a client sends selects whatever it names when the request arrives. A short name is
+ * taken back only for reads and for copies of the commit the client was shown, which the registry
+ * checks. A removal names no commit, so Cloud refuses one by a short name and gives the full name,
+ * and the release prints Cloud's explanation. A full name removes exactly that listing.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body, currentClient, releasedClient } from "../support/api.ts";
+import { withApps } from "../support/apps-release.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App, Organization } from "../support/contracts.ts";
+import { Target } from "../support/platform.ts";
+import {
+  releasedCatalog,
+  releasedHostAnswer,
+  releasedInstall,
+  releasedSourceView,
+} from "../support/release-f5f3256ab.ts";
+import {
+  releasedCatalog as beta16Catalog,
+  releasedInstall as beta16Install,
+} from "../support/release-6ba6219e6.ts";
+import { rawRequest, targetHosts } from "../support/role-hosts.ts";
+
+const Workspace = Schema.Struct({
+  revision: Schema.Struct({ commit: Schema.String }),
+  publication: Schema.Unknown,
+});
+const Publication = Schema.Struct({ name: Schema.String, commit: Schema.String });
+const Copy = Schema.Struct({
+  id: Schema.String,
+  copiedFrom: Schema.NullOr(
+    Schema.Struct({ name: Schema.String, commit: Schema.NullOr(Schema.String) }),
+  ),
+});
+const Failure = Schema.Struct({ _tag: Schema.String, reason: Schema.String });
+/**
+ * The released CLI's account of Cloud refusing to remove a listing by the short name `name`: that
+ * nothing was removed, the full name to remove instead, and how to update a CLI that cannot send it.
+ */
+const fullNameRequired = (
+  response: { readonly status: number; readonly body: unknown },
+  name: string,
+  fullName: string,
+) =>
+  Effect.gen(function* () {
+    const failure = yield* releasedHostAnswer(response.status, response.body);
+    expect(failure).toMatchObject({ code: "FullListingNameRequired", status: 400 });
+    expect(failure.message).toContain(`${name} is the short form of a public listing's name.`);
+    expect(failure.message).toContain("so nothing was removed.");
+    expect(failure.recovery?.action).toContain(`Remove ${fullName} instead.`);
+    expect(failure.recovery?.action).toContain("npm i -g executor@beta --include=optional");
+    expect(failure.recovery?.instructions).toContain(
+      `executor apps unpublish --package ${fullName}`,
+    );
+    expect(failure.recovery?.instructions).toContain("executor-wire-revision: 1");
+  });
+
+layer(HostedLive, { excludeTestServices: true })("Released client package names", (it) => {
+  it.effect(scenarios.releasedClientPackageNames.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const hosts = targetHosts(yield* Target);
+        const api = yield* Api,
+          actors = yield* Actors;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const label = `released-${randomUUID().slice(0, 8)}`;
+        const name = `@${actors.organization.slug}.executor.community/${label}`;
+        const releasedName = `@${actors.organization.slug}/${label}`;
+
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `Released ${label}`,
+          files: [
+            {
+              path: "index.ts",
+              content: `import { defineApp } from "apps";\nexport default defineApp({}, {});\n`,
+            },
+            {
+              path: "package.json",
+              content: JSON.stringify({ name, description: label, dependencies: withApps() }),
+            },
+          ],
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed);
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`)
+            .pipe(Effect.asVoid, Effect.orDie),
+        );
+        const workspace = (client: Record<string, string>) =>
+          api.request(actors.owner, "GET", `${prefix}/apps/${app.id}/workspace`, undefined, client);
+
+        // The released CLI reads the source it deploys (`apps source`, `apps deploy --files`).
+        // Its readiness names the package under the organization's scope, which that CLI cannot
+        // decode, so Cloud withholds it.
+        const released = yield* workspace(releasedClient);
+        expect(released.status, JSON.stringify(released.body)).toBe(200);
+        const view = yield* releasedSourceView(released.body);
+        expect(view.publication).toBeNull();
+        const current = yield* body(Workspace, yield* workspace(currentClient));
+        expect(current.publication).toEqual({
+          status: "ready",
+          manifest: { name, description: label },
+        });
+        const commit = current.revision.commit;
+
+        const published = yield* api.request(
+          actors.owner,
+          "POST",
+          `${prefix}/apps/${app.id}/publication`,
+          { commit },
+        );
+        expect(published.status, JSON.stringify(published.body)).toBe(200);
+        expect(yield* body(Publication, published)).toEqual({ name, commit });
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "POST", `${prefix}/app-publications/unpublish`, {
+              package: name,
+            })
+            .pipe(Effect.asVoid, Effect.orDie),
+        );
+
+        // The released local server reads the whole public catalog with no revision. Every listing
+        // decodes, and this one carries the name that release knows it by.
+        const registry = (path: string, headers: Record<string, string> = {}) =>
+          rawRequest(`${hosts.api}${path}`, { headers }).pipe(
+            Effect.tap((response) =>
+              Effect.sync(() => expect(response.status, response.text).toBe(200)),
+            ),
+            Effect.map((response): unknown => JSON.parse(response.text)),
+          );
+        const catalog = yield* releasedCatalog(yield* registry("/api/registry/apps"));
+        expect(catalog).toContainEqual(expect.objectContaining({ name: releasedName, commit }));
+        expect(
+          yield* releasedCatalog(
+            yield* registry(`/api/registry/apps?name=${encodeURIComponent(releasedName)}`),
+          ),
+        ).toMatchObject([{ name: releasedName, commit }]);
+        // This release's readers state revision 1 and read the name under the scope.
+        const listed = yield* registry(
+          `/api/registry/apps?name=${encodeURIComponent(name)}`,
+          currentClient,
+        );
+        expect(yield* Schema.decodeUnknownEffect(Schema.Array(Publication))(listed)).toEqual([
+          { name, commit },
+        ]);
+
+        // It reads the listing's source by that name too. Installing it still fails for that
+        // release alone: its package.json names the scope, and the release requires package.json
+        // to repeat the listing's name exactly.
+        const source = yield* registry(
+          `/api/registry/source?name=${encodeURIComponent(releasedName)}&commit=${commit}`,
+        );
+        expect(yield* Effect.flip(releasedInstall(source, releasedName, commit))).toBe(
+          "invalid-manifest",
+        );
+        // The next release's local server, which states no revision either, installs the listing by
+        // the name it is asked for: the full one from a saved command, or the short one it lists.
+        for (const sent of [name, releasedName]) {
+          expect(
+            yield* beta16Catalog(
+              yield* registry(`/api/registry/apps?name=${encodeURIComponent(sent)}`),
+            ),
+          ).toMatchObject([{ name: sent, commit }]);
+          const read = yield* registry(
+            `/api/registry/source?name=${encodeURIComponent(sent)}&commit=${commit}`,
+          );
+          expect(yield* beta16Install(read, sent, commit)).toBe(2);
+        }
+
+        // The released CLI installs it on Cloud by that name; Cloud resolves the listing itself.
+        const copied = yield* api.request(
+          actors.owner,
+          "POST",
+          `${prefix}/apps/copies`,
+          { from: { package: releasedName, commit }, name: `Copy ${label}` },
+          releasedClient,
+        );
+        expect(copied.status, JSON.stringify(copied.body)).toBe(200);
+        const copy = yield* body(Copy, copied);
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "DELETE", `${prefix}/apps/${copy.id}`)
+            .pipe(Effect.asVoid, Effect.orDie),
+        );
+
+        // Its catalog and published listings decode. It cannot remove the listing by that name:
+        // Cloud refuses, the release prints the full name to use and how to update, and the
+        // listing stays.
+        const releasedRead = (path: string) =>
+          api
+            .request(actors.owner, "GET", `${prefix}${path}`, undefined, releasedClient)
+            .pipe(Effect.flatMap((response) => releasedCatalog(response.body)));
+        expect(
+          yield* releasedRead(`/app-publications?name=${encodeURIComponent(releasedName)}`),
+        ).toMatchObject([{ name: releasedName, commit }]);
+        expect(yield* releasedRead("/app-publications/published")).toContainEqual(
+          expect.objectContaining({ name: releasedName, commit }),
+        );
+        expect(
+          yield* api
+            .request(
+              actors.owner,
+              "GET",
+              `${prefix}/app-publications?name=${encodeURIComponent(name)}`,
+              undefined,
+              releasedClient,
+            )
+            .pipe(Effect.flatMap((response) => beta16Catalog(response.body))),
+        ).toMatchObject([{ name, commit }]);
+        const refused = yield* api.request(
+          actors.owner,
+          "POST",
+          `${prefix}/app-publications/unpublish`,
+          { package: releasedName },
+          releasedClient,
+        );
+        yield* fullNameRequired(refused, releasedName, name);
+        expect(
+          yield* api.request(
+            actors.owner,
+            "GET",
+            `${prefix}/app-publications?name=${encodeURIComponent(name)}`,
+          ),
+        ).toMatchObject({ status: 200, body: [{ name, commit }] });
+      }),
+    ),
+  );
+
+  it.effect(scenarios.releasedClientWriteBinding.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const hosts = targetHosts(yield* Target);
+        const api = yield* Api,
+          actors = yield* Actors;
+        const suffix = randomUUID().slice(0, 8);
+        const label = `bound-${suffix}`;
+        const slug = `bound-${suffix}`,
+          renamedSlug = `bound-renamed-${suffix}`;
+        const name = `@${slug}.executor.community/${label}`,
+          renamedName = `@${renamedSlug}.executor.community/${label}`;
+        // The name the released client is shown for `name`, and sends back.
+        const shown = `@${slug}/${label}`;
+        const home = `/api/organizations/${actors.organization.id}`;
+
+        const organization = (organizationSlug: string) =>
+          Effect.gen(function* () {
+            const created = yield* body(
+              Organization,
+              yield* api.request(actors.owner, "POST", "/api/auth/organization/create", {
+                name: `Write binding ${organizationSlug}`,
+                slug: organizationSlug,
+                keepCurrentActiveOrganization: true,
+              }),
+            );
+            yield* Effect.addFinalizer(() =>
+              api
+                .request(actors.owner, "DELETE", `/api/organizations/${created.id}`)
+                .pipe(Effect.asVoid, Effect.orDie),
+            );
+            return created;
+          });
+        /** Publish a new app as `name` from an organization, and return its published commit. */
+        const publishApp = (organizationId: string, marker: string) =>
+          Effect.gen(function* () {
+            const prefix = `/api/organizations/${organizationId}`;
+            const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+              name: `Bound ${marker}`,
+              files: [
+                {
+                  path: "index.ts",
+                  content: `import { defineApp } from "apps";\n// ${marker}\nexport default defineApp({}, {});\n`,
+                },
+                {
+                  path: "package.json",
+                  content: JSON.stringify({ name, description: marker, dependencies: withApps() }),
+                },
+              ],
+            });
+            expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+            const app = yield* body(App, deployed);
+            yield* Effect.addFinalizer(() =>
+              api
+                .request(actors.owner, "DELETE", `${prefix}/apps/${app.id}`)
+                .pipe(Effect.asVoid, Effect.orDie),
+            );
+            const { revision } = yield* body(
+              Workspace,
+              yield* api.request(actors.owner, "GET", `${prefix}/apps/${app.id}/workspace`),
+            );
+            const published = yield* api.request(
+              actors.owner,
+              "POST",
+              `${prefix}/apps/${app.id}/publication`,
+              { commit: revision.commit },
+            );
+            expect(published.status, JSON.stringify(published.body)).toBe(200);
+            expect(yield* body(Publication, published)).toEqual({ name, commit: revision.commit });
+            return revision.commit;
+          });
+        /** The listings this release's clients find under `listing`. */
+        const listed = (listing: string) =>
+          api
+            .request(
+              actors.owner,
+              "GET",
+              `${home}/app-publications?name=${encodeURIComponent(listing)}`,
+            )
+            .pipe(Effect.flatMap((response) => body(Schema.Array(Publication), response)));
+        /** The listings the released client finds under the name it was shown. */
+        const shownListings = api
+          .request(
+            actors.owner,
+            "GET",
+            `${home}/app-publications?name=${encodeURIComponent(shown)}`,
+            undefined,
+            releasedClient,
+          )
+          .pipe(Effect.flatMap((response) => releasedCatalog(response.body)));
+        const unpublish = (organizationId: string, client: Record<string, string>, pkg: string) =>
+          api.request(
+            actors.owner,
+            "POST",
+            `/api/organizations/${organizationId}/app-publications/unpublish`,
+            { package: pkg },
+            client,
+          );
+        const failure = (response: { readonly status: number; readonly body: unknown }) => {
+          expect(response.status, JSON.stringify(response.body)).toBe(400);
+          return body(Failure, response);
+        };
+        /** A stale removal by the shown name from an organization: refused, before any lookup. */
+        const refusedRemoval = (organizationId: string) =>
+          Effect.flatMap(unpublish(organizationId, releasedClient, shown), (refused) =>
+            fullNameRequired(refused, shown, name),
+          );
+        /** A stale copy of the shown name at `commit`: refused for `reason`, and no app is made. */
+        const refusedCopy = (commit: string, reason: string) =>
+          Effect.gen(function* () {
+            const copyName = `Stale ${reason} ${suffix}`;
+            const copied = yield* api.request(
+              actors.owner,
+              "POST",
+              `${home}/apps/copies`,
+              { from: { package: shown, commit }, name: copyName },
+              releasedClient,
+            );
+            expect(yield* failure(copied)).toEqual({ _tag: "RegistryError", reason });
+            const apps = yield* body(
+              Schema.Array(App),
+              yield* api.request(actors.owner, "GET", `${home}/apps`),
+            );
+            expect(apps.map((app) => app.name)).not.toContain(copyName);
+          });
+        /** The released local server's read of the shown name's source at `commit`. */
+        const sourceFailure = (commit: string) =>
+          rawRequest(
+            `${hosts.api}/api/registry/source?name=${encodeURIComponent(shown)}&commit=${commit}`,
+          ).pipe(
+            Effect.flatMap((response) =>
+              failure({ status: response.status, body: JSON.parse(response.text) }),
+            ),
+          );
+        const changed = { _tag: "RegistryError", reason: "changed" };
+
+        // An organization publishes the listing, and the released client is shown it.
+        const first = yield* organization(slug);
+        const original = yield* publishApp(first.id, `original ${suffix}`);
+        expect(yield* shownListings).toMatchObject([{ name: shown, commit: original }]);
+
+        // The organization replaces it with another app under the same name. A stale removal is
+        // refused and the replacement stays; a stale copy or source read of the commit it was
+        // shown is refused as changed.
+        expect((yield* unpublish(first.id, currentClient, name)).status).toBe(200);
+        const replacement = yield* publishApp(first.id, `replacement ${suffix}`);
+        expect(replacement).not.toBe(original);
+        yield* refusedRemoval(first.id);
+        expect(yield* listed(name)).toEqual([{ name, commit: replacement }]);
+        yield* refusedCopy(original, "changed");
+        expect(yield* sourceFailure(original)).toEqual(changed);
+
+        // The organization is renamed after the client lists the replacement. The name it was
+        // shown selects nothing now; the removal is refused and the renamed listing stays.
+        expect(yield* shownListings).toMatchObject([{ name: shown, commit: replacement }]);
+        const renamed = yield* api.request(actors.owner, "POST", "/api/auth/organization/update", {
+          organizationId: first.id,
+          data: { slug: renamedSlug },
+        });
+        expect(renamed.status, JSON.stringify(renamed.body)).toBe(200);
+        yield* refusedRemoval(first.id);
+        yield* refusedCopy(replacement, "not-found");
+        expect(yield* listed(renamedName)).toEqual([{ name: renamedName, commit: replacement }]);
+
+        // Another organization takes the slug and publishes the same label. The shown name now
+        // selects its listing, which never published the commit the client was shown, so the copy
+        // and source read are refused. Neither organization can remove a listing by that name.
+        const second = yield* organization(slug);
+        const successor = yield* publishApp(second.id, `successor ${suffix}`);
+        yield* refusedCopy(replacement, "changed");
+        expect(yield* sourceFailure(replacement)).toEqual(changed);
+        yield* refusedRemoval(first.id);
+        yield* refusedRemoval(second.id);
+        expect(yield* listed(name)).toEqual([{ name, commit: successor }]);
+        expect(yield* listed(renamedName)).toEqual([{ name: renamedName, commit: replacement }]);
+
+        // Listed again, the client is shown the successor's commit, and copies exactly that.
+        expect(yield* shownListings).toMatchObject([{ name: shown, commit: successor }]);
+        const copied = yield* api.request(
+          actors.owner,
+          "POST",
+          `${home}/apps/copies`,
+          { from: { package: shown, commit: successor }, name: `Bound copy ${suffix}` },
+          releasedClient,
+        );
+        expect(copied.status, JSON.stringify(copied.body)).toBe(200);
+        const copy = yield* body(Copy, copied);
+        yield* Effect.addFinalizer(() =>
+          api
+            .request(actors.owner, "DELETE", `${home}/apps/${copy.id}`)
+            .pipe(Effect.asVoid, Effect.orDie),
+        );
+        expect(copy.copiedFrom).toEqual({ name, commit: successor });
+
+        // A full name means only that listing, so a client without a revision removes it as this
+        // release's clients do. Releases 2.0.0-beta.16 through beta.29 can send one.
+        const removed = yield* unpublish(second.id, releasedClient, name);
+        expect(removed.status, JSON.stringify(removed.body)).toBe(200);
+        expect(removed.body).toEqual({ name });
+        expect(yield* listed(name)).toEqual([]);
+        expect(yield* listed(renamedName)).toEqual([{ name: renamedName, commit: replacement }]);
+        expect((yield* unpublish(first.id, currentClient, renamedName)).status).toBe(200);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/schedule-run-telemetry.spec.ts b/e2e/tests/schedule-run-telemetry.spec.ts
new file mode 100644
index 0000000000..63541663e3
--- /dev/null
+++ b/e2e/tests/schedule-run-telemetry.spec.ts
@@ -0,0 +1,180 @@
+/**
+ * A scheduled run's error cannot say who failed it: a mutation that throws and one whose reply
+ * Executor's runtime lost both fail with `ToolCallFailed`. Its span records what the call failed
+ * with. On Cloud, the coordinator's pass records how many schedules were due before it claimed
+ * any, and how long the oldest had waited.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Schedule, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Actors } from "../support/actors.ts";
+import { Api, body } from "../support/api.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { Evidence, Telemetry } from "../support/evidence.ts";
+import { Target } from "../support/platform.ts";
+import { appsManifest } from "../support/apps-release.ts";
+
+/**
+ * `crash` throws. `lost` returns, but the app's isolate fails the runtime's read of its reply, so
+ * no usable answer reaches Executor. Hourly schedules never fall due during the scenario; Run Now
+ * makes each one due.
+ */
+const source = `import { defineApp, mutation, userInterval, object, string, router } from "apps";
+const json = Response.prototype.json;
+Response.prototype.json = async function () {
+  const value = await json.call(this);
+  if (JSON.stringify(value).includes("reply-" + "lost")) throw new Error("Synthetic lost reply");
+  return value;
+};
+const fine = mutation({ input: object({}) }, async () => ({ done: true }));
+const crash = mutation({ input: object({}) }, async () => { throw new Error("Synthetic app failure"); });
+const lost = mutation({ input: object({}), output: string() }, async () => "reply-" + "lost");
+export default defineApp({}, async () => ({ tools: router({ fine, crash, lost }), schedules: {
+  fine: userInterval({ minutes: 60 }, fine, {}),
+  crash: userInterval({ minutes: 60 }, crash, {}),
+  lost: userInterval({ minutes: 60 }, lost, {}),
+} }));`;
+const names = ["fine", "crash", "lost"] as const;
+
+const Runs = Schema.Array(
+  Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    status: Schema.String,
+    finishedAt: Schema.NullOr(Schema.String),
+    failure: Schema.NullOr(Schema.String),
+  }),
+);
+class Pending extends Schema.TaggedError<Pending>()("Pending", { found: Schema.Number }) {}
+
+layer(HostedLive, { excludeTestServices: true })("Schedule run telemetry", (it) => {
+  it.effect(scenarios.scheduleRunTelemetry.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors,
+          evidence = yield* Evidence,
+          telemetry = yield* Telemetry,
+          target = yield* Target;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+          name: `Run sources ${randomUUID().slice(0, 8)}`,
+          files: [{ path: "index.ts", content: source }, appsManifest],
+        });
+        expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+        const app = yield* body(App, deployed);
+        const path = `${prefix}/apps/${app.id}`;
+        yield* Effect.addFinalizer(() =>
+          api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
+        );
+        for (const name of names) {
+          expect(
+            (yield* api.request(actors.owner, "PATCH", `${path}/schedules/${name}`, {
+              enabled: true,
+              approvalMode: "automatic",
+            })).status,
+          ).toBe(200);
+          expect(
+            (yield* api.request(actors.owner, "POST", `${path}/schedules/${name}/run`)).status,
+          ).toBe(200);
+        }
+
+        const runs = yield* api
+          .request(actors.owner, "GET", `${prefix}/scheduled-runs?app=${app.id}`)
+          .pipe(
+            Effect.flatMap((response) => body(Runs, response)),
+            Effect.flatMap((runs) => {
+              const found = runs.filter((run) => run.finishedAt !== null).length;
+              return found === names.length
+                ? Effect.succeed(runs)
+                : Effect.fail(new Pending({ found }));
+            }),
+            Effect.retry({
+              while: (error) => error instanceof Pending,
+              schedule: Schedule.spaced("250 millis"),
+              times: 120,
+            }),
+          );
+        yield* evidence.json("scheduled-runs.json", runs);
+        const run = (name: (typeof names)[number]) => {
+          const found = runs.find((run) => run.name === name);
+          if (found === undefined) throw new Error(`No ${name} run`);
+          return found;
+        };
+        // The run's own error is the same for the app's failure and the runtime's.
+        expect(names.map((name) => [run(name).status, run(name).failure])).toEqual([
+          ["succeeded", null],
+          ["failed", "ToolCallFailed"],
+          ["failed", "ToolCallFailed"],
+        ]);
+
+        const spans = yield* telemetry.search("schedule.run", { "executor.app.id": app.id }).pipe(
+          Effect.map((found) =>
+            found.data.filter(({ span }) => span.operationName === "schedule.run"),
+          ),
+          Effect.flatMap((found) =>
+            names.every((name) =>
+              found.some(({ span }) => span.tags["executor.run.id"] === run(name).id),
+            )
+              ? Effect.succeed(found)
+              : Effect.fail(new Pending({ found: found.length })),
+          ),
+          Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 60 }),
+        );
+        yield* evidence.json(
+          "schedule-run-spans.json",
+          spans.map(({ traceId, span }) => ({ traceId, status: span.status, tags: span.tags })),
+        );
+        const spanOf = (name: (typeof names)[number]) => {
+          const found = spans.find(({ span }) => span.tags["executor.run.id"] === run(name).id);
+          if (found === undefined) throw new Error(`No span of the ${name} run`);
+          return found;
+        };
+        // Its span says what each call failed with, and a run that succeeded records no source.
+        expect(spanOf("fine").span.tags).toMatchObject({ "executor.outcome": "completed" });
+        expect(spanOf("fine").span.tags).not.toHaveProperty("executor.failure.source");
+        expect(spanOf("crash").span.tags).toMatchObject({
+          "executor.outcome": "failed",
+          "error.type": "ToolCallFailed",
+          "executor.failure.source": "app",
+        });
+        expect(spanOf("lost").span.tags).toMatchObject({
+          "executor.outcome": "failed",
+          "error.type": "ToolCallFailed",
+          "executor.failure.source": "runtime",
+        });
+
+        if (target.metadata.target === "cloud") {
+          // Each run's trace holds the coordinator's pass that claimed it. That pass found the run
+          // due, at least, and the oldest due schedule it found waited at least as long as the run.
+          for (const name of names) {
+            const { traceId, span } = spanOf(name);
+            const pass = yield* telemetry.query(traceId).pipe(
+              Effect.map((trace) =>
+                trace.data.find(
+                  ({ span }) =>
+                    span.operationName === "schedule.dispatch" &&
+                    span.tags["executor.schedule.runner"] === "cloud",
+                ),
+              ),
+              Effect.flatMap((found) =>
+                found === undefined
+                  ? Effect.fail(new Pending({ found: 0 }))
+                  : Effect.succeed(found.span.tags),
+              ),
+              Effect.retry({ schedule: Schedule.spaced("500 millis"), times: 60 }),
+            );
+            yield* evidence.json(`${name}-dispatch.json`, pass);
+            expect(Number(pass["executor.schedule.due"])).toBeGreaterThanOrEqual(1);
+            expect(Number(pass["executor.schedule.oldest_due_ms"])).toBeGreaterThanOrEqual(
+              Number(span.tags["executor.schedule.lateness_ms"]),
+            );
+          }
+        }
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/self-host-sso.spec.ts b/e2e/tests/self-host-sso.spec.ts
index 5ae9bcc72c..f4d3d0cada 100644
--- a/e2e/tests/self-host-sso.spec.ts
+++ b/e2e/tests/self-host-sso.spec.ts
@@ -6,6 +6,7 @@
  */
 import { expect, layer } from "@effect/vitest";
 import { Effect, FileSystem, Schema } from "effect";
+import type { Page } from "playwright";
 import { Browser } from "../support/browser.ts";
 import { TestLive, withCase } from "../support/case.ts";
 import { startControlledSelfHost } from "../support/managed-server.ts";
@@ -263,7 +264,7 @@ layer(TestLive, { excludeTestServices: true })("Self-host SSO", (it) => {
         yield* expectExplainedRejection(
           origin,
           "Provider verifies a password account's address",
-          "This email already has a password account on this instance. Sign in with your password.",
+          "This email already has a password account on this instance. Sign in with your password, then connect SSO on your account's Security page.",
         );
         yield* idp.configure("member@outside.example.test", "valid");
         yield* expectExplainedRejection(
@@ -274,4 +275,69 @@ layer(TestLive, { excludeTestServices: true })("Self-host SSO", (it) => {
       }),
     ),
   );
+
+  it.effect(scenarios.selfHostSsoConnectPasswordAccount.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const browser = yield* Browser;
+        // Setup leaves the password owner signed in.
+        const { idp, origin } = yield* startSsoInstance("valid");
+        const card = (page: Page) =>
+          page.getByRole("heading", { name: "Single sign-on", exact: true });
+        yield* browser.use("Open Security", (page) => page.goto(`${origin}/account/security`));
+        yield* browser.use("Security offers to connect SSO", (page) => card(page).waitFor());
+        yield* browser.checkpoint("Security offers to connect SSO");
+
+        // The provider signs in someone else: the instance refuses to connect it and says why.
+        yield* idp.configure("member@sso.example.test", "valid");
+        yield* browser.use("Connect another person's SSO account", (page) =>
+          page.getByRole("button", { name: "Connect SSO", exact: true }).click(),
+        );
+        const refused = yield* browser.use("Read the refusal", (page) =>
+          page
+            .waitForURL(
+              (url) => url.pathname === "/account/security" && url.searchParams.has("error"),
+            )
+            .then(() => page.getByRole("alert").textContent()),
+        );
+        expect(refused).toBe(
+          "Your identity provider signed you in with a different email address. Connect the SSO account that uses this account's email.",
+        );
+        yield* browser.checkpoint("SSO for another email is refused with a reason");
+
+        // The provider verifies the owner's own address: SSO is connected to the password account.
+        yield* idp.configure("owner@sso.example.test", "valid");
+        yield* browser.use("Connect the owner's SSO account", (page) =>
+          page.getByRole("button", { name: "Connect SSO", exact: true }).click(),
+        );
+        yield* browser.use("Security shows SSO connected", (page) =>
+          page
+            .waitForURL(
+              (url) => url.pathname === "/account/security" && !url.searchParams.has("error"),
+            )
+            .then(() =>
+              page
+                .getByText("Connected. You can sign in with SSO or with your password.")
+                .waitFor(),
+            ),
+        );
+        yield* browser.checkpoint("SSO connected to the password owner");
+
+        // The owner now signs in with SSO as the same account.
+        yield* continueWithSso(origin, "Owner signs in with connected SSO");
+        yield* browser.use("The owner leaves sign-in", (page) =>
+          page.waitForURL(
+            (url) =>
+              url.origin === origin &&
+              !url.pathname.startsWith("/login") &&
+              !url.pathname.startsWith("/api/"),
+          ),
+        );
+        expect(yield* session(origin)).toEqual({
+          user: expect.objectContaining({ email: "owner@sso.example.test", emailVerified: true }),
+        });
+      }),
+    ),
+  );
 });
diff --git a/e2e/tests/storage-migration-diagnostics.spec.ts b/e2e/tests/storage-migration-diagnostics.spec.ts
new file mode 100644
index 0000000000..76089989e6
--- /dev/null
+++ b/e2e/tests/storage-migration-diagnostics.spec.ts
@@ -0,0 +1,48 @@
+import { expect, layer } from "@effect/vitest";
+import { Effect, FileSystem, Schema } from "effect";
+import { TestLive, withCase } from "../support/case.ts";
+import { legacyStorage } from "../support/legacy-storage.ts";
+import { Target } from "../support/platform.ts";
+import { serverControl } from "../support/server-control.ts";
+import { scenarios } from "../test-plan.ts";
+
+const Version = Schema.Tuple([Schema.Struct({ value: Schema.String })]);
+const readVersion = { sql: "SELECT value FROM private_executor_settings WHERE key = 'version'" };
+
+layer(TestLive, { excludeTestServices: true })("Storage migration diagnostics", (it) => {
+  it.effect(scenarios.storageMigrationDiagnostics.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target;
+        const fs = yield* FileSystem.FileSystem;
+        const [current] = yield* legacyStorage([readVersion]);
+        const [{ value: version }] = Schema.decodeUnknownSync(Version)(current);
+        // The journal is put back as it was, whatever version this release records.
+        yield* Effect.addFinalizer(() =>
+          legacyStorage([
+            {
+              sql: "UPDATE private_executor_settings SET value = $1 WHERE key = 'version'",
+              params: [version],
+            },
+          ]).pipe(Effect.andThen(serverControl("start")), Effect.orDie),
+        );
+        // An interrupted upgrade can leave the column present while its journal needs repair.
+        yield* legacyStorage([
+          { sql: "UPDATE private_executor_settings SET value = '4.0.1' WHERE key = 'version'" },
+        ]);
+        yield* serverControl("start", 500);
+        const log = yield* fs.readFileString(`${target.directory}/server.log`);
+        expect(log).toContain("StorageMigrationFailed");
+        expect(log).toContain("at executor version 4.0.2:");
+        expect(log).toContain("(SQLSTATE 42701)");
+        // Neither the statement nor the driver's message, which names the table, is kept.
+        expect(log).not.toContain("Failed to execute migration statement:");
+        expect(log.toLowerCase()).not.toContain('add column "generation"');
+        expect(log.toLowerCase()).not.toContain('column "generation"');
+        const [rows] = yield* legacyStorage([readVersion]);
+        expect(rows).toEqual([{ value: "4.0.1" }]);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/superseded-reads.spec.ts b/e2e/tests/superseded-reads.spec.ts
index 85af640b11..f18ca1b787 100644
--- a/e2e/tests/superseded-reads.spec.ts
+++ b/e2e/tests/superseded-reads.spec.ts
@@ -14,6 +14,8 @@ const overview = "**/api/organizations/*/billing";
 const held = 1_500;
 const pollInterval = 30_000;
 const polls = 3;
+const overviewRead = (request: Request) =>
+  request.method() === "GET" && /\/api\/organizations\/[^/]+\/billing$/.test(request.url());
 
 interface Read {
   readonly request: Request;
@@ -33,11 +35,7 @@ layer(HostedLive, { excludeTestServices: true })("Superseded reads", (it) => {
         const observe = (page: Page) => {
           const find = (request: Request) => reads.find((read) => read.request === request);
           page.on("request", (request) => {
-            if (
-              request.method() === "GET" &&
-              /\/api\/organizations\/[^/]+\/billing$/.test(request.url())
-            )
-              reads.push({ request, responded: false, ended: undefined });
+            if (overviewRead(request)) reads.push({ request, responded: false, ended: undefined });
           });
           page.on("response", (response) => {
             const read = find(response.request());
@@ -72,9 +70,11 @@ layer(HostedLive, { excludeTestServices: true })("Superseded reads", (it) => {
           page.route(overview, hold),
         );
         const before = reads.length;
+        // A poll fires near the end of the advanced interval, and its request event can arrive
+        // after `runFor` returns, so each poll waits for the read it sends.
         for (let poll = 1; poll <= polls; poll += 1)
           yield* browser.use(`Poll ${poll} while the previous read is held`, (page) =>
-            page.clock.runFor(pollInterval),
+            Promise.all([page.waitForRequest(overviewRead), page.clock.runFor(pollInterval)]),
           );
         const polled = reads.slice(before);
         const latest = polled.at(-1);
diff --git a/e2e/tests/telemetry-store-bound.spec.ts b/e2e/tests/telemetry-store-bound.spec.ts
new file mode 100644
index 0000000000..a40a569346
--- /dev/null
+++ b/e2e/tests/telemetry-store-bound.spec.ts
@@ -0,0 +1,131 @@
+/**
+ * The bundled collector, once its store is full, keeps the traces it holds while an idle server
+ * trickles in small exports, instead of evicting the oldest for every export.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, FileSystem, Schema } from "effect";
+import { HttpBody, HttpClient } from "effect/http";
+import { randomBytes } from "node:crypto";
+import { TestLive, withCase } from "../support/case.ts";
+import { serveOtlpCollector } from "../support/otlp-collector.ts";
+import { Target } from "../support/platform.ts";
+import { scenarios } from "../test-plan.ts";
+
+/** A bound a few seconds of exports cross; the shipped bound is 1 GiB. */
+const boundMegabytes = 8;
+/** An idle server's exports: one small trace each. */
+const idleExports = 20;
+
+const Evictions = Schema.Struct({
+  evictions: Schema.Struct({ passes: Schema.Number, traces: Schema.Number }),
+});
+
+const attribute = (key: string, value: string) => ({ key, value: { stringValue: value } });
+
+/** One OTLP export of whole traces, `spans` spans each, shaped like the product's database spans. */
+const traceExport = (traceIds: ReadonlyArray<string>, spans: number) => {
+  const now = BigInt(Date.now()) * 1_000_000n;
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: [attribute("service.name", "executor-selfhost")] },
+        scopeSpans: [
+          {
+            scope: { name: "executor" },
+            spans: traceIds.flatMap((traceId) => {
+              const root = randomBytes(8).toString("hex");
+              return Array.from({ length: spans }, (_, index) => ({
+                traceId,
+                spanId: index === 0 ? root : randomBytes(8).toString("hex"),
+                ...(index === 0 ? {} : { parentSpanId: root }),
+                name: index === 0 ? "schedule.dispatch" : "sql.execute",
+                kind: 1,
+                startTimeUnixNano: String(now - 5_000_000n),
+                endTimeUnixNano: String(now),
+                attributes: [
+                  attribute("db.system.name", "sqlite"),
+                  attribute(
+                    "db.query.text",
+                    `select "id", "due_at" from "executor_schedules" where "due_at" <= ? limit ${index}`,
+                  ),
+                  attribute("executor.record.id", randomBytes(20).toString("hex")),
+                ],
+                status: { code: 1 },
+              }));
+            }),
+          },
+        ],
+      },
+    ],
+  };
+};
+
+layer(TestLive, { excludeTestServices: true })("Telemetry store bound", (it) => {
+  it.effect(scenarios.telemetryStoreIdleAtBound.title, (context) =>
+    withCase(
+      context,
+      Effect.gen(function* () {
+        const target = yield* Target,
+          fs = yield* FileSystem.FileSystem,
+          http = yield* HttpClient.HttpClient;
+        const directory = yield* fs.makeTempDirectory({
+          directory: target.directory,
+          prefix: "collector",
+        });
+        const collector = yield* serveOtlpCollector(directory, {
+          MOTEL_OTEL_MAX_DB_SIZE_MB: String(boundMegabytes),
+        });
+        const send = (traceIds: ReadonlyArray<string>, spans: number) =>
+          Effect.scoped(
+            http.post(new URL("/v1/traces", collector).href, {
+              body: HttpBody.jsonUnsafe(traceExport(traceIds, spans)),
+            }),
+          ).pipe(Effect.map(({ status }) => status));
+        const stored = (traceId: string) =>
+          Effect.scoped(http.get(new URL(`/api/traces/${traceId}`, collector).href)).pipe(
+            Effect.map(({ status }) => status === 200),
+          );
+        const ingestStatus = Effect.scoped(
+          http.get(new URL("/api/ingest", collector).href).pipe(Effect.flatMap((r) => r.json)),
+        );
+        const evictions = (status: unknown) =>
+          Schema.decodeUnknownEffect(Evictions)(status).pipe(
+            Effect.map(({ evictions }) => evictions),
+          );
+        const newId = () => randomBytes(16).toString("hex");
+
+        // Fill the store, two 40-span traces an export, until it evicts its first trace.
+        const sent: Array<string> = [];
+        while (sent.length === 0 || (yield* stored(sent[0]!))) {
+          const traceIds = [newId(), newId()];
+          expect(yield* send(traceIds, 40)).toBe(200);
+          sent.push(...traceIds);
+        }
+        // Traces are evicted oldest first, so the ones still stored are a suffix of those sent.
+        let low = 0;
+        let high = sent.length - 1;
+        while (low < high) {
+          const middle = Math.floor((low + high) / 2);
+          if (yield* stored(sent[middle]!)) high = middle;
+          else low = middle + 1;
+        }
+        const oldest = sent[low]!;
+        const filled = yield* ingestStatus;
+
+        // An idle server's exports, about half a MiB in all, after the store first evicted.
+        const idle = Array.from({ length: idleExports }, newId);
+        for (const traceId of idle) expect(yield* send([traceId], 10)).toBe(200);
+
+        expect(yield* stored(oldest), "The oldest stored trace is still stored").toBe(true);
+        for (const traceId of idle) expect(yield* stored(traceId)).toBe(true);
+        // The export that crossed the bound evicted down to the low-water mark in one pass.
+        const passes = yield* evictions(filled);
+        expect(passes.passes, "Filling the store took one eviction pass").toBe(1);
+        expect(
+          yield* evictions(yield* ingestStatus),
+          "No idle export started an eviction pass",
+        ).toEqual(passes);
+      }),
+    ),
+  );
+});
diff --git a/e2e/tests/tool-call-overhead.spec.ts b/e2e/tests/tool-call-overhead.spec.ts
index e946ddb828..1abfbf7890 100644
--- a/e2e/tests/tool-call-overhead.spec.ts
+++ b/e2e/tests/tool-call-overhead.spec.ts
@@ -775,6 +775,7 @@ return await ${tools}.upstream.answer({})`,
         // Cloud also records the command where it reaches the app's supervisor.
         if (below(spans, warm, "runtime.cloud.call").length > 0) {
           const hop = one(below(spans, warm, "runtime.cloud.cache"), "supervisor command");
+          expect(hop.tags["executor.app.id"]).toBe(app.id);
           expect(hop.tags["cache.operation"]).toBe("acquire");
           expect(hop.tags["cache.reads"]).toBe("1");
           expect(hop.tags["cache.command.index"]).toBe("1");
@@ -879,6 +880,7 @@ export default defineApp({}, {
         const wokeIsolate = wake.tags["executor.supervisor.isolate_cold"] === "true";
         // Every command of that invocation reports the start its wake made, and so does its call.
         for (const command of below(spans, cold!, "runtime.cloud.cache")) {
+          expect(command.tags["executor.app.id"]).toBe(app.id);
           expect(command.tags["cache.supervisor.woke"]).toBe("true");
           expect(command.tags["cache.supervisor.woke_by"]).toBe("wake");
         }
@@ -893,6 +895,7 @@ export default defineApp({}, {
           for (const wake of below(spans, invocation, "runtime.cloud.wake"))
             expect(wake.tags["executor.supervisor.cold"]).toBe("false");
           for (const command of below(spans, invocation, "runtime.cloud.cache")) {
+            expect(command.tags["executor.app.id"]).toBe(app.id);
             expect(command.tags["cache.supervisor.woke"]).toBe("true");
             expect(command.tags["cache.supervisor.woke_by"]).toBe("earlier");
           }
diff --git a/e2e/tests/tool-call-read-ahead.spec.ts b/e2e/tests/tool-call-read-ahead.spec.ts
index 6fe5e9c575..000279baf2 100644
--- a/e2e/tests/tool-call-read-ahead.spec.ts
+++ b/e2e/tests/tool-call-read-ahead.spec.ts
@@ -71,9 +71,10 @@ const Execution = Schema.Struct({
   }),
 });
 
-/** One statement of the tool call, with the spans it ran under. */
+/** One statement of the tool call, with the FumaDB operation that ran it and the spans it ran under. */
 interface Statement {
   readonly text: string;
+  readonly operation: string | undefined;
   readonly under: ReadonlyArray<string>;
   readonly start: number;
   readonly end: number;
@@ -86,8 +87,7 @@ const isAccessCheck = (statement: Statement) =>
   statement.text.includes("left join hosted_app_access p on p.id =");
 /** The app read made ahead for the call, outside the SDK's tool call. */
 const isSelectionRead = (statement: Statement) =>
-  statement.under.includes("FumaDB.SqlQuery.findFirst") &&
-  !statement.under.includes("sdk.tools.call");
+  statement.operation === "findFirst" && !statement.under.includes("sdk.tools.call");
 /** The call's own reads of the app and accounts, made when nothing read ahead answered them. */
 const isCallRead = (statement: Statement) => statement.under.includes("sdk.invocation.snapshot");
 
@@ -296,6 +296,10 @@ layer(HostedLive, { excludeTestServices: true })("Tool call read ahead", (it) =>
                     span.operationName === "sql.pipeline"
                       ? batchMarker
                       : String(span.tags["db.query.text"] ?? "").replace(/\s+/g, " "),
+                  operation:
+                    typeof span.tags["fumadb.operation"] === "string"
+                      ? span.tags["fumadb.operation"]
+                      : undefined,
                   under,
                   start,
                   end: start + span.durationMs,
diff --git a/e2e/tests/tool-index-redeploy.spec.ts b/e2e/tests/tool-index-redeploy.spec.ts
index 501782ac8a..cf605dbf01 100644
--- a/e2e/tests/tool-index-redeploy.spec.ts
+++ b/e2e/tests/tool-index-redeploy.spec.ts
@@ -183,7 +183,7 @@ return await ${tools}.status({});`,
         ]);
         expect(sameProgram.execution.error?.kind).toBe("UnknownTool");
         expect(sameProgram.execution.error?.suggestions).toEqual([
-          `This execute loaded '${app.slug}' from version ${recovered} when it first reached the app. If the app was deployed after that, call its new tools in a new execute. Otherwise use search to find the app's tools.`,
+          `This execute loaded '${app.slug}' from version ${recovered} when it first reached the app. If the app was deployed after that, call its new tools in a new execute. If the tool was added to the service behind the app, Executor is checking the app for new tools now; they appear within a few minutes, so call it again in a new execute. Otherwise use search to find the app's tools.`,
         ]);
         const nextProgram = yield* execute(
           "Call the new tool in the next execute",
diff --git a/e2e/tests/tools-index-cache.spec.ts b/e2e/tests/tools-index-cache.spec.ts
index 98ffe48250..20074172be 100644
--- a/e2e/tests/tools-index-cache.spec.ts
+++ b/e2e/tests/tools-index-cache.spec.ts
@@ -35,7 +35,7 @@ const indexTools = (actor: Session, app: string, label: string) =>
   });
 
 /** The app's cache round trips, read from the index request's delivered trace. */
-const cacheTrips = (index: Effect.Success<ReturnType<typeof indexTools>>) =>
+const cacheTrips = (index: Effect.Success<ReturnType<typeof indexTools>>, app: string) =>
   Effect.gen(function* () {
     const evidence = yield* Evidence,
       telemetry = yield* Telemetry;
@@ -51,6 +51,9 @@ const cacheTrips = (index: Effect.Success<ReturnType<typeof indexTools>>) =>
       Effect.retry({ schedule: Schedule.spaced("1 second"), times: 40 }),
     );
     const commands = spans.filter((span) => span.operationName === "app.cache.command");
+    const host = spans.filter((span) => span.operationName === "runtime.cloud.cache");
+    // Each host-side command names the app whose supervisor it reached.
+    for (const span of host) expect(span.tags["executor.app.id"], index.label).toBe(app);
     const result = spans.find((span) => span.operationName === "app.cache.get")?.tags[
       "cache.result"
     ];
@@ -62,9 +65,7 @@ const cacheTrips = (index: Effect.Success<ReturnType<typeof indexTools>>) =>
         ms: span.durationMs,
       })),
       // Cloud also reports each command from the host side of the RPC when it has arrived.
-      host: spans
-        .filter((span) => span.operationName === "runtime.cloud.cache")
-        .map((span) => ({ operation: span.tags["cache.operation"], ms: span.durationMs })),
+      host: host.map((span) => ({ operation: span.tags["cache.operation"], ms: span.durationMs })),
     });
     return {
       result,
@@ -175,7 +176,7 @@ layer(HostedLive, { excludeTestServices: true })("Tools index cache", (it) => {
         expect(revisedListing.dispatched).toBe(true);
 
         const [first, second, third] = yield* Effect.all(
-          [cacheTrips(cold), cacheTrips(revised), cacheTrips(other)],
+          [cacheTrips(cold, app.id), cacheTrips(revised, app.id), cacheTrips(other, app.id)],
           { concurrency: "unbounded" },
         );
 
diff --git a/e2e/tests/webhook-source-retry-backoff.spec.ts b/e2e/tests/webhook-source-retry-backoff.spec.ts
index 722b7e9eec..6fa3aeaf1b 100644
--- a/e2e/tests/webhook-source-retry-backoff.spec.ts
+++ b/e2e/tests/webhook-source-retry-backoff.spec.ts
@@ -2,6 +2,13 @@
  * A webhook source whose account's OAuth renewal the service keeps refusing backs off: each failure
  * in a row doubles its wait from 30 seconds, so the token endpoint is not asked again every tick.
  * New intent, such as configuring the source, runs at once and starts the count again.
+ *
+ * A source whose account must reconnect waits the same way: the attempt that finds it waiting and
+ * each check that finds the account still waiting double the next wait. Reconnecting the account
+ * ends the wait at once.
+ *
+ * A source waiting for a person to finish a manual setup waits the same way, since another attempt
+ * cannot finish it. Completing the setup runs it at once.
  */
 import { expect, layer } from "@effect/vitest";
 import { Clock, Effect, Schedule, Schema } from "effect";
@@ -19,6 +26,8 @@ import { serverControl } from "../support/server-control.ts";
 import { settleWebhookSources, sourcesAre } from "../support/webhook-sources.ts";
 import { scenarios } from "../test-plan.ts";
 import { appsManifest } from "../support/apps-release.ts";
+import { appLinksFixture, keyProvider, okBody } from "../support/app-links.ts";
+import { webhookSubscriptions } from "../support/webhook-sources.ts";
 
 const AppProvider = Schema.Struct({ id: Schema.String });
 const SignIn = Schema.Struct({ authorizationUrl: Schema.String });
@@ -35,29 +44,45 @@ const tick = 5_000;
 /** Real time to wait for a tick the product's clock has made due. */
 const quiet = tick + 1_500;
 
-layer(HostedLive, { excludeTestServices: true })("Webhook source retry backoff", (it) => {
-  it.effect(
-    scenarios.webhookSourceRetryBackoff.title,
-    (context) =>
-      withHostedCase(
-        context,
-        Effect.gen(function* () {
-          const api = yield* Api,
-            actors = yield* Actors,
-            evidence = yield* Evidence,
-            telemetry = yield* Telemetry,
-            http = yield* HttpClient.HttpClient;
-          const issuer = yield* oauthSetupIssuer;
-          const prefix = `/api/organizations/${actors.organization.id}`;
-          // Tokens issued inside the host's renewal window renew on every use.
-          yield* issuer.configure({ refreshTokens: true, expiresIn: 20 });
-          const name = `Retry backoff ${randomUUID().slice(0, 8)}`;
-          const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
-            name,
-            files: [
-              {
-                path: "index.ts",
-                content: `import { defineApp, defineProvider, oauth2, query, object, string, router } from "apps";
+/**
+ * The running product's wall clock: the runner's, plus every advance this scenario made. Both
+ * processes read the same system clock.
+ */
+const productClock = Effect.sync(() => {
+  let offset = 0;
+  const productNow = Clock.currentTimeMillis.pipe(Effect.map((now) => now + offset));
+  /** Move the running product's clock forward to `at`, in its time. */
+  const advanceTo = (at: number) =>
+    Effect.gen(function* () {
+      const milliseconds = Math.ceil(at - (yield* productNow));
+      expect(milliseconds, "The scenario moves the clock forward only").toBeGreaterThan(0);
+      yield* serverControl("clock/advance", 200, { milliseconds });
+      offset += milliseconds;
+    });
+  return { productNow, advanceTo };
+});
+
+/**
+ * Deploy an app with a user-account webhook and connect the owner's account from it, which makes
+ * the account the app's webhook source, and wait for it to register. Returns the source and the
+ * controls both scenarios use: the product's clock, the source's configuration and a sign-in
+ * that creates or reconnects the account.
+ */
+const registeredSource = Effect.gen(function* () {
+  const api = yield* Api,
+    actors = yield* Actors,
+    http = yield* HttpClient.HttpClient;
+  const issuer = yield* oauthSetupIssuer;
+  const prefix = `/api/organizations/${actors.organization.id}`;
+  // Tokens issued inside the host's renewal window renew on every use.
+  yield* issuer.configure({ refreshTokens: true, expiresIn: 20 });
+  const name = `Retry backoff ${randomUUID().slice(0, 8)}`;
+  const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+    name,
+    files: [
+      {
+        path: "index.ts",
+        content: `import { defineApp, defineProvider, oauth2, query, object, string, router } from "apps";
 const service = defineProvider({ name: ${JSON.stringify(name)}, auth: { oauth: oauth2({ discover: ${JSON.stringify(`${issuer.origin}/mcp`)} }) } });
 const incoming = { account: { user: "service" }, config: object({ channel: string().optional() }), state: object({}),
   register: async () => ({}), unregister: async () => {}, handle: async () => Response.json({}) };
@@ -65,76 +90,139 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({
   tools: router({ ready: query({ input: object({}) }, async (ctx) => ctx.user.accounts.service.id) }),
   webhooks: { incoming },
 }));`,
-              },
-              appsManifest,
-            ],
-          });
-          expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
-          const app = yield* body(AppProvider, deployed);
-          const path = `${prefix}/apps/${app.id}`;
-          yield* Effect.addFinalizer(() =>
-            api.request(actors.owner, "DELETE", path).pipe(Effect.orDie),
-          );
+      },
+      appsManifest,
+    ],
+  });
+  expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+  const app = yield* body(AppProvider, deployed);
+  const path = `${prefix}/apps/${app.id}`;
+  yield* Effect.addFinalizer(() => api.request(actors.owner, "DELETE", path).pipe(Effect.orDie));
 
-          // Connecting an account from the app links it for the owner, which makes it the app's
-          // webhook source. Its renewals still succeed, so the source registers.
-          const connection = yield* body(
-            Resource,
-            yield* api.request(actors.owner, "POST", connectionsPath(path, "user", "service"), {}),
-          );
-          const started = yield* api.request(
-            actors.owner,
-            "POST",
-            `${prefix}/connections/${connection.id}/oauth/start`,
-            { method: "oauth", label: "Synthetic webhook source account" },
-          );
-          expect(started.status, JSON.stringify(started.body)).toBe(200);
-          const { authorizationUrl } = yield* body(SignIn, started);
-          const callbackUrl = yield* Effect.scoped(
-            Effect.gen(function* () {
-              const consent = yield* HttpClient.withScope(http).get(authorizationUrl);
-              expect(consent.status).toBe(302);
-              const location = consent.headers.location;
-              if (location === undefined)
-                return yield* Effect.die("Issuer did not return a callback");
-              return location;
-            }),
-          ).pipe(
-            Effect.provideService(FetchHttpClient.RequestInit, {
-              redirect: "manual",
-            }),
-          );
-          const completed = yield* api.request(
-            actors.owner,
-            "POST",
-            `${prefix}/connections/${connection.id}/oauth/complete`,
-            { callbackUrl },
-          );
-          expect(completed.status, JSON.stringify(completed.body)).toBe(200);
-          const account = (yield* body(Resource, completed)).id;
-          yield* Effect.addFinalizer(() =>
-            api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`).pipe(Effect.orDie),
-          );
-          yield* settleWebhookSources(
-            actors.owner,
-            path,
-            sourcesAre({ [account]: { status: "ready", failure: null } }),
-          );
+  /**
+   * Complete the issuer's consent for a connection made from the app: without `account` it
+   * creates an account and links it, with one it reconnects that account.
+   */
+  const signIn = (account?: string) =>
+    Effect.gen(function* () {
+      const connection = yield* body(
+        Resource,
+        yield* api.request(
+          actors.owner,
+          "POST",
+          connectionsPath(path, "user", "service"),
+          account === undefined ? {} : { account },
+        ),
+      );
+      const started = yield* api.request(
+        actors.owner,
+        "POST",
+        `${prefix}/connections/${connection.id}/oauth/start`,
+        { method: "oauth", label: "Synthetic webhook source account" },
+      );
+      expect(started.status, JSON.stringify(started.body)).toBe(200);
+      const { authorizationUrl } = yield* body(SignIn, started);
+      const callbackUrl = yield* Effect.scoped(
+        Effect.gen(function* () {
+          const consent = yield* HttpClient.withScope(http).get(authorizationUrl);
+          expect(consent.status).toBe(302);
+          const location = consent.headers.location;
+          if (location === undefined) return yield* Effect.die("Issuer did not return a callback");
+          return location;
+        }),
+      ).pipe(Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }));
+      const completed = yield* api.request(
+        actors.owner,
+        "POST",
+        `${prefix}/connections/${connection.id}/oauth/complete`,
+        { callbackUrl },
+      );
+      expect(completed.status, JSON.stringify(completed.body)).toBe(200);
+      return (yield* body(Resource, completed)).id;
+    });
 
-          /**
-           * The product's wall clock: the runner's, plus every advance this scenario made. Both
-           * processes read the same system clock.
-           */
-          let offset = 0;
-          const productNow = Clock.currentTimeMillis.pipe(Effect.map((now) => now + offset));
-          /** Move the running product's clock forward to `at`, in its time. */
-          const advanceTo = (at: number) =>
-            Effect.gen(function* () {
-              const milliseconds = Math.ceil(at - (yield* productNow));
-              expect(milliseconds, "The scenario moves the clock forward only").toBeGreaterThan(0);
-              yield* serverControl("clock/advance", 200, { milliseconds });
-              offset += milliseconds;
-            });
+  // Its renewals still succeed, so the source registers.
+  const account = yield* signIn();
+  yield* Effect.addFinalizer(() =>
+    api.request(actors.owner, "DELETE", `${prefix}/accounts/${account}`).pipe(Effect.orDie),
+  );
+  yield* settleWebhookSources(
+    actors.owner,
+    path,
+    sourcesAre({ [account]: { status: "ready", failure: null } }),
+  );
+
+  const { productNow, advanceTo } = yield* productClock;
+  /** Save new configuration for the source, which is new intent. */
+  const configure = (channel: string) =>
+    api
+      .request(actors.owner, "PUT", `${path}/webhook-sources/${account}/config`, {
+        config: { incoming: { channel } },
+      })
+      .pipe(
+        Effect.tap((response) =>
+          Effect.sync(() => expect(response.status, JSON.stringify(response.body)).toBe(200)),
+        ),
+      );
+  return { app, path, account, issuer, signIn, productNow, advanceTo, configure };
+});
+
+/** An app-account webhook a person sets up at the provider by hand. */
+const manualSetupSource = `import { defineApp, defineProvider, secrets, query, object, string, router } from "apps";
+const team = ${keyProvider("Manual setup wait fixture")};
+const inbound = { account: { app: "team" }, config: object({}), state: object({}),
+  setup: { instructions: "Paste the callback URL into the provider's webhook settings.", signingSecret: "executor" },
+  handle: async () => Response.json({ received: true }) };
+export default defineApp({ app: { accounts: { team } } },
+  async () => ({ tools: router({ ping: query({ input: object({}) }, async () => "pong") }), webhooks: { inbound } }));`;
+const SetupStep = Schema.Struct({ step: Schema.Literal("configure"), revision: Schema.String });
+const SetupResult = Schema.Struct({ id: Schema.String, status: Schema.String });
+
+/** The legacy storage statement that reads a source's stored row. */
+const sourceRow = (app: string, account: string) => ({
+  sql: `select status, failure, retries, lease,
+    (extract(epoch from lease_until) * 1000)::float8 as lease_until
+    from executor_webhook_sources where app = $1 and account = $2`,
+  params: [app, account],
+});
+
+/**
+ * Run `read`, the scenario's legacy storage read of `sourceRow`, which stops the product, then
+ * start it again and return the row.
+ */
+const storedRow = <E, R>(read: Effect.Effect<ReadonlyArray<ReadonlyArray<unknown>>, E, R>) =>
+  Effect.gen(function* () {
+    const [rows] = yield* read;
+    yield* serverControl("start");
+    expect(rows, "The source has one stored row").toHaveLength(1);
+    return yield* Schema.decodeUnknownEffect(SourceRow)(rows?.[0]).pipe(Effect.orDie);
+  });
+
+/** Wait until `count` delivered spans exist, polling `spans`, and return how many there are. */
+const spansReach = <E, R>(spans: Effect.Effect<readonly unknown[], E, R>, count: number) =>
+  spans.pipe(
+    Effect.flatMap((found) =>
+      found.length >= count
+        ? Effect.succeed(found.length)
+        : Effect.fail(new Error(`${found.length} of ${count} spans delivered`)),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("200 millis"), times: 150 }),
+    Effect.orDie,
+  );
+
+layer(HostedLive, { excludeTestServices: true })("Webhook source retry backoff", (it) => {
+  it.effect(
+    scenarios.webhookSourceRetryBackoff.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const actors = yield* Actors,
+            evidence = yield* Evidence,
+            telemetry = yield* Telemetry;
+          const { app, path, account, issuer, productNow, advanceTo, configure } =
+            yield* registeredSource;
+          const stored = storedRow(legacyStorage([sourceRow(app.id, account)]));
           /** Delivered spans of the source's attempts that the host's tick started. */
           const attempts = telemetry
             .spans("sdk.webhooks.reconcileSource", {
@@ -143,47 +231,8 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({
             })
             .pipe(Effect.orDie);
           /** Wait until `count` attempts have completed, and return the token requests made. */
-          const attemptsReach = (count: number) =>
-            attempts.pipe(
-              Effect.flatMap((spans) =>
-                spans.length >= count
-                  ? Effect.succeed(spans.length)
-                  : Effect.fail(new Error(`${spans.length} of ${count} attempts completed`)),
-              ),
-              Effect.retry({
-                schedule: Schedule.spaced("200 millis"),
-                times: 150,
-              }),
-              Effect.orDie,
-            );
+          const attemptsReach = (count: number) => spansReach(attempts, count);
           const refreshes = issuer.metrics.pipe(Effect.map((metrics) => metrics.refreshes));
-          /** Save new configuration for the source, which is new intent. */
-          const configure = (channel: string) =>
-            api
-              .request(actors.owner, "PUT", `${path}/webhook-sources/${account}/config`, {
-                config: { incoming: { channel } },
-              })
-              .pipe(
-                Effect.tap((response) =>
-                  Effect.sync(() =>
-                    expect(response.status, JSON.stringify(response.body)).toBe(200),
-                  ),
-                ),
-              );
-          /** Stop the product, read the source's stored row, then start it again. */
-          const stored = Effect.gen(function* () {
-            const [rows] = yield* legacyStorage([
-              {
-                sql: `select status, failure, retries, lease,
-                  (extract(epoch from lease_until) * 1000)::float8 as lease_until
-                  from executor_webhook_sources where app = $1 and account = $2`,
-                params: [app.id, account],
-              },
-            ]);
-            yield* serverControl("start");
-            expect(rows, "The source has one stored row").toHaveLength(1);
-            return yield* Schema.decodeUnknownEffect(SourceRow)(rows?.[0]).pipe(Effect.orDie);
-          });
           /**
            * Run `change` and wait for the attempt it causes to complete. Returns the product time
            * bounds of that attempt's completion and the token requests it made.
@@ -311,4 +360,251 @@ export default defineApp({ user: { accounts: { service } } }, async () => ({
       ),
     { timeout: 240_000 },
   );
+
+  it.effect(
+    scenarios.webhookSourceReconnectWait.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const actors = yield* Actors,
+            evidence = yield* Evidence,
+            telemetry = yield* Telemetry;
+          const { app, path, account, issuer, signIn, productNow, advanceTo, configure } =
+            yield* registeredSource;
+          const stored = storedRow(legacyStorage([sourceRow(app.id, account)]));
+          /**
+           * Delivered spans of the host's checks of whether the app's accounts still need a
+           * reconnect. Only a waiting source makes them: the app has no schedules.
+           */
+          const checks = telemetry
+            .spans("sdk.accounts.reconnectRequired", { "executor.app.id": app.id })
+            .pipe(Effect.orDie);
+          /**
+           * Move the clock past the source's wait and return the product time bounds of the check
+           * the next tick makes, once it has completed.
+           */
+          const check = (count: number, due: number) =>
+            Effect.gen(function* () {
+              const from = yield* productNow;
+              yield* advanceTo(due + 1);
+              yield* spansReach(checks, count);
+              const to = yield* productNow;
+              expect(yield* checks, "The due tick checked the accounts once").toHaveLength(count);
+              return { from, to };
+            });
+          /**
+           * The stored row after the attempt that found the account waiting and `retries - 1`
+           * checks that found it still waiting.
+           */
+          const waits = (
+            window: { readonly from: number; readonly to: number },
+            retries: number,
+            delay: number,
+          ) =>
+            Effect.gen(function* () {
+              const row = yield* stored;
+              expect(row).toMatchObject({
+                status: "needs-setup",
+                failure: "accounts",
+                retries,
+                lease: null,
+              });
+              // The attempt or check completed inside the window, so its wait is exactly `delay`.
+              expect(row.lease_until).toBeGreaterThanOrEqual(window.from + delay);
+              expect(row.lease_until).toBeLessThanOrEqual(window.to + delay);
+              yield* evidence.step(
+                `The account was found waiting ${retries} times; the next check is ${delay / 1000}s later`,
+                Effect.void,
+              );
+              return row;
+            });
+          /**
+           * Hold the product's clock at `at`, before the next check is due but past the wait an
+           * earlier check had, for longer than a tick: no check runs.
+           */
+          const holdsAt = (at: number, count: number) =>
+            Effect.gen(function* () {
+              yield* advanceTo(at);
+              yield* Effect.sleep(quiet);
+              expect(yield* checks, "No check ran before it was due").toHaveLength(count);
+            });
+
+          // The service ends the grant. Once the access token expires, the next attempt's renewal
+          // marks the account for reconnecting, and the source waits on it: that attempt is the
+          // first wait.
+          yield* issuer.configure({
+            tokenError: { status: 400, body: { error: "invalid_grant" } },
+          });
+          yield* advanceTo((yield* productNow) + 60_000);
+          const ended = yield* productNow;
+          yield* configure("ended");
+          yield* settleWebhookSources(
+            actors.owner,
+            path,
+            sourcesAre({ [account]: { status: "needs-setup", failure: "accounts" } }),
+          );
+          const one = yield* waits({ from: ended, to: yield* productNow }, 1, 30_000);
+          yield* issuer.configure({ tokenError: null });
+          const refreshes = (yield* issuer.metrics).refreshes;
+          // A stopping product delivers every span it recorded, so the count starts from here.
+          const initial = (yield* checks).length;
+
+          // Each check that finds the account still waiting doubles the next wait.
+          const two = yield* waits(yield* check(initial + 1, one.lease_until), 2, 60_000);
+          // Past the 30 seconds an earlier wait lasted, the source still waits.
+          yield* holdsAt(two.lease_until - 15_000, initial + 1);
+          const three = yield* waits(yield* check(initial + 2, two.lease_until), 3, 120_000);
+          // Past the 60 seconds an earlier wait lasted, the source still waits.
+          yield* holdsAt(three.lease_until - 50_000, initial + 2);
+          expect(
+            (yield* issuer.metrics).refreshes,
+            "A waiting source asks the token endpoint nothing",
+          ).toBe(refreshes);
+
+          // Reconnecting the account ends the wait: the next tick finds it usable and the source
+          // registers, well before its next check was due.
+          expect(yield* signIn(account), "The sign-in reconnected the same account").toBe(account);
+          yield* settleWebhookSources(
+            actors.owner,
+            path,
+            sourcesAre({ [account]: { status: "ready", failure: null } }),
+          );
+          expect(
+            yield* productNow,
+            "The source resumed before its next check was due",
+          ).toBeLessThan(three.lease_until);
+          expect(yield* stored).toMatchObject({
+            status: "ready",
+            failure: null,
+            retries: 0,
+            lease: null,
+          });
+        }),
+      ),
+    { timeout: 240_000 },
+  );
+
+  it.effect(
+    scenarios.webhookSourceSetupWait.title,
+    (context) =>
+      withHostedCase(
+        context,
+        Effect.gen(function* () {
+          const api = yield* Api,
+            actors = yield* Actors,
+            evidence = yield* Evidence,
+            telemetry = yield* Telemetry;
+          const { prefix, app, path, connect } = yield* appLinksFixture([
+            { path: "index.ts", content: manualSetupSource },
+          ]);
+          const { productNow, advanceTo } = yield* productClock;
+
+          // Linking an account makes it the app's webhook source, whose webhook waits for a person
+          // to set it up at the provider.
+          const linked = yield* productNow;
+          const account = yield* connect(actors.owner, "app", "team", "manual-setup-key");
+          yield* settleWebhookSources(
+            actors.owner,
+            path,
+            sourcesAre({ [account]: { status: "needs-setup", failure: "configuration" } }),
+          );
+          const [subscription] = (yield* webhookSubscriptions(actors.owner, path)).filter(
+            (row) => row.sourceAccount === account && row.status === "setup-required",
+          );
+          if (subscription === undefined)
+            return yield* Effect.die(new Error("The manual webhook is missing"));
+          const setupPath = `${prefix}/webhook-setup/${app.id}/${subscription.id}`;
+          // A finished setup stays active until a manager removes it by hand, which the app's
+          // removal waits for.
+          yield* Effect.addFinalizer(() =>
+            Effect.gen(function* () {
+              yield* api.request(actors.owner, "DELETE", setupPath);
+              yield* api.request(actors.owner, "POST", `${setupPath}/confirm-removal`);
+            }).pipe(Effect.orDie),
+          );
+
+          const stored = storedRow(legacyStorage([sourceRow(app.id, account)]));
+          /** Delivered spans of the source's attempts. */
+          const attempts = telemetry
+            .spans("sdk.webhooks.reconcileSource", {
+              "executor.app.id": app.id,
+              "executor.account.id": account,
+            })
+            .pipe(Effect.orDie);
+          /** The stored row after `retries` attempts in a row found the setup unfinished. */
+          const waits = (
+            window: { readonly from: number; readonly to: number },
+            retries: number,
+            delay: number,
+          ) =>
+            Effect.gen(function* () {
+              const row = yield* stored;
+              expect(row).toMatchObject({
+                status: "needs-setup",
+                failure: "configuration",
+                retries,
+                lease: null,
+              });
+              // The attempt completed inside the window, so its wait is exactly `delay`.
+              expect(row.lease_until).toBeGreaterThanOrEqual(window.from + delay);
+              expect(row.lease_until).toBeLessThanOrEqual(window.to + delay);
+              yield* evidence.step(
+                `${retries} attempts found the setup unfinished; the next is ${delay / 1000}s later`,
+                Effect.void,
+              );
+              return row;
+            });
+
+          // The attempt that found the setup unfinished waits 30 seconds.
+          const one = yield* waits({ from: linked, to: yield* productNow }, 1, 30_000);
+          // A stopping product delivers every span it recorded, so the count starts from here.
+          const initial = yield* spansReach(attempts, 1);
+
+          // Once they pass, the next tick tries again, still finds it unfinished and waits twice
+          // as long.
+          const from = yield* productNow;
+          yield* advanceTo(one.lease_until + 1);
+          yield* spansReach(attempts, initial + 1);
+          const two = yield* waits({ from, to: yield* productNow }, 2, 60_000);
+          // Past the 30 seconds the first wait lasted, it still waits.
+          yield* advanceTo(two.lease_until - 15_000);
+          yield* Effect.sleep(quiet);
+          expect(yield* attempts, "No attempt ran before the next was due").toHaveLength(
+            initial + 1,
+          );
+
+          // A manager finishes the setup. That runs the source at once, well before its next
+          // attempt was due, and it is ready.
+          const opened = yield* okBody(
+            SetupStep,
+            yield* api.request(actors.owner, "GET", setupPath),
+          );
+          expect(
+            yield* okBody(
+              SetupResult,
+              yield* api.request(actors.owner, "POST", setupPath, {
+                revision: opened.revision,
+                state: {},
+              }),
+            ),
+          ).toMatchObject({ id: subscription.id, status: "active" });
+          yield* settleWebhookSources(
+            actors.owner,
+            path,
+            sourcesAre({ [account]: { status: "ready", failure: null } }),
+          );
+          expect(yield* productNow, "The source ran before its next attempt was due").toBeLessThan(
+            two.lease_until,
+          );
+          expect(yield* stored).toMatchObject({
+            status: "ready",
+            failure: null,
+            retries: 0,
+            lease: null,
+          });
+        }),
+      ),
+    { timeout: 240_000 },
+  );
 });
diff --git a/e2e/tests/workflow-controls.spec.ts b/e2e/tests/workflow-controls.spec.ts
new file mode 100644
index 0000000000..f4c81b8f4a
--- /dev/null
+++ b/e2e/tests/workflow-controls.spec.ts
@@ -0,0 +1,337 @@
+/**
+ * In-app workflow controls answer every app build, refuse invalid calls before the engine, and
+ * never present a start whose run is saved as one to repeat.
+ */
+import { expect, layer } from "@effect/vitest";
+import { Effect, Layer, Schema } from "effect";
+import { randomUUID } from "node:crypto";
+import { scenarios } from "../test-plan.ts";
+import { Api, body, SessionClients } from "../support/api.ts";
+import { Actors } from "../support/actors.ts";
+import { HostedLive, withHostedCase } from "../support/case.ts";
+import { App } from "../support/contracts.ts";
+import { Evidence } from "../support/evidence.ts";
+import { appsManifest } from "../support/apps-release.ts";
+import { startDevelopmentServer } from "../support/managed-server.ts";
+import { Target } from "../support/platform.ts";
+
+// Each tool returns what its control call answered, or the failure it threw. Releases before the
+// account scopes declare requirements as \`{ accounts: {} }\`; later ones as \`{}\`.
+const source = (
+  requirements: string,
+) => `import { defineApp, mutation, query, workflow, object, string, router } from "apps";
+const record = workflow({ input: object({ label: string() }) }, async (_ctx, input) => input.label);
+const settle = async (work) => {
+  try { return { ok: await work() }; }
+  catch (error: any) {
+    return { failed: { tag: error?._tag ?? null, reason: error?.reason ?? null, retryable: error?.retryable ?? null, message: error?.message ?? "" } };
+  }
+};
+const launch = mutation({ input: object({ label: string(), key: string() }) }, (ctx, input) =>
+  settle(async () => (await ctx.workflows.start({ workflow: "record", input: { label: input.label }, key: input.key })).id));
+const begin = mutation({ input: object({ label: string() }) }, (ctx, input) =>
+  settle(async () => (await ctx.workflows.start({ workflow: "record", input: { label: input.label } })).id));
+const runs = query({ input: object({}) }, (ctx) =>
+  settle(async () => (await ctx.workflows.list({ limit: 50 })).items.map((item) => item.id)));
+const peek = query({ input: object({ run: string() }) }, (ctx, input) =>
+  settle(async () => (await ctx.workflows.get({ run: input.run })).id));
+export default defineApp(${requirements}, { tools: router({ runs, peek, launch, begin }), workflows: { record } });`;
+
+const kinds = { launch: "mutation", begin: "mutation", runs: "query", peek: "query" } as const;
+const Failed = Schema.Struct({
+  tag: Schema.NullOr(Schema.String),
+  reason: Schema.NullOr(Schema.String),
+  retryable: Schema.NullOr(Schema.Boolean),
+  message: Schema.String,
+});
+const Settled = Schema.Union([
+  Schema.Struct({ ok: Schema.Json }),
+  Schema.Struct({ failed: Failed }),
+]);
+const Page = Schema.Struct({ items: Schema.Array(Schema.Struct({ id: Schema.String })) });
+
+type Send = (
+  method: "GET" | "POST" | "DELETE",
+  path: string,
+  payload?: unknown,
+) => ReturnType<(typeof Api.Service)["request"]>;
+/** Call the app at `path`'s tools, and read its run history through the management API. */
+const appClient = (send: Send, path: string) => ({
+  call: (tool: keyof typeof kinds, input: Schema.Json) =>
+    Effect.gen(function* () {
+      const response = yield* send("POST", `${path}/tools/call`, {
+        tool,
+        kind: kinds[tool],
+        input,
+      });
+      expect(response.status, JSON.stringify(response.body)).toBe(200);
+      return yield* body(Settled, response);
+    }),
+  history: Effect.gen(function* () {
+    const response = yield* send("GET", `${path}/workflow-runs?limit=50`);
+    expect(response.status, JSON.stringify(response.body)).toBe(200);
+    return (yield* body(Page, response)).items.map((item) => item.id).toSorted();
+  }),
+});
+
+/** The self-host test host's storage fault; see `apps/hosted/testing/storage-fault-fixture.ts`. */
+const storageFault = "/api/devtools/storage-fault";
+/** Whether the armed read failed, and the spans it ran inside, innermost first. */
+const Faulted = Schema.Struct({
+  failed: Schema.Boolean,
+  spans: Schema.optional(Schema.Array(Schema.String)),
+});
+/** A start's read of its run right after the transaction that saves it. */
+const readBack = ["workflow.start.read-back", "workflow.start"];
+const Users = Schema.Struct({
+  users: Schema.Array(Schema.Struct({ id: Schema.String, email: Schema.String })),
+});
+const Organizations = Schema.Array(Schema.Struct({ id: Schema.String, slug: Schema.String }));
+
+/**
+ * Deploy an app on a fresh test host, which mounts the storage fault, and disarm the fault when
+ * the scenario ends.
+ */
+const faultHost = (label: string) =>
+  Effect.gen(function* () {
+    const target = yield* Target;
+    // Only the test entry point mounts the storage fault.
+    const origin = yield* startDevelopmentServer(target);
+    const api = yield* Api.pipe(
+      Effect.provide(Layer.fresh(Api.layer)),
+      Effect.provide(Layer.fresh(SessionClients.layer)),
+      Effect.provideService(Target, { ...target, metadata: { ...target.metadata, origin } }),
+    );
+    const owner = yield* api.session(),
+      headers = { origin };
+    const send: Send = (method, path, payload) =>
+      api.request(owner, method, `${origin}${path}`, payload, headers);
+    expect((yield* send("POST", "/api/devtools/operator", {})).status).toBe(200);
+    const directory = yield* body(Users, yield* send("GET", "/api/auth/admin/list-users"));
+    const developer = directory.users.find((user) => user.email === "agent-agent@example.test");
+    if (!developer) return yield* Effect.die("Development owner is missing");
+    expect(
+      (yield* send("POST", "/api/auth/admin/impersonate-user", { userId: developer.id })).status,
+    ).toBe(200);
+    const organization = (yield* body(
+      Organizations,
+      yield* send("GET", "/api/auth/organization/list"),
+    ))[0];
+    if (!organization) return yield* Effect.die("Development organization is missing");
+    const prefix = `/api/organizations/${organization.id}`;
+    // A failed assertion must not leave the fault armed.
+    yield* Effect.addFinalizer(() => send("DELETE", storageFault).pipe(Effect.orDie));
+
+    const deployed = yield* send("POST", `${prefix}/apps/deploy`, {
+      name: `${label} ${randomUUID().slice(0, 8)}`,
+      files: [{ path: "index.ts", content: source("{}") }, appsManifest],
+    });
+    expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+    const app = yield* body(App, deployed);
+    const path = `${prefix}/apps/${app.id}`;
+    yield* Effect.addFinalizer(() => send("DELETE", path).pipe(Effect.orDie));
+    return { send, app, ...appClient(send, path) };
+  });
+
+layer(HostedLive, { excludeTestServices: true })("Workflow controls", (it) => {
+  it.effect(scenarios.workflowControls.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const api = yield* Api,
+          actors = yield* Actors;
+        const prefix = `/api/organizations/${actors.organization.id}`;
+        const apps: string[] = [];
+        yield* Effect.addFinalizer(() =>
+          Effect.gen(function* () {
+            for (const app of apps)
+              yield* api.request(actors.owner, "DELETE", `${prefix}/apps/${app}`);
+          }).pipe(Effect.orDie),
+        );
+        const deploy = (
+          label: string,
+          requirements: string,
+          manifest: { path: string; content: string },
+        ) =>
+          Effect.gen(function* () {
+            const deployed = yield* api.request(actors.owner, "POST", `${prefix}/apps/deploy`, {
+              name: `Workflow controls ${label} ${randomUUID().slice(0, 8)}`,
+              files: [{ path: "index.ts", content: source(requirements) }, manifest],
+            });
+            expect(deployed.status, JSON.stringify(deployed.body)).toBe(200);
+            const app = yield* body(App, deployed);
+            apps.push(app.id);
+            return `${prefix}/apps/${app.id}`;
+          });
+        const send: Send = (method, path, payload) =>
+          api.request(actors.owner, method, path, payload);
+
+        const check = (path: string) =>
+          Effect.gen(function* () {
+            const { call, history } = appClient(send, path);
+            // Start, list and get each answer with the run, and the start made exactly one.
+            const key = `controls-${randomUUID()}`;
+            const started = yield* call("launch", { label: "first", key });
+            expect(started).toEqual({ ok: expect.stringMatching(/^wfr_/) });
+            const run = "ok" in started ? String(started.ok) : "";
+            expect(yield* call("runs", {})).toEqual({
+              ok: [run],
+            });
+            expect(yield* call("peek", { run })).toEqual({ ok: run });
+            // Starting again with the same key and input returns the same run.
+            expect(yield* call("launch", { label: "first", key })).toEqual({
+              ok: run,
+            });
+            expect(yield* history).toEqual([run]);
+
+            // A key over the limit is refused as the caller's input, naming the field, and
+            // starts nothing.
+            const refused = yield* call("launch", { label: "long", key: "k".repeat(140) });
+            expect(refused).toEqual({
+              failed: {
+                tag: "WorkflowFailure",
+                reason: "input",
+                retryable: false,
+                message: expect.stringContaining(
+                  "ctx.workflows.start was refused before Executor started or changed any run. key: Expected a value with a length of at most 128",
+                ),
+              },
+            });
+            expect(yield* history).toEqual([run]);
+          });
+
+        // An app on this checkout's `apps` release.
+        yield* check(yield* deploy("current", "{}", appsManifest));
+        // An app built on `apps` beta.84, which names a run's version `deployment`.
+        yield* check(
+          yield* deploy("beta.84", "{ accounts: {} }", {
+            path: "package.json",
+            content: JSON.stringify({ dependencies: { apps: "0.0.1-beta.84" } }),
+          }),
+        );
+      }),
+    ),
+  );
+
+  it.effect(scenarios.workflowStartReadBack.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const evidence = yield* Evidence;
+        const { send, app, call, history } = yield* faultHost("Workflow read-back");
+
+        /**
+         * Start with the start's first read of this app's runs after its save failing, and return
+         * the saved run the failure names.
+         */
+        const startUnread = (tool: "begin" | "launch", input: Schema.Json, file: string) =>
+          Effect.gen(function* () {
+            const armed = yield* send("POST", storageFault, { binds: app.id, within: readBack });
+            expect(armed.status).toBe(200);
+            const settled = yield* call(tool, input);
+            const faulted = yield* body(Faulted, yield* send("GET", storageFault));
+            yield* evidence.json(file, { settled, faulted });
+            expect(faulted, "The fault failed the read-back").toEqual({
+              failed: true,
+              spans: expect.arrayContaining(readBack),
+            });
+            // The run is saved, so the failure names it and is not offered as a retry.
+            expect(settled).toEqual({
+              failed: {
+                tag: "WorkflowFailure",
+                reason: "engine",
+                retryable: false,
+                message: expect.stringMatching(/^Run wfr_\S+ exists for this start/),
+              },
+            });
+            const message = "failed" in settled ? settled.failed.message : "";
+            return { run: message.split(" ")[1] ?? "", message };
+          });
+
+        // Without a key, the failure says starting again makes another run; getting the run by
+        // its ID, as it advises, finds it and starts nothing.
+        const unkeyed = yield* startUnread("begin", { label: "unkeyed" }, "unkeyed-start.json");
+        expect(unkeyed.message).toContain("This start had no key");
+        expect(yield* history).toEqual([unkeyed.run]);
+        expect(yield* call("peek", { run: unkeyed.run })).toEqual({ ok: unkeyed.run });
+        expect(yield* history).toEqual([unkeyed.run]);
+
+        // With a key, starting again with the same key and input returns the saved run.
+        const key = `read-back-${randomUUID()}`;
+        const keyed = yield* startUnread("launch", { label: "keyed", key }, "keyed-start.json");
+        expect(keyed.message).toContain(
+          "Starting again with the same key and input returns this run.",
+        );
+        expect(yield* call("launch", { label: "keyed", key })).toEqual({ ok: keyed.run });
+        expect(yield* history).toEqual([unkeyed.run, keyed.run].toSorted());
+      }),
+    ),
+  );
+
+  it.effect(scenarios.workflowStartCommit.title, (context) =>
+    withHostedCase(
+      context,
+      Effect.gen(function* () {
+        const evidence = yield* Evidence;
+        const { send, call, history } = yield* faultHost("Workflow commit");
+        /** Start with the commit of the start's save failing as `commit` says. */
+        const startUncommitted = (
+          commit: "refused" | "timeout" | "lost",
+          tool: "begin" | "launch",
+          input: Schema.Json,
+        ) =>
+          Effect.gen(function* () {
+            const armed = yield* send("POST", storageFault, { commit, within: ["workflow.start"] });
+            expect(armed.status).toBe(200);
+            const settled = yield* call(tool, input);
+            const faulted = yield* body(Faulted, yield* send("GET", storageFault));
+            yield* evidence.json(`commit-${commit}-${tool}.json`, { settled, faulted });
+            expect(faulted, "The fault reached the start's transaction").toEqual({
+              failed: true,
+              spans: expect.arrayContaining(["storage.transaction", "workflow.start"]),
+            });
+            return settled;
+          });
+        const mayExist = (message: string) => ({
+          failed: {
+            tag: "WorkflowFailure",
+            reason: "engine",
+            retryable: false,
+            message: expect.stringContaining(message),
+          },
+        });
+
+        // The database refuses the commit. The host cannot tell that apart from a commit that
+        // applied, so the run may exist; without a key, the failure says to check the list.
+        expect(yield* startUncommitted("refused", "begin", { label: "refused" })).toEqual(
+          mayExist(
+            "so the run may exist. This start had no key: check ctx.workflows.list before starting again",
+          ),
+        );
+        expect(yield* history).toEqual([]);
+
+        // The commit times out. With a key, starting again with the same key and input is safe,
+        // and here makes the one run the refused commit left out.
+        const key = `commit-${randomUUID()}`;
+        expect(yield* startUncommitted("timeout", "launch", { label: "timeout", key })).toEqual(
+          mayExist(
+            "so the run may exist. Starting again with the same key and input returns the run if it was saved.",
+          ),
+        );
+        expect(yield* history).toEqual([]);
+        const again = yield* call("launch", { label: "timeout", key });
+        expect(again).toEqual({ ok: expect.stringMatching(/^wfr_/) });
+        const keyed = "ok" in again ? String(again.ok) : "";
+        expect(yield* history).toEqual([keyed]);
+
+        // The commit applies and its answer is lost. Reading the run back confirms the start, so
+        // it answers with the run and makes no other.
+        const lost = yield* startUncommitted("lost", "begin", { label: "lost" });
+        expect(lost).toEqual({ ok: expect.stringMatching(/^wfr_/) });
+        const run = "ok" in lost ? String(lost.ok) : "";
+        expect(yield* history).toEqual([keyed, run].toSorted());
+        expect(yield* call("peek", { run })).toEqual({ ok: run });
+      }),
+    ),
+  );
+});
diff --git a/package.json b/package.json
index e96776c6d4..c95da82e9e 100644
--- a/package.json
+++ b/package.json
@@ -94,7 +94,10 @@
     "hosted:cloud:state:migrate": "node apps/hosted/cloud/scripts/migrate-state.ts",
     "ci:plan": "op run --env-file=.env.ci.op -- bun run --cwd apps/hosted/cloud alchemy deploy alchemy.github.ts --dry-run --detect-drift --no-input",
     "ci:deploy": "op run --env-file=.env.ci.op -- bun run --cwd apps/hosted/cloud alchemy deploy alchemy.github.ts",
+    "deploy-events:plan": "bun run --cwd apps/hosted/cloud alchemy deploy alchemy.deploy-events.ts --stage v2 --dry-run --detect-drift --no-input",
+    "deploy-events:deploy": "bun run --cwd apps/hosted/cloud alchemy deploy alchemy.deploy-events.ts --stage v2",
     "e2e:billing": "vitest run --config e2e/billing.config.ts",
+    "auth:security": "bun apps/hosted/server/scripts/check-better-auth-security.mjs",
     "e2e:pglite": "vitest run --config e2e/pglite.config.ts",
     "e2e:dashboard-file-names": "vitest run --config e2e/dashboard-file-names.config.ts",
     "e2e:apps-published": "vitest run --config e2e/apps-published.config.ts",
@@ -190,7 +193,8 @@
     "alchemy@2.0.0-beta.80": "patches/alchemy@2.0.0-beta.80.patch",
     "@alchemy.run/cloudflare-runtime@2.0.0-beta.80": "patches/@alchemy.run%2Fcloudflare-runtime@2.0.0-beta.80.patch",
     "@distilled.cloud/cloudflare@1.0.0-rc.13": "patches/@distilled.cloud%2Fcloudflare@1.0.0-rc.13.patch",
-    "@better-auth/api-key@1.7.5": "patches/@better-auth%2Fapi-key@1.7.5.patch"
+    "@better-auth/api-key@1.7.5": "patches/@better-auth%2Fapi-key@1.7.5.patch",
+    "@better-auth/core@1.7.5": "patches/@better-auth%2Fcore@1.7.5.patch"
   },
   "trustedDependencies": [
     "dugite",
diff --git a/packages/app-cache/src/changes.ts b/packages/app-cache/src/changes.ts
index 8eb327a6f4..b93a894aa4 100644
--- a/packages/app-cache/src/changes.ts
+++ b/packages/app-cache/src/changes.ts
@@ -9,9 +9,9 @@ import { CacheCommand } from "./contracts/cache.ts";
  * Whether a command asked for retained data to be replaced now: an invalidation, such as the one
  * that follows an MCP server's `notifications/tools/list_changed`, or the claim that starts an
  * explicit refresh, which then publishes before its caller continues. Hosts report these so
- * results evaluated from the earlier data are not reused. A routine refresh or a direct write
- * replaces data a kept result may still reflect until its next stale-while-revalidate refresh,
- * so it is not reported.
+ * results evaluated from the earlier data are not reused. A routine refresh or a direct write is
+ * known to change data only once the store compares it with the retained value, so the store
+ * reports those itself (`SqliteCacheResult.replaced`); rewriting the same value is no change.
  */
 export const discardsEvaluated = (command: unknown) => {
   const operation = Schema.decodeUnknownOption(CacheCommand)(command);
diff --git a/packages/app-cache/src/sqlite.ts b/packages/app-cache/src/sqlite.ts
index 993776db83..b1e5acbb76 100644
--- a/packages/app-cache/src/sqlite.ts
+++ b/packages/app-cache/src/sqlite.ts
@@ -25,6 +25,7 @@ const Row = Schema.Struct({
   bytes: Schema.Number,
 });
 const Usage = Schema.Struct({ bytes: Schema.Number, count: Schema.Number });
+const Count = Schema.Struct({ count: Schema.Number });
 
 /**
  * Totals are kept by triggers, so bounding a write reads one row instead of every entry.
@@ -56,12 +57,22 @@ const initialize = (storage: CacheSqlStorage) =>
       BEGIN UPDATE executor_cache_usage SET bytes = bytes - OLD.bytes + NEW.bytes WHERE id = 0; END`);
   });
 
+/**
+ * A command's reply, and whether it replaced or removed a retained value: overwrote it with
+ * different data, invalidated it, or swept it once expired. A routine refresh that publishes what
+ * it read before, a write of the same value, or a load that fills an empty key replaces nothing.
+ */
+export interface SqliteCacheResult {
+  readonly reply: Schema.Json;
+  readonly replaced: boolean;
+}
+
 /** Create a bounded, fenced cache store. All commands execute in a synchronous SQL transaction. */
 export const sqliteCache = (storage: CacheSqlStorage) => {
   let initialized = false;
   return (namespace: string, input: unknown) =>
     Effect.try({
-      try: (): Schema.Json => {
+      try: (): SqliteCacheResult => {
         const command = Schema.decodeUnknownSync(CacheCommand)(input);
         if (namespace.length > 256) throw new CacheError({ reason: "invalid" });
         if (!initialized) {
@@ -69,8 +80,20 @@ export const sqliteCache = (storage: CacheSqlStorage) => {
           initialized = true;
         }
         const now = Date.now();
-        return storage.transactionSync(() => {
-          // Expired entries are disposable. Active loaders keep their fencing row.
+        let replaced = false;
+        const reply = storage.transactionSync((): Schema.Json => {
+          // Expired entries are disposable. Active loaders keep their fencing row. Removing a value
+          // is a change: a kept result may reflect it, and a later load may differ.
+          const expired = Schema.decodeUnknownSync(Count)(
+            storage.sql
+              .exec(
+                "SELECT count(*) AS count FROM executor_cache WHERE stale < ? AND lease_until < ? AND value IS NOT NULL",
+                now,
+                now,
+              )
+              .one(),
+          );
+          if (expired.count > 0) replaced = true;
           storage.sql.exec(
             "DELETE FROM executor_cache WHERE stale < ? AND lease_until < ?",
             now,
@@ -104,6 +127,10 @@ export const sqliteCache = (storage: CacheSqlStorage) => {
             // Nothing is kept past the retention, whatever the caller's clock said.
             const staleUntil = Math.min(entry.staleUntil, now + cacheLimits.retentionMs);
             const freshUntil = Math.min(entry.freshUntil, staleUntil);
+            // Filling an empty key changes nothing a kept result reflects: a result that read the
+            // key while it was empty loaded this value itself, or waited for the load that did.
+            const previous = read(key)?.value ?? null;
+            if (previous !== null && previous !== value) replaced = true;
             storage.sql.exec(
               `INSERT INTO executor_cache VALUES (?, ?, ?, ?, ?, ?, NULL, 0, ?, ?)
             ON CONFLICT(namespace, key) DO UPDATE SET value=excluded.value, version=excluded.version,
@@ -212,6 +239,7 @@ export const sqliteCache = (storage: CacheSqlStorage) => {
               return null;
             }
             case "invalidate":
+              if ((read(command.key)?.value ?? null) !== null) replaced = true;
               // Revoke an in-flight publication as well as the retained value.
               storage.sql.exec(
                 "DELETE FROM executor_cache WHERE namespace = ? AND key = ?",
@@ -241,6 +269,7 @@ export const sqliteCache = (storage: CacheSqlStorage) => {
               return null;
           }
         });
+        return { reply, replaced };
       },
       catch: (error) =>
         error instanceof CacheError ? error : new CacheError({ reason: "storage" }),
diff --git a/packages/app-data/package.json b/packages/app-data/package.json
index 425b5f1d26..23659fd782 100644
--- a/packages/app-data/package.json
+++ b/packages/app-data/package.json
@@ -8,7 +8,8 @@
     "./contracts": "./src/contracts/database.ts",
     "./worker-bundle": "./src/contracts/worker-bundle.ts",
     "./cloudflare": "./src/cloudflare.ts",
-    "./evaluated": "./src/contracts/evaluated.ts"
+    "./evaluated": "./src/contracts/evaluated.ts",
+    "./host-api": "./src/contracts/host-api.ts"
   },
   "dependencies": {
     "@executor-js/app-cache": "workspace:*",
diff --git a/packages/app-data/src/cloudflare.ts b/packages/app-data/src/cloudflare.ts
index f29c58b46d..02200632b6 100644
--- a/packages/app-data/src/cloudflare.ts
+++ b/packages/app-data/src/cloudflare.ts
@@ -10,12 +10,14 @@ import type {
 import { Clock, Deferred, Effect, Exit, Result, Schema, Semaphore } from "effect";
 import { fingerprint } from "./implementation/fingerprint.ts";
 import { AppDatabaseError } from "./contracts/database.ts";
+import { HostApiCheck } from "./contracts/host-api.ts";
 import { CacheCommand, CacheError, CacheReply } from "@executor-js/app-cache/contracts";
 import { holdLeases } from "@executor-js/app-cache";
 import { discardsEvaluated } from "@executor-js/app-cache/changes";
 import { sqliteCache } from "@executor-js/app-cache/sqlite";
 import { evaluatedStore } from "./implementation/evaluated.ts";
 import type {
+  EvaluatedChanged,
   EvaluatedEntry,
   EvaluatedSupervisor,
   EvaluatedWritten,
@@ -34,6 +36,11 @@ export const FacetInvocation = Schema.Struct({
   identity: Schema.NonEmptyString,
   body: Schema.String,
   cacheNamespace: Schema.optionalKey(Schema.String),
+  /**
+   * The host API revision `cacheNamespace` belongs to, for an app that reads its host's API. The
+   * facet Worker's network is bound to it, so `identity` names the revision too.
+   */
+  hostApi: Schema.optionalKey(HostApiCheck),
   write: Schema.Boolean,
   /**
    * The bundle's calls may run alongside other calls of the same execution context. Bundles built
@@ -207,10 +214,11 @@ export const makeFacetSupervisor = (
   state: DurableObjectState,
   loader: Pick<WorkerLoader, "get">,
   /**
-   * Network the facet's global `fetch` uses, bound to its app. It substitutes credential handles
-   * and applies the host's routing rules.
+   * Network the facet's global `fetch` uses, bound to its app and to the host API revision its
+   * cache belongs to, when it reads its host's API. It substitutes credential handles and applies
+   * the host's routing rules.
    */
-  globalOutbound: (app: string) => Fetcher,
+  globalOutbound: (app: string, hostApi: HostApiCheck | undefined) => Fetcher,
   /**
    * Whether this object is the supervisor named for `app`, from its own ID (for example
    * `state.id.equals(namespace.idFromName(app))`). Its storage is that app's, so it refuses an
@@ -346,18 +354,21 @@ export const makeFacetSupervisor = (
       });
     const evaluated = evaluatedStore(state.storage);
     const cached = sqliteCache(state.storage);
-    // Every cache command, from the host or from an invocation, passes here, so an invalidation
-    // is recorded for evaluated results before any caller can read them again.
+    // Every cache command, from the host or from an invocation, passes here, so a change is
+    // recorded for evaluated results before any caller can read them again: an invalidation, an
+    // explicit refresh, or any command that replaced a value with different data, such as a
+    // routine background refresh that found a changed MCP tool list.
     const store = (namespace: string, command: unknown) =>
       cached(namespace, command).pipe(
-        Effect.tap(() =>
-          discardsEvaluated(command)
+        Effect.tap(({ replaced }) =>
+          replaced || discardsEvaluated(command)
             ? Clock.currentTimeMillis.pipe(
                 Effect.flatMap(evaluated.changed),
                 Effect.mapError(() => new CacheError({ reason: "storage" })),
               )
             : Effect.void,
         ),
+        Effect.map(({ reply }) => reply),
       );
     const cache = (namespace: string, command: unknown) =>
       store(namespace, command).pipe(
@@ -412,16 +423,16 @@ export const makeFacetSupervisor = (
           state.facets.abort("data", "Fresh subrequest allowance");
           starts.recycled = true;
         }
-        if (!unloadReplacedFacets) return yield* select(name, invocation.app, load, starts);
+        if (!unloadReplacedFacets) return yield* select(name, invocation, load, starts);
         // Also covers a facet an evicted supervisor left loaded, which `active` never saw.
         const replaced = loadedFacets.get(supervisor);
         loadedFacets.set(supervisor, { name, loaded });
         if (replaced !== undefined && replaced.loaded !== loaded) yield* unloadReplaced(replaced);
-        return yield* select(name, invocation.app, load, starts);
+        return yield* select(name, invocation, load, starts);
       });
     const select = (
       name: string,
-      app: string,
+      invocation: Pick<typeof FacetInvocation.Type, "app" | "hostApi">,
       load: () => Promise<typeof FacetBundle.Type>,
       starts: FacetStarts,
     ) =>
@@ -440,8 +451,8 @@ export const makeFacetSupervisor = (
                   modules: workerModules(bundle.modules),
                   compatibilityDate: "2026-07-30",
                   // The strictly-public flag would override this outbound and bypass it.
-                  compatibilityFlags: ["nodejs_compat"],
-                  globalOutbound: globalOutbound(app),
+                  compatibilityFlags: ["nodejs_compat", "no_brotli_content_encoding"],
+                  globalOutbound: globalOutbound(invocation.app, invocation.hostApi),
                 };
               });
               return { class: worker.getDurableObjectClass("ExecutorAppData") };
@@ -697,7 +708,7 @@ export const makeFacetSupervisor = (
         runningIn(trace).pipe(
           Effect.flatMap(({ supervisor }) =>
             evaluated.command(command).pipe(
-              Effect.map((reply): EvaluatedEntry | EvaluatedWritten =>
+              Effect.map((reply): EvaluatedEntry | EvaluatedWritten | EvaluatedChanged =>
                 typeof reply === "boolean"
                   ? { kept: reply, supervisor }
                   : reply === null
diff --git a/packages/app-data/src/contracts/evaluated.ts b/packages/app-data/src/contracts/evaluated.ts
index 2852753627..361c0d2de1 100644
--- a/packages/app-data/src/contracts/evaluated.ts
+++ b/packages/app-data/src/contracts/evaluated.ts
@@ -15,10 +15,12 @@ export const evaluatedLimits = {
 
 /**
  * `at` is when the read that produced the result began; `until` is when the store may drop it.
- * A write whose evaluation began no later than the app's last cache invalidation is refused.
+ * A write whose evaluation began no later than the app's last cache change is refused. `changed`
+ * reads when that change was, so a process can forget the results it keeps in memory from before.
  */
 export const EvaluatedCommand = Schema.Union([
   Schema.Struct({ operation: Schema.Literal("read"), key: Key }),
+  Schema.Struct({ operation: Schema.Literal("changed") }),
   Schema.Struct({
     operation: Schema.Literal("write"),
     key: Key,
@@ -60,8 +62,18 @@ export const EvaluatedWritten = Schema.Struct({
 });
 export type EvaluatedWritten = typeof EvaluatedWritten.Type;
 
+/**
+ * A `changed` reply: when the app's cached data last changed, on the supervisor's clock, or null
+ * when it never has. Supervisors deployed before `changed` answer it as `missing`.
+ */
+export const EvaluatedChanged = Schema.Struct({
+  changed: Schema.NullOr(Time),
+  supervisor: EvaluatedSupervisor,
+});
+export type EvaluatedChanged = typeof EvaluatedChanged.Type;
+
 /** A command or reply as JSON text, with bodies in base64, for a host that sends it over HTTP. */
 export const EvaluatedCommandJson = Schema.fromJsonString(Schema.toCodecJson(EvaluatedCommand));
 export const EvaluatedReplyJson = Schema.fromJsonString(
-  Schema.toCodecJson(Schema.Union([EvaluatedEntry, EvaluatedWritten])),
+  Schema.toCodecJson(Schema.Union([EvaluatedEntry, EvaluatedWritten, EvaluatedChanged])),
 );
diff --git a/packages/app-data/src/contracts/host-api.ts b/packages/app-data/src/contracts/host-api.ts
new file mode 100644
index 0000000000..edb0ce55bb
--- /dev/null
+++ b/packages/app-data/src/contracts/host-api.ts
@@ -0,0 +1,15 @@
+/** How an invocation of an app that reads its host's API is bound to one revision of it. */
+import { Schema } from "effect";
+
+/**
+ * The host API revision an invocation's app cache belongs to, and the URLs its document is served
+ * at. The runner fills that cache only through a network that refuses a document from one of
+ * `documents` whose SHA-256 is not `revision`, so the cache never holds another revision's API
+ * under this one's name, whichever of the caller and the API deploys first. A facet's network is
+ * bound the same way, so a database call is checked as an app Worker's call is.
+ */
+export const HostApiCheck = Schema.Struct({
+  revision: Schema.NonEmptyString,
+  documents: Schema.Array(Schema.NonEmptyString),
+});
+export type HostApiCheck = typeof HostApiCheck.Type;
diff --git a/packages/app-data/src/implementation/evaluated.ts b/packages/app-data/src/implementation/evaluated.ts
index f13a67383a..ee7545925c 100644
--- a/packages/app-data/src/implementation/evaluated.ts
+++ b/packages/app-data/src/implementation/evaluated.ts
@@ -41,8 +41,9 @@ const initialize = (storage: EvaluatedSqlStorage) =>
   });
 
 /**
- * One app's store. `changed` records an app cache invalidation: results evaluated no later than
- * then are neither served nor accepted, so every isolate forgets them at once.
+ * One app's store. `changed` records a change of the app's cached data: results evaluated no
+ * later than then are neither served nor accepted. Each isolate also reads when it was (the
+ * `changed` command) to forget the results it keeps in memory from before.
  */
 export const evaluatedStore = (storage: EvaluatedSqlStorage) => {
   let initialized = false;
@@ -75,9 +76,17 @@ export const evaluatedStore = (storage: EvaluatedSqlStorage) => {
       }),
     command: (input: unknown) =>
       Effect.try({
-        try: (): { readonly at: number; readonly body: Uint8Array } | null | boolean => {
+        try: ():
+          | { readonly at: number; readonly body: Uint8Array }
+          | { readonly changed: number | null }
+          | null
+          | boolean => {
           const command = Schema.decodeUnknownSync(EvaluatedCommand)(input);
           ready();
+          if (command.operation === "changed") {
+            const changed = lastChange();
+            return { changed: Number.isFinite(changed) ? changed : null };
+          }
           const now = Date.now();
           return storage.transactionSync(() => {
             storage.sql.exec("DELETE FROM executor_evaluated WHERE until < ?", now);
diff --git a/packages/app-management/src/cli.ts b/packages/app-management/src/cli.ts
index 57546dcc23..da40db5096 100644
--- a/packages/app-management/src/cli.ts
+++ b/packages/app-management/src/cli.ts
@@ -43,6 +43,8 @@ import {
   ToolListingTimedOut,
   ToolName,
   ToolResumeFailure,
+  wireRevision,
+  wireRevisionHeader,
   type App,
   type ToolCallResult,
 } from "@executor-js/sdk/core";
@@ -93,13 +95,12 @@ class SkillLookupFailed extends Schema.TaggedError<SkillLookupFailed>()("SkillLo
 class AppLookupFailed extends Schema.TaggedError<AppLookupFailed>()("AppLookupFailed", {
   reason: Schema.String,
 }) {}
-const localOrigin = "http://127.0.0.1:4312";
 const host = Flag.String("host").pipe(
   Flag.withDescription(
-    `Executor origin. Defaults to EXECUTOR_HOST, then the local server at ${localOrigin}; use ${hostedExecutorOrigin} for hosted Executor`,
+    `Executor origin. Defaults to EXECUTOR_HOST, then the local background Executor, which starts if needed; use ${hostedExecutorOrigin} for hosted Executor`,
   ),
   Flag.withFallbackConfig(Config.String("EXECUTOR_HOST")),
-  Flag.withDefault(localOrigin),
+  Flag.optional,
 );
 const organization = Flag.String("organization").pipe(
   Flag.withDescription(
@@ -133,9 +134,38 @@ const publication = {
   ),
   commit: commit("of the published version to install"),
 };
+/** The local Executor that commands use when neither --host nor EXECUTOR_HOST names a host. */
+export interface LocalServer {
+  readonly url: string;
+  /** Sent as the local API key. */
+  readonly token: Redacted.Redacted<string>;
+}
+/**
+ * The local Executor could not be started or reached for a command without --host or
+ * EXECUTOR_HOST. `message` is the local server's own explanation and what to do about it.
+ */
+export class LocalServerUnavailable extends Schema.TaggedError<LocalServerUnavailable>()(
+  "LocalServerUnavailable",
+  { message: Schema.String },
+) {}
+/**
+ * The host one command talks to: the --host or EXECUTOR_HOST origin, or the local server with the
+ * token its resolver supplied. A named host resolves its credential for each request, as a hosted
+ * session can refresh during a long command.
+ */
+interface Host {
+  readonly origin: string;
+  readonly local?: Redacted.Redacted<string>;
+}
 /** Resolve the credential and, for hosted Executor, the organization every request targets. */
-const access = (host: string, organization: Option.Option<string>) =>
+const access = ({ origin: host, local: localToken }: Host, organization: Option.Option<string>) =>
   Effect.gen(function* () {
+    if (localToken !== undefined) {
+      // The local server has no organizations; a hosted one must be named with --host.
+      if (Option.isSome(organization))
+        return yield* new AppClientError({ reason: "authentication" });
+      return { token: localToken, organization: undefined };
+    }
     yield* Schema.decodeUnknownEffect(RegistryOrigin)(host).pipe(
       Effect.mapError(() => new AppClientError({ reason: "authentication" })),
     );
@@ -173,6 +203,7 @@ const transport = (host: string, token: Redacted.Redacted<string>, path = (url:
         request.pipe(
           HttpClientRequest.updateUrl((url) => host + path(url)),
           HttpClientRequest.bearerToken(token),
+          HttpClientRequest.setHeader(wireRevisionHeader, String(wireRevision)),
         ),
       ),
       HttpClient.transform((response) =>
@@ -261,10 +292,10 @@ type Framework = HttpApiClient.ForApi<typeof localFrameworkApi>["framework"];
  * routes: local serves them under /v1, and hosted serves the same endpoints and
  * schemas under its organization prefix.
  */
-const connect = (host: string, organization: Option.Option<string>) =>
+const connect = (host: Host, organization: Option.Option<string>) =>
   Effect.gen(function* () {
     const target = yield* access(host, organization);
-    const httpClient = yield* transport(host, target.token);
+    const httpClient = yield* transport(host.origin, target.token);
     if (target.organization === undefined) {
       const client = yield* HttpApiClient.makeWith(localManagementApi, { httpClient });
       const management: Management = client.appManagement;
@@ -283,7 +314,7 @@ const connect = (host: string, organization: Option.Option<string>) =>
       };
     }
     const prefix = `/api/organizations/${encodeURIComponent(target.organization)}`;
-    const sdkClient = yield* transport(host, target.token, (url) =>
+    const sdkClient = yield* transport(host.origin, target.token, (url) =>
       url.replace(/^\/v1\//, `${prefix}/`),
     );
     const client = yield* HttpApiClient.makeWith(hostedManagementApi, { httpClient });
@@ -305,7 +336,7 @@ const connect = (host: string, organization: Option.Option<string>) =>
   });
 /** Run one app management operation; contract errors stay typed for command diagnostics. */
 const manage = <A, E>(
-  host: string,
+  host: Host,
   organization: Option.Option<string>,
   operation: (
     api: Management,
@@ -327,11 +358,11 @@ const print =
       Effect.flatMap((json) => Console.log(JSON.stringify(json, null, 2))),
     );
 /** The working source the host holds now, with its revision and Git location. */
-const workingSource = (host: string, organization: Option.Option<string>, app: AppId) =>
+const workingSource = (host: Host, organization: Option.Option<string>, app: AppId) =>
   manage(host, organization, (api, tenant) => api.source({ params: { ...tenant, app } }));
 
 /** The credential Git requests carry, the same one the API requests use. */
-const gitAuthorization = (host: string, organization: Option.Option<string>) =>
+const gitAuthorization = (host: Host, organization: Option.Option<string>) =>
   access(host, organization).pipe(Effect.map(({ token }) => `Bearer ${Redacted.value(token)}`));
 
 /**
@@ -339,7 +370,7 @@ const gitAuthorization = (host: string, organization: Option.Option<string>) =>
  * files; a larger one is pushed with Git, sending only the files the app does not already hold.
  */
 const saveSource = (input: {
-  readonly host: string;
+  readonly host: Host;
   readonly organization: Option.Option<string>;
   readonly app: AppId;
   readonly expected: typeof SourceCommit.Type;
@@ -387,7 +418,7 @@ const skillRead = <A, E>(
 ) => effect.pipe(Effect.catchIf(isTransportFailure, hostFailure));
 /** Skills come from each app's version on the host; the CLI bundles no guidance. */
 const readSkills = (args: {
-  readonly host: string;
+  readonly host: Host;
   readonly organization: Option.Option<string>;
   readonly app: Option.Option<string>;
   readonly name: Option.Option<typeof AppSkillName.Type>;
@@ -478,7 +509,7 @@ const callInput = (args: {
  * decide it, as for any other API caller. The input is checked before any request.
  */
 const callTool = (args: {
-  readonly host: string;
+  readonly host: Host;
   readonly organization: Option.Option<string>;
   readonly app: string;
   readonly tool: ToolName;
@@ -517,7 +548,7 @@ const callTool = (args: {
     yield* Console.log(JSON.stringify(result.value, null, 2));
   });
 
-const notSignedIn = `Not signed in to this host. For hosted Executor, run executor apps login --host ${hostedExecutorOrigin} and pass the same --host to each command, or set EXECUTOR_HOST. For a local server (default ${localOrigin}), set EXECUTOR_API_KEY to its API key.`;
+const notSignedIn = `Not signed in to this host. For hosted Executor, run executor apps login --host ${hostedExecutorOrigin} and pass the same --host to each command, or set EXECUTOR_HOST. Without --host or EXECUTOR_HOST, commands use the local background Executor; for a local server at --host, set EXECUTOR_API_KEY to its API key.`;
 /** What each sign-in failure means and what to do next. */
 const loginFailure: Record<LoginFailed["reason"], string> = {
   host: `Could not read this host's sign-in settings. Check --host, for example --host ${hostedExecutorOrigin}, and your network connection.`,
@@ -634,6 +665,8 @@ const hostRequestFailure = (error: HostRequestFailed): AppCommandFailure => {
  * other response text are never included. Undefined for failures outside the apps commands.
  */
 export const describeAppFailure = (error: unknown): AppCommandFailure | undefined => {
+  if (Schema.is(LocalServerUnavailable)(error))
+    return { code: "LocalServerUnavailable", message: error.message };
   if (
     (Schema.is(AppClientError)(error) || Schema.is(AppAccessDenied)(error)) &&
     error.reason === "authentication"
@@ -761,9 +794,27 @@ export const renderAppFailure = (failure: AppCommandFailure): string =>
 export const encodeAppFailure = (failure: AppCommandFailure): string =>
   JSON.stringify({ error: Schema.encodeSync(AppCommandFailure)(failure) }, null, 2);
 
-/** The executable supplies one platform layer and owns process lifetime. */
-export const appsCommand = (platform: string) =>
-  Command.make("apps").pipe(
+/**
+ * The executable supplies one platform layer and owns process lifetime. `localServer` resolves the
+ * local Executor that commands use when neither --host nor EXECUTOR_HOST names a host; without it,
+ * such a command fails as not signed in.
+ */
+export const appsCommand = <E = never, R = never>(
+  platform: string,
+  localServer?: Effect.Effect<LocalServer, E, R>,
+) => {
+  /** Run with --host or EXECUTOR_HOST, or else the local server, resolved once per command. */
+  const withHost = <A, E2, R2>(
+    named: Option.Option<string>,
+    run: (host: Host) => Effect.Effect<A, E2, R2>,
+  ) =>
+    Effect.gen(function* () {
+      if (Option.isSome(named)) return yield* run({ origin: named.value });
+      if (localServer === undefined) return yield* new AppClientError({ reason: "authentication" });
+      const { url, token } = yield* localServer;
+      return yield* run({ origin: url, local: token });
+    });
+  return Command.make("apps").pipe(
     Command.withDescription(
       `Create, edit, deploy, share, and install apps. Output is JSON on stdout. A failure exits 1 (2 when executor apps call needs approval) and prints the error's message, code, HTTP status and recovery on stderr; when stdout is not a terminal it also prints them as {"error": {"code", "status", "message", "recovery", "details", "update"}} on stdout; "update" says when a newer CLI release exists. Set EXECUTOR_HOST to skip --host; --organization defaults to the one you signed in to`,
     ),
@@ -782,7 +833,14 @@ export const appsCommand = (platform: string) =>
       },
     ]),
     Command.withSubcommands([
-      Command.make("login", { host }).pipe(
+      Command.make("login", {
+        host: Flag.String("host").pipe(
+          Flag.withDescription(
+            `Hosted Executor origin, such as ${hostedExecutorOrigin}. Defaults to EXECUTOR_HOST`,
+          ),
+          Flag.withFallbackConfig(Config.String("EXECUTOR_HOST")),
+        ),
+      }).pipe(
         Command.withDescription(
           `Sign in to a hosted Executor with a code approved in any browser, for example --host ${hostedExecutorOrigin}`,
         ),
@@ -797,10 +855,12 @@ export const appsCommand = (platform: string) =>
       Command.make("list", connection).pipe(
         Command.withDescription("List apps"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .list({ params: tenant, responseMode: "decoded-and-response" })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .list({ params: tenant, responseMode: "decoded-and-response" })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
@@ -819,44 +879,46 @@ export const appsCommand = (platform: string) =>
           },
         ]),
         Command.withHandler((args) =>
-          Effect.gen(function* () {
-            const local = yield* readSource(args.files);
-            if (fitsRequest(local)) {
-              const files = yield* requestFiles(local);
-              return yield* manage(args.host, args.organization, (api, tenant) =>
-                api
-                  .create({
-                    params: tenant,
-                    payload: { name: args.name, files },
-                    responseMode: "decoded-and-response",
-                  })
-                  .pipe(Effect.flatMap(printResponse)),
-              );
-            }
-            // Too large for one request: create the app from its code, then push the whole
-            // directory, public files included, as its next commit.
-            const [created, response] = yield* manage(args.host, args.organization, (api, tenant) =>
-              requestFiles(codeOnly(local)).pipe(
-                Effect.flatMap((files) =>
-                  api.create({
-                    params: tenant,
-                    payload: { name: args.name, files },
-                    responseMode: "decoded-and-response",
-                  }),
+          withHost(args.host, (host) =>
+            Effect.gen(function* () {
+              const local = yield* readSource(args.files);
+              if (fitsRequest(local)) {
+                const files = yield* requestFiles(local);
+                return yield* manage(host, args.organization, (api, tenant) =>
+                  api
+                    .create({
+                      params: tenant,
+                      payload: { name: args.name, files },
+                      responseMode: "decoded-and-response",
+                    })
+                    .pipe(Effect.flatMap(printResponse)),
+                );
+              }
+              // Too large for one request: create the app from its code, then push the whole
+              // directory, public files included, as its next commit.
+              const [created, response] = yield* manage(host, args.organization, (api, tenant) =>
+                requestFiles(codeOnly(local)).pipe(
+                  Effect.flatMap((files) =>
+                    api.create({
+                      params: tenant,
+                      payload: { name: args.name, files },
+                      responseMode: "decoded-and-response",
+                    }),
+                  ),
                 ),
-              ),
-            );
-            const source = yield* workingSource(args.host, args.organization, created.id);
-            yield* pushSource({
-              url: source.gitUrl,
-              authorization: yield* gitAuthorization(args.host, args.organization),
-              expected: source.revision.commit,
-              remote: source.files,
-              files: local,
-              message: "Add ui/public files",
-            });
-            yield* printResponse([created, response]);
-          }),
+              );
+              const source = yield* workingSource(host, args.organization, created.id);
+              yield* pushSource({
+                url: source.gitUrl,
+                authorization: yield* gitAuthorization(host, args.organization),
+                expected: source.revision.commit,
+                remote: source.files,
+                files: local,
+                message: "Add ui/public files",
+              });
+              yield* printResponse([created, response]);
+            }),
+          ),
         ),
       ),
       Command.make("framework", connection).pipe(
@@ -864,12 +926,14 @@ export const appsCommand = (platform: string) =>
           "Print the exact apps framework version this host runs. Declare it as dependencies.apps in each app's package.json",
         ),
         Command.withHandler((args) =>
-          connect(args.host, args.organization).pipe(
-            Effect.flatMap(({ framework, tenant }) =>
-              framework.release({ params: tenant, responseMode: "decoded-and-response" }),
+          withHost(args.host, (host) =>
+            connect(host, args.organization).pipe(
+              Effect.flatMap(({ framework, tenant }) =>
+                framework.release({ params: tenant, responseMode: "decoded-and-response" }),
+              ),
+              Effect.flatMap(printResponse),
+              Effect.catchIf(isTransportFailure, hostFailure),
             ),
-            Effect.flatMap(printResponse),
-            Effect.catchIf(isTransportFailure, hostFailure),
           ),
         ),
       ),
@@ -887,72 +951,76 @@ export const appsCommand = (platform: string) =>
           "Print an app's working source files and current commit. A ui/public/ file that is not text, or does not fit, is listed as {path, object, size}; pass --out to write every file",
         ),
         Command.withHandler((args) =>
-          Option.match(args.out, {
-            onNone: () =>
-              manage(args.host, args.organization, (api, tenant) =>
-                api
-                  .source({
-                    params: { ...tenant, app: args.app },
-                    responseMode: "decoded-and-response",
-                  })
-                  .pipe(Effect.flatMap(printResponse)),
-              ),
-            onSome: (out) =>
-              Effect.gen(function* () {
-                const fs = yield* FileSystem.FileSystem;
-                const path = yield* Path.Path;
-                if ((yield* fs.exists(out)) && (yield* fs.readDirectory(out)).length > 0)
-                  return yield* new SourceRejected({
-                    reason: "invalid",
-                    detail: `${out} is not empty.`,
-                    paths: [],
-                  });
-                const source = yield* workingSource(args.host, args.organization, args.app);
-                const write = (file: string, bytes: Uint8Array) =>
-                  Effect.gen(function* () {
-                    const target = path.join(out, ...file.split("/"));
-                    yield* fs.makeDirectory(path.dirname(target), { recursive: true });
-                    yield* fs.writeFile(target, bytes);
-                  });
-                const stored = new Map<string, string[]>();
-                for (const file of source.files) {
-                  if ("object" in file)
-                    stored.set(file.object, [...(stored.get(file.object) ?? []), file.path]);
-                  else yield* write(file.path, inlineBytes(file));
-                }
-                // Files listed by their blob come from the app's Git remote.
-                if (stored.size > 0)
-                  yield* readCommitBlobs({
-                    url: source.gitUrl,
-                    authorization: yield* gitAuthorization(args.host, args.organization),
-                    commit: source.revision.commit,
-                    objects: [...stored.keys()],
-                    write: (object, bytes) =>
-                      Effect.forEach(stored.get(object) ?? [], (file) => write(file, bytes), {
-                        discard: true,
-                      }).pipe(Effect.mapError(() => new SourceError({ reason: "storage" }))),
-                  });
-                yield* Console.log(
-                  JSON.stringify(
-                    { revision: source.revision, files: source.files.length, out },
-                    null,
-                    2,
-                  ),
-                );
-              }),
-          }),
+          withHost(args.host, (host) =>
+            Option.match(args.out, {
+              onNone: () =>
+                manage(host, args.organization, (api, tenant) =>
+                  api
+                    .source({
+                      params: { ...tenant, app: args.app },
+                      responseMode: "decoded-and-response",
+                    })
+                    .pipe(Effect.flatMap(printResponse)),
+                ),
+              onSome: (out) =>
+                Effect.gen(function* () {
+                  const fs = yield* FileSystem.FileSystem;
+                  const path = yield* Path.Path;
+                  if ((yield* fs.exists(out)) && (yield* fs.readDirectory(out)).length > 0)
+                    return yield* new SourceRejected({
+                      reason: "invalid",
+                      detail: `${out} is not empty.`,
+                      paths: [],
+                    });
+                  const source = yield* workingSource(host, args.organization, args.app);
+                  const write = (file: string, bytes: Uint8Array) =>
+                    Effect.gen(function* () {
+                      const target = path.join(out, ...file.split("/"));
+                      yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+                      yield* fs.writeFile(target, bytes);
+                    });
+                  const stored = new Map<string, string[]>();
+                  for (const file of source.files) {
+                    if ("object" in file)
+                      stored.set(file.object, [...(stored.get(file.object) ?? []), file.path]);
+                    else yield* write(file.path, inlineBytes(file));
+                  }
+                  // Files listed by their blob come from the app's Git remote.
+                  if (stored.size > 0)
+                    yield* readCommitBlobs({
+                      url: source.gitUrl,
+                      authorization: yield* gitAuthorization(host, args.organization),
+                      commit: source.revision.commit,
+                      objects: [...stored.keys()],
+                      write: (object, bytes) =>
+                        Effect.forEach(stored.get(object) ?? [], (file) => write(file, bytes), {
+                          discard: true,
+                        }).pipe(Effect.mapError(() => new SourceError({ reason: "storage" }))),
+                    });
+                  yield* Console.log(
+                    JSON.stringify(
+                      { revision: source.revision, files: source.files.length, out },
+                      null,
+                      2,
+                    ),
+                  );
+                }),
+            }),
+          ),
         ),
       ),
       Command.make("history", { ...connection, app }).pipe(
         Command.withDescription("List recent commits in an app's private Git history"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .history({
-                params: { ...tenant, app: args.app },
-                responseMode: "decoded-and-response",
-              })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .history({
+                  params: { ...tenant, app: args.app },
+                  responseMode: "decoded-and-response",
+                })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
@@ -968,9 +1036,11 @@ export const appsCommand = (platform: string) =>
           },
         ]),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api.git({ params: { ...tenant, app: args.app } }),
-          ).pipe(Effect.flatMap((remote) => Console.log(remote.url))),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api.git({ params: { ...tenant, app: args.app } }),
+            ).pipe(Effect.flatMap((remote) => Console.log(remote.url))),
+          ),
         ),
       ),
       Command.make("commit", {
@@ -999,18 +1069,20 @@ export const appsCommand = (platform: string) =>
           },
         ]),
         Command.withHandler((args) =>
-          Effect.gen(function* () {
-            const files = yield* readSource(args.files);
-            const committed = yield* saveSource({
-              host: args.host,
-              organization: args.organization,
-              app: args.app,
-              expected: args.expected,
-              files,
-              message: args.message,
-            });
-            yield* print(CommittedSource)(committed);
-          }),
+          withHost(args.host, (host) =>
+            Effect.gen(function* () {
+              const files = yield* readSource(args.files);
+              const committed = yield* saveSource({
+                host,
+                organization: args.organization,
+                app: args.app,
+                expected: args.expected,
+                files,
+                message: args.message,
+              });
+              yield* print(CommittedSource)(committed);
+            }),
+          ),
         ),
       ),
       Command.make("deploy", {
@@ -1043,38 +1115,40 @@ export const appsCommand = (platform: string) =>
           },
         ]),
         Command.withHandler((args) =>
-          Effect.gen(function* () {
-            if (Option.isSome(args.commit) === Option.isSome(args.files))
-              return yield* new SourceRejected({
-                reason: "invalid",
-                detail: "Pass exactly one of --commit and --files.",
-                paths: [],
-              });
-            const target = Option.isSome(args.commit)
-              ? args.commit.value
-              : yield* Effect.gen(function* () {
-                  const local = yield* readSource(Option.getOrThrow(args.files));
-                  const head = yield* workingSource(args.host, args.organization, args.app);
-                  const saved = yield* saveSource({
-                    host: args.host,
-                    organization: args.organization,
-                    app: args.app,
-                    expected: head.revision.commit,
-                    files: local,
-                    message: args.message,
-                  });
-                  return saved.revision.commit;
+          withHost(args.host, (host) =>
+            Effect.gen(function* () {
+              if (Option.isSome(args.commit) === Option.isSome(args.files))
+                return yield* new SourceRejected({
+                  reason: "invalid",
+                  detail: "Pass exactly one of --commit and --files.",
+                  paths: [],
                 });
-            yield* manage(args.host, args.organization, (api, tenant) =>
-              api
-                .deploy({
-                  params: { ...tenant, app: args.app },
-                  payload: { commit: target },
-                  responseMode: "decoded-and-response",
-                })
-                .pipe(Effect.flatMap(printResponse)),
-            );
-          }),
+              const target = Option.isSome(args.commit)
+                ? args.commit.value
+                : yield* Effect.gen(function* () {
+                    const local = yield* readSource(Option.getOrThrow(args.files));
+                    const head = yield* workingSource(host, args.organization, args.app);
+                    const saved = yield* saveSource({
+                      host,
+                      organization: args.organization,
+                      app: args.app,
+                      expected: head.revision.commit,
+                      files: local,
+                      message: args.message,
+                    });
+                    return saved.revision.commit;
+                  });
+              yield* manage(host, args.organization, (api, tenant) =>
+                api
+                  .deploy({
+                    params: { ...tenant, app: args.app },
+                    payload: { commit: target },
+                    responseMode: "decoded-and-response",
+                  })
+                  .pipe(Effect.flatMap(printResponse)),
+              );
+            }),
+          ),
         ),
       ),
       Command.make("copy", { ...connection, app, name }).pipe(
@@ -1082,14 +1156,16 @@ export const appsCommand = (platform: string) =>
           "Copy an app into a new app with fresh Git history. Accounts and app data are not copied",
         ),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .copy({
-                params: tenant,
-                payload: { from: { app: args.app }, name: args.name },
-                responseMode: "decoded-and-response",
-              })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .copy({
+                  params: tenant,
+                  payload: { from: { app: args.app }, name: args.name },
+                  responseMode: "decoded-and-response",
+                })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
@@ -1098,62 +1174,75 @@ export const appsCommand = (platform: string) =>
           "Publish a commit to the app registry. Its package.json name identifies the listing",
         ),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .publish({
-                params: { ...tenant, app: args.app },
-                payload: { commit: args.commit },
-                responseMode: "decoded-and-response",
-              })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .publish({
+                  params: { ...tenant, app: args.app },
+                  payload: { commit: args.commit },
+                  responseMode: "decoded-and-response",
+                })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
       Command.make("catalog", connection).pipe(
         Command.withDescription("List published apps available to install"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .catalog({ params: tenant, query: {}, responseMode: "decoded-and-response" })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .catalog({ params: tenant, query: {}, responseMode: "decoded-and-response" })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
       Command.make("published", connection).pipe(
         Command.withDescription("List apps this account has published"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .published({ params: tenant, responseMode: "decoded-and-response" })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .published({ params: tenant, responseMode: "decoded-and-response" })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
       Command.make("install", { ...connection, ...publication, name }).pipe(
         Command.withDescription("Install a published app as a new, independently owned app"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .copy({
-                params: tenant,
-                payload: { from: { package: args.package, commit: args.commit }, name: args.name },
-                responseMode: "decoded-and-response",
-              })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .copy({
+                  params: tenant,
+                  payload: {
+                    from: { package: args.package, commit: args.commit },
+                    name: args.name,
+                  },
+                  responseMode: "decoded-and-response",
+                })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
       Command.make("unpublish", { ...connection, package: publication.package }).pipe(
         Command.withDescription("Remove a published listing. Installed copies keep working"),
         Command.withHandler((args) =>
-          manage(args.host, args.organization, (api, tenant) =>
-            api
-              .unpublish({
-                params: tenant,
-                payload: { package: args.package },
-                responseMode: "decoded-and-response",
-              })
-              .pipe(Effect.flatMap(printResponse)),
+          withHost(args.host, (host) =>
+            manage(host, args.organization, (api, tenant) =>
+              api
+                .unpublish({
+                  params: tenant,
+                  payload: { package: args.package },
+                  responseMode: "decoded-and-response",
+                })
+                .pipe(Effect.flatMap(printResponse)),
+            ),
           ),
         ),
       ),
@@ -1194,7 +1283,7 @@ export const appsCommand = (platform: string) =>
             description: "Call a tool with an inline JSON input",
           },
         ]),
-        Command.withHandler(callTool),
+        Command.withHandler((args) => withHost(args.host, (host) => callTool({ ...args, host }))),
       ),
       Command.make("skills", {
         ...connection,
@@ -1218,7 +1307,7 @@ export const appsCommand = (platform: string) =>
         Command.withDescription(
           "List or read app skills served by the host. Start with --app executor --name executor, then read its app-authoring skill before writing an app",
         ),
-        Command.withHandler(readSkills),
+        Command.withHandler((args) => withHost(args.host, (host) => readSkills({ ...args, host }))),
       ),
       Command.make("credential", {
         action: Argument.Literals("action", ["get", "store", "erase"]).pipe(
@@ -1268,3 +1357,4 @@ export const appsCommand = (platform: string) =>
       ),
     ]),
   );
+};
diff --git a/packages/app-management/src/contracts/api.ts b/packages/app-management/src/contracts/api.ts
index 8bfb465647..dcc5a18b2c 100644
--- a/packages/app-management/src/contracts/api.ts
+++ b/packages/app-management/src/contracts/api.ts
@@ -5,6 +5,7 @@ import {
   SourceDisplayFileQuery,
 } from "./source-display.ts";
 import { ApiError } from "@executor-js/utils/api-error";
+import { UserFacingError } from "@executor-js/utils/user-facing-error";
 /** Shared app wire contracts; browser imports never load HTTP route or Git adapters. */
 import { Context, Schema } from "effect";
 import {
@@ -24,6 +25,7 @@ import {
   StorageError,
   PublicationReadiness,
   RegistryError,
+  RequestRejection,
 } from "@executor-js/sdk/core";
 export * from "./framework.ts";
 
@@ -42,6 +44,28 @@ export const AppAccessDenied = ApiError.define({
       : "This caller may not perform this app operation, or cannot access this app.",
 });
 export type AppAccessDenied = typeof AppAccessDenied.Type;
+/**
+ * A client released before wire revisions asked to remove a listing by the short name it is shown,
+ * `@acme/notes` for `@acme.executor.community/notes`. It states no commit, so the name cannot be
+ * bound to the listing it was shown. Those clients print an error their contract lacks as the host
+ * states it.
+ */
+export const FullListingNameRequired = UserFacingError.define({
+  tag: "FullListingNameRequired",
+  status: 400,
+  fields: { name: PackageName, fullName: PackageName },
+  recorded: () =>
+    "A client without a wire revision asked to remove a public listing by its short name.",
+  presentation: ({ name, fullName }) => ({
+    title: "Remove this listing by its full name",
+    description: `${name} is the short form of a public listing's name. It selects whichever listing holds that name when the request arrives, which may not be the one that was listed, so nothing was removed.`,
+    recovery: {
+      action: `Remove ${fullName} instead. Releases up to 2.0.0-beta.15 cannot send that name: install the current release first with npm i -g executor@beta --include=optional.`,
+      instructions: `The request stated no executor-wire-revision header, so the host lists public packages to this client by short names such as ${name} and removes none by them. Run executor apps unpublish --package ${fullName}. If the CLI rejects that name, update it first with npm i -g executor@beta --include=optional. API callers send executor-wire-revision: 1.`,
+    },
+  }),
+});
+export type FullListingNameRequired = typeof FullListingNameRequired.Type;
 /** Expected operation failures are shared unchanged across the product transports. */
 export const appOperationErrors = [
   StorageError,
@@ -150,7 +174,7 @@ export const appManagementApi = <I extends HttpApiMiddleware.AnyId, S>(
   const tenant =
     prefix === "/api" ? Schema.Struct({}) : Schema.Struct({ organization: Schema.NonEmptyString });
   const app = Schema.Struct({ ...tenant.fields, app: AppId });
-  return HttpApi.make("app-management").add(
+  const api = HttpApi.make("app-management").add(
     HttpApiGroup.make("appManagement")
       .add(
         HttpApiEndpoint.get("list", "/apps", {
@@ -292,7 +316,7 @@ export const appManagementApi = <I extends HttpApiMiddleware.AnyId, S>(
           params: tenant,
           payload: Schema.Struct({ package: PackageName }),
           success: Schema.Struct({ name: PackageName }),
-          error: appOperationErrors,
+          error: [...appOperationErrors, FullListingNameRequired],
         }).annotate(
           OpenApi.Description,
           "Remove a registry listing. Existing installed copies remain independent and usable.",
@@ -301,4 +325,5 @@ export const appManagementApi = <I extends HttpApiMiddleware.AnyId, S>(
       .prefix(prefix)
       .middleware(access),
   );
+  return api.middleware(RequestRejection);
 };
diff --git a/packages/app-management/src/contracts/data-steps.ts b/packages/app-management/src/contracts/data-steps.ts
index e5a1dac19e..51841bd466 100644
--- a/packages/app-management/src/contracts/data-steps.ts
+++ b/packages/app-management/src/contracts/data-steps.ts
@@ -29,6 +29,11 @@ export interface DataStep<R> {
   readonly items: Effect.Effect<ReadonlyArray<DataStepItem<R>>, unknown, R>;
   /** Outcomes that a later pass revisits. The step is complete once a pass ends without them. */
   readonly retry: ReadonlyArray<string>;
+  /**
+   * Retry outcomes that are not failures, such as a concurrent edit the next pass retries. Their
+   * items are revisited like any retry outcome but do not count as failed items.
+   */
+  readonly expected?: ReadonlyArray<string>;
   /**
    * Whether a report still walks the items after the step has applied, as an independent check
    * of its result under a new report label. Otherwise an applied step has nothing to report.
@@ -57,6 +62,19 @@ export const DataStepSummary = Schema.Struct({
 });
 export type DataStepSummary = typeof DataStepSummary.Type;
 
+/**
+ * What one run of the pending steps did. `pending` when a step still has work: the deadline passed,
+ * another process holds its lease, or its last pass left items to retry. `attempted` counts the
+ * items the run handled and recorded, and `failed` those of them that ended with one of their
+ * step's retry outcomes that is not `expected`, such as `failed` (but not a retried `conflict`). A run that only waited for a lease or a
+ * backoff, or ran out of time, has no failed items.
+ */
+export interface DataStepRun {
+  readonly status: "complete" | "pending";
+  readonly attempted: number;
+  readonly failed: number;
+}
+
 /** The prefix of the single log line each finished pass writes, followed by its JSON summary. */
 export const dataStepLogPrefix = "Data step pass finished: ";
 
diff --git a/packages/app-management/src/contracts/framework.ts b/packages/app-management/src/contracts/framework.ts
index e4b9d7a103..ecc90ecbd9 100644
--- a/packages/app-management/src/contracts/framework.ts
+++ b/packages/app-management/src/contracts/framework.ts
@@ -2,6 +2,7 @@
 import { Context, Schema, type Effect } from "effect";
 import type { HttpApiMiddleware } from "effect/http-api";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
+import { RequestRejection } from "@executor-js/sdk/core";
 
 const Entry = Schema.Struct({
   symbol: Schema.String,
@@ -91,7 +92,7 @@ export const frameworkApi = <I extends HttpApiMiddleware.AnyId, S>(
 ) => {
   const params =
     prefix === "/api" ? Schema.Struct({}) : Schema.Struct({ organization: Schema.NonEmptyString });
-  return HttpApi.make("framework").add(
+  const api = HttpApi.make("framework").add(
     HttpApiGroup.make("framework")
       .add(
         HttpApiEndpoint.get("release", "/framework/release", {
@@ -133,4 +134,5 @@ export const frameworkApi = <I extends HttpApiMiddleware.AnyId, S>(
       .prefix(prefix)
       .middleware(access),
   );
+  return api.middleware(RequestRejection);
 };
diff --git a/packages/app-management/src/http.ts b/packages/app-management/src/http.ts
index f8d6979312..572805d675 100644
--- a/packages/app-management/src/http.ts
+++ b/packages/app-management/src/http.ts
@@ -3,6 +3,7 @@ import {
   AppAccessDenied,
   AppIdentity,
   appManagementApi,
+  FullListingNameRequired,
   type AppCapabilities,
 } from "./contracts/api.ts";
 export * from "./contracts/api.ts";
@@ -12,7 +13,7 @@ export {
   frameworkRoutes,
 } from "./implementation/framework.ts";
 /** Product-authorized app authoring, release discovery, and ordinary Git access. */
-import { Array as Arr, Context, Effect, Layer, Schema } from "effect";
+import { Array as Arr, Context, Effect, Layer, Option, Schema } from "effect";
 import { HttpMiddleware, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import {
   HttpApi,
@@ -37,6 +38,13 @@ import {
   Publication,
   PublicationSnapshot,
   PackageName,
+  packageNameFromRevision,
+  publicationForRevision,
+  publicationsForRevision,
+  readinessForRevision,
+  registryForRevision,
+  requestWireRevision,
+  scopedNameFor,
   type App,
   type AppCopySnapshot,
   type Executor,
@@ -95,6 +103,13 @@ const gitRemote = (scope: string, app: App) =>
     const path = `/git/${encodeURIComponent(scope)}/${app.slug}.git`;
     return { path, url: origin + path };
   });
+/**
+ * The wire revision the requesting client reads; see `wire-revision.ts` in the SDK. The span
+ * records it, so the requests still answered in an earlier revision can be counted.
+ */
+const clientRevision = Effect.map(HttpServerRequest.HttpServerRequest, (request) =>
+  requestWireRevision(request.headers),
+).pipe(Effect.tap((revision) => Effect.annotateCurrentSpan("executor.wire_revision", revision)));
 /** Cookies never authorize Git. The host validates the explicit scoped Git credential. */
 export class AppGitAccess extends Context.Service<
   AppGitAccess,
@@ -141,17 +156,22 @@ const projectApp = <A extends App>(
   app: A,
   identity: Context.Service.Shape<typeof AppIdentity>,
 ) => capabilities(host, app, identity).pipe(Effect.as(app));
-/** The catalog reads this caller gets: the product's narrowed view, or the executor's own. */
+/**
+ * The catalog reads this caller gets: the product's narrowed view, or the executor's own as a
+ * client reading wire `revision` sees it. A narrowed view names listings as its product does.
+ */
 const readableRegistry = (
   host: ManagementHost,
   identity: Context.Service.Shape<typeof AppIdentity>,
-): Pick<Registry, "list" | "snapshot"> =>
-  host.registry === undefined
-    ? {
-        list: (name) => host.executor.registry.list(name === undefined ? {} : { name }),
-        snapshot: (name, commit) => host.executor.registry.snapshot({ name, commit }),
-      }
-    : host.registry(identity);
+  revision: number,
+): Pick<Registry, "list" | "snapshot"> => {
+  if (host.registry !== undefined) return host.registry(identity);
+  const registry = registryForRevision(host.executor.registry, revision);
+  return {
+    list: (name) => registry.list(name === undefined ? {} : { name }),
+    snapshot: (name, commit) => registry.snapshot({ name, commit }),
+  };
+};
 const ownedSource = (
   host: ManagementHost,
   identity: Context.Service.Shape<typeof AppIdentity>,
@@ -234,7 +254,8 @@ const workspaceSource = (id: AppId) =>
     return {
       ...source,
       ...fields,
-      publication:
+      publication: readinessForRevision(
+        yield* clientRevision,
         canPublish && metadata.namespace !== null
           ? yield* host.executor.publications.preview({
               owner: app.owner,
@@ -243,6 +264,7 @@ const workspaceSource = (id: AppId) =>
               files: source.files,
             })
           : null,
+      ),
     };
   });
 /** Routes call existing SDK app operations; authoring never creates another project identity. */
@@ -328,7 +350,14 @@ export const appManagementHandlers = <I extends HttpApiMiddleware.AnyId, S, Id e
             "app" in payload.from
               ? (yield* ownedSource(host, identity, payload.from.app)).app.id
               : host.registry === undefined
-                ? payload.from
+                ? {
+                    ...payload.from,
+                    package: yield* packageNameFromRevision(
+                      host.executor.registry,
+                      yield* clientRevision,
+                      payload.from.package,
+                    ),
+                  }
                 : // The narrowed catalog resolves the files; a listing this caller may not read
                   // does not exist for it.
                   yield* host.registry(identity).copy(payload.from);
@@ -367,6 +396,7 @@ export const appManagementHandlers = <I extends HttpApiMiddleware.AnyId, S, Id e
           yield* ownedSource(host, identity, params.app, true);
           if (identity.namespace === null)
             return yield* new AppAccessDenied({ reason: "forbidden" });
+          const revision = yield* clientRevision;
           return yield* host.executor.publications
             .publish({
               owner: identity.owner,
@@ -380,6 +410,9 @@ export const appManagementHandlers = <I extends HttpApiMiddleware.AnyId, S, Id e
                   ? new AppAccessDenied({ reason: "forbidden" })
                   : error,
               ),
+              Effect.flatMap((published) =>
+                publicationForRevision(host.executor.registry, revision, published),
+              ),
             );
         }),
       )
@@ -387,27 +420,48 @@ export const appManagementHandlers = <I extends HttpApiMiddleware.AnyId, S, Id e
         Effect.gen(function* () {
           const identity = yield* AppIdentity;
           const host = yield* Effect.flatten(AppManagementHost);
-          return yield* readableRegistry(host, identity).list(query.name);
+          return yield* readableRegistry(host, identity, yield* clientRevision).list(query.name);
         }),
       )
       .handle("publicationSource", ({ query }) =>
         Effect.gen(function* () {
           const identity = yield* AppIdentity;
           const host = yield* Effect.flatten(AppManagementHost);
-          return yield* readableRegistry(host, identity).snapshot(query.name, query.commit);
+          return yield* readableRegistry(host, identity, yield* clientRevision).snapshot(
+            query.name,
+            query.commit,
+          );
         }),
       )
       .handle("published", () =>
         Effect.gen(function* () {
           const identity = yield* AppIdentity;
           const host = yield* Effect.flatten(AppManagementHost);
-          return yield* host.executor.publications.owned({ owner: identity.owner });
+          const revision = yield* clientRevision;
+          return yield* host.executor.publications
+            .owned({ owner: identity.owner })
+            .pipe(
+              Effect.flatMap((all) =>
+                publicationsForRevision(host.executor.registry, revision, all),
+              ),
+            );
         }),
       )
       .handle("unpublish", ({ payload }) =>
         Effect.gen(function* () {
           const identity = yield* writeIdentity;
           const host = yield* Effect.flatten(AppManagementHost);
+          // Revision 0 is shown a scoped listing by a short name, `@acme/notes`, and states no
+          // commit. By the time a removal arrives that name can select another listing, so it is
+          // never resolved for one; the client is given the full name. A full name means only
+          // itself. A host that reads a remote registry refuses every removal anyway.
+          const { publishing } = yield* host.executor.publications.status();
+          const fullName = scopedNameFor(payload.package);
+          if (publishing && Option.isSome(fullName) && (yield* clientRevision) < 1)
+            return yield* new FullListingNameRequired({
+              name: payload.package,
+              fullName: fullName.value,
+            });
           return yield* host.executor.publications
             .unpublish({ owner: identity.owner, package: payload.package })
             .pipe(
@@ -456,6 +510,11 @@ export const registryRoutes = (() => {
       (host) => host.registry === undefined && (host.publicationAudience ?? "public") === "public",
       () => new RegistryError({ reason: "forbidden" }),
     ),
+    Effect.flatMap((host) =>
+      Effect.map(clientRevision, (revision) =>
+        registryForRevision(host.executor.registry, revision),
+      ),
+    ),
   );
   // Public sites read the catalog from another origin (`executor.sh` reads `api.executor.sh`).
   // The reads carry no credentials, so any origin may read them; a preflight gets the same answer.
@@ -466,13 +525,13 @@ export const registryRoutes = (() => {
         HttpApiBuilder.group(api, "registry", (h) =>
           h
             .handle("list", ({ query }) =>
-              Effect.flatMap(publicRegistry, (host) => host.executor.registry.list(query)),
+              Effect.flatMap(publicRegistry, (registry) => registry.list(query)),
             )
             .handle("snapshot", ({ query }) =>
-              Effect.flatMap(publicRegistry, (host) => host.executor.registry.snapshot(query)),
+              Effect.flatMap(publicRegistry, (registry) => registry.snapshot(query)),
             )
             .handle("file", ({ query }) =>
-              Effect.flatMap(publicRegistry, (host) => host.executor.registry.file(query)),
+              Effect.flatMap(publicRegistry, (registry) => registry.file(query)),
             ),
         ),
       ),
diff --git a/packages/app-management/src/implementation/data-steps.ts b/packages/app-management/src/implementation/data-steps.ts
index 78f9ccb516..42b30b0252 100644
--- a/packages/app-management/src/implementation/data-steps.ts
+++ b/packages/app-management/src/implementation/data-steps.ts
@@ -16,6 +16,7 @@ import {
   type DataStep,
   type DataStepJournal,
   type DataStepMode,
+  type DataStepRun,
   type DataStepSummary,
 } from "../contracts/data-steps.ts";
 
@@ -85,16 +86,19 @@ const Counts = Schema.Array(
   Schema.Struct({ owner: Schema.String, outcome: Schema.String, count: Schema.Number }),
 );
 
-/**
- * Advance every pending step, in order. Returns `pending` when a step still has work, because the
- * deadline passed, another process holds its lease, or its last pass left items to retry.
- */
-export const runDataSteps = <R>(steps: ReadonlyArray<DataStep<R>>, options: DataStepRunOptions) =>
+/** Advance every pending step, in order, and say what this run did (see {@link DataStepRun}). */
+export const runDataSteps = <R>(
+  steps: ReadonlyArray<DataStep<R>>,
+  options: DataStepRunOptions,
+): Effect.Effect<DataStepRun, DataStepUnavailable, R | SqlClient.SqlClient> =>
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
     const journal = sql(`${options.journal}_data_steps`);
     const outcomes = sql(`${options.journal}_data_step_items`);
     const run = options.mode === "apply" ? "apply" : `report:${options.report}`;
+    // Only the caller reads these; the journal, retries and logs do not depend on them.
+    let attempted = 0;
+    let failed = 0;
 
     const advance = (step: DataStep<R>) =>
       Effect.gen(function* () {
@@ -174,6 +178,8 @@ export const runDataSteps = <R>(steps: ReadonlyArray<DataStep<R>>, options: Data
             }),
           );
           cursor = item.id;
+          attempted += 1;
+          if (step.retry.includes(outcome) && !step.expected?.includes(outcome)) failed += 1;
         }
 
         // Items removed since an earlier pass cannot be retried; they no longer need the step.
@@ -229,6 +235,7 @@ export const runDataSteps = <R>(steps: ReadonlyArray<DataStep<R>>, options: Data
         }),
       );
 
-    for (const step of steps) if ((yield* advance(step)) === "pending") return "pending" as const;
-    return "complete" as const;
+    for (const step of steps)
+      if ((yield* advance(step)) === "pending") return { status: "pending", attempted, failed };
+    return { status: "complete", attempted, failed };
   });
diff --git a/packages/app-management/src/implementation/executor-app-redeploy.ts b/packages/app-management/src/implementation/executor-app-redeploy.ts
index f6af3f0cfc..1f6a09aab8 100644
--- a/packages/app-management/src/implementation/executor-app-redeploy.ts
+++ b/packages/app-management/src/implementation/executor-app-redeploy.ts
@@ -238,6 +238,8 @@ export const executorAppRedeployStep = (
 ): DataStep<SqlClient.SqlClient> => ({
   name,
   retry: ["conflict", "failed"],
+  // A concurrent edit is retried on the next pass; it is not a failed item.
+  expected: ["conflict"],
   items: host.executor.apps.list({}).pipe(
     Effect.map((apps) =>
       apps.filter(executorShaped).map((app) => ({
diff --git a/packages/app-management/src/implementation/framework-pin.ts b/packages/app-management/src/implementation/framework-pin.ts
index f4c1fa268b..adaaa14bb5 100644
--- a/packages/app-management/src/implementation/framework-pin.ts
+++ b/packages/app-management/src/implementation/framework-pin.ts
@@ -263,6 +263,8 @@ export const frameworkPinStep = (
 ): DataStep<never> => ({
   name,
   retry: ["conflict", "failed"],
+  // A concurrent edit is retried on the next pass; it is not a failed item.
+  expected: ["conflict"],
   items: host.executor.apps.list({}).pipe(
     Effect.map((apps) =>
       apps.map((app) => ({
diff --git a/packages/app-management/src/implementation/host-data-steps.ts b/packages/app-management/src/implementation/host-data-steps.ts
index 8c8ef8515d..8aca96c150 100644
--- a/packages/app-management/src/implementation/host-data-steps.ts
+++ b/packages/app-management/src/implementation/host-data-steps.ts
@@ -132,7 +132,7 @@ export const runStartupDataSteps = <Journal extends DataStepJournal>(
 ) =>
   Effect.gen(function* () {
     const mode = yield* startupDataStepMode;
-    const status = yield* runDataSteps(hostDataSteps(host), {
+    const { status } = yield* runDataSteps(hostDataSteps(host), {
       journal,
       mode,
       report: `startup-${yield* Clock.currentTimeMillis}`,
diff --git a/packages/app-management/src/implementation/idle-agent-grants.ts b/packages/app-management/src/implementation/idle-agent-grants.ts
index 26ac286853..8214db459a 100644
--- a/packages/app-management/src/implementation/idle-agent-grants.ts
+++ b/packages/app-management/src/implementation/idle-agent-grants.ts
@@ -9,19 +9,22 @@ import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import type { DataStep, DataStepJournal, DataStepMode } from "../contracts/data-steps.ts";
 
-/** A host's grant expiry endpoints; see `grantExpiry` in `@executor-js/mcp-auth/oauth`. */
-export interface AgentGrantExpiry {
+/**
+ * A host's grant expiry endpoints, which fail with `E`; see `grantExpiry` in
+ * `@executor-js/mcp-auth/oauth`.
+ */
+export interface AgentGrantExpiry<E = unknown> {
   /** The most grants one call lists or checks. */
   readonly batch: number;
   /** Up to `batch` unrevoked grants after `after`, in ID order. */
   readonly page: (
     after: string | null,
-  ) => Effect.Effect<ReadonlyArray<{ readonly id: string; readonly userId: string }>, unknown>;
+  ) => Effect.Effect<ReadonlyArray<{ readonly id: string; readonly userId: string }>, E>;
   /** Each grant's outcome; idle grants are revoked only when `apply` is set. */
   readonly expire: (
     ids: ReadonlyArray<string>,
     apply: boolean,
-  ) => Effect.Effect<ReadonlyArray<{ readonly id: string; readonly outcome: string }>, unknown>;
+  ) => Effect.Effect<ReadonlyArray<{ readonly id: string; readonly outcome: string }>, E>;
 }
 
 export interface AgentGrantHost {
@@ -31,12 +34,12 @@ export interface AgentGrantHost {
 type GrantPage = ReadonlyArray<{ readonly id: string; readonly userId: string }>;
 
 /** Visit every unrevoked grant, one page at a time, in ID order. */
-const eachPage = <E, R>(
-  grants: AgentGrantExpiry,
+const eachPage = <G, E, R>(
+  grants: AgentGrantExpiry<G>,
   visit: (page: GrantPage) => Effect.Effect<void, E, R>,
-): Effect.Effect<void, unknown, R> =>
+): Effect.Effect<void, G | E, R> =>
   grants.page(null).pipe(
-    Effect.flatMap(function next(page): Effect.Effect<void, unknown, R> {
+    Effect.flatMap(function next(page): Effect.Effect<void, G | E, R> {
       const last = page.at(-1);
       if (last === undefined) return Effect.void;
       return visit(page).pipe(
@@ -85,7 +88,7 @@ const Applied = Schema.Array(Schema.Struct({ completed: Schema.Boolean }));
  * including while Cloud only reports the step, this does nothing, so no grant is revoked without
  * the reviewed step. Logs one summary line with counts per outcome.
  */
-export const expireIdleAgentGrants = (grants: AgentGrantExpiry, journal: DataStepJournal) =>
+export const expireIdleAgentGrants = <E>(grants: AgentGrantExpiry<E>, journal: DataStepJournal) =>
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
     const applied = yield* sql`select completed_at is not null as completed
diff --git a/packages/app-source/src/node.ts b/packages/app-source/src/node.ts
index 75b77cdb07..45a0b002dd 100644
--- a/packages/app-source/src/node.ts
+++ b/packages/app-source/src/node.ts
@@ -1,13 +1,46 @@
 /** Native Git process and filesystem lifetime for Node and Bun hosts. */
 import * as NodeServices from "@effect/platform-node/NodeServices";
+import { join } from "node:path";
 import { Effect, Exit, FileSystem, Path, Scope, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import * as PlatformError from "effect/PlatformError";
 import { SourceError, type RepositoryBackend } from "@executor-js/sdk/core";
 import { gitRepositories } from "./implementation/git-repositories.ts";
 
+/** The Git a host runs: its executable and what its processes need beside the host's environment. */
+export interface NativeGit {
+  readonly executable: string;
+  readonly environment: Readonly<Record<string, string>>;
+}
+
+/** The Git on PATH, as a server image or a development checkout provides it. */
+export const systemGit: NativeGit = { executable: "git", environment: {} };
+
+/**
+ * A Git distribution laid out as dugite's, such as the copy a release bundles. Its environment
+ * reaches only the Git processes this host starts, so processes Executor starts for other
+ * purposes keep the user's PATH and Git. On Windows `cmd/git.exe` puts MinGit's own directories
+ * on its PATH.
+ */
+export const bundledGit = (directory: string): NativeGit =>
+  process.platform === "win32"
+    ? {
+        executable: join(directory, "cmd", "git.exe"),
+        environment: { GIT_EXEC_PATH: join(directory, "mingw64", "libexec", "git-core") },
+      }
+    : {
+        executable: join(directory, "bin", "git"),
+        environment: {
+          GIT_EXEC_PATH: join(directory, "libexec", "git-core"),
+          GIT_TEMPLATE_DIR: join(directory, "share", "git-core", "templates"),
+          // A Linux Git built for one prefix resolves its files from PREFIX when moved.
+          ...(process.platform === "linux" ? { PREFIX: directory } : {}),
+        },
+      };
+
 /** Execute without a shell. Git diagnostics can contain source or paths and are discarded. */
-const git = (
+const run = (
+  git: NativeGit,
   args: ReadonlyArray<string>,
   input?: Uint8Array,
   environment?: Record<string, string>,
@@ -19,14 +52,14 @@ const git = (
         // Receive-pack adds a quarantine directory beneath the repository. Let
         // Git use Windows extended paths for those deeper object filenames.
         ChildProcess.make(
-          "git",
+          git.executable,
           ["-c", "core.hooksPath=/dev/null", "-c", "core.longpaths=true", ...args],
           {
             stdin: input === undefined ? "ignore" : Stream.succeed(input),
             stdout: "pipe",
             stderr: "ignore",
             extendEnv: true,
-            env: { ...gitEnvironment, ...environment },
+            env: { ...gitEnvironment, ...git.environment, ...environment },
           },
         ),
       );
@@ -61,6 +94,7 @@ const gitEnvironment = {
  * out. The process lives until its output is read or the response is cancelled.
  */
 const httpBackend = (
+  git: NativeGit,
   environment: Record<string, string>,
   body: ReadableStream<Uint8Array> | null,
 ) =>
@@ -70,7 +104,7 @@ const httpBackend = (
     const process = yield* spawner
       .spawn(
         ChildProcess.make(
-          "git",
+          git.executable,
           ["-c", "core.hooksPath=/dev/null", "-c", "core.longpaths=true", "http-backend"],
           {
             stdin:
@@ -90,7 +124,7 @@ const httpBackend = (
             stdout: "pipe",
             stderr: "ignore",
             extendEnv: true,
-            env: { ...gitEnvironment, ...environment },
+            env: { ...gitEnvironment, ...git.environment, ...environment },
           },
         ),
       )
@@ -104,12 +138,12 @@ const httpBackend = (
   }).pipe(Effect.mapError(() => new SourceError({ reason: "git" })));
 
 /** Lazy repositories with scoped native processes and temporary indexes. */
-export const nativeRepositories = (directory: string): RepositoryBackend => {
+export const nativeRepositories = (directory: string, git: NativeGit): RepositoryBackend => {
   const provide = Effect.provide(NodeServices.layer);
   return gitRepositories({
     directory,
-    git: (args, input, environment) => git(args, input, environment).pipe(provide),
-    httpBackend: (environment, body) => httpBackend(environment, body).pipe(provide),
+    git: (args, input, environment) => run(git, args, input, environment).pipe(provide),
+    httpBackend: (environment, body) => httpBackend(git, environment, body).pipe(provide),
     createDirectory: (path) =>
       FileSystem.FileSystem.use((fs) =>
         fs.makeDirectory(path, { recursive: true, mode: 0o700 }),
diff --git a/packages/app-templates/executor/skills/app-authoring/accounts.md b/packages/app-templates/executor/skills/app-authoring/accounts.md
index 89d96d920a..841383d9c1 100644
--- a/packages/app-templates/executor/skills/app-authoring/accounts.md
+++ b/packages/app-templates/executor/skills/app-authoring/accounts.md
@@ -398,6 +398,20 @@ wholesale. Keep `openid`, `profile` and `email` only when the service or app nee
 identity; an access-token-only app can declare its resource scopes explicitly.
 The host adds `offline_access` when advertised and `scopes` is omitted.
 
+Sign-in sends one RFC 8707 resource indicator on authorization, exchange and
+renewal: `resource` when declared, otherwise the one the protected-resource
+metadata names. `accounts.oauthSetup` reports it as `resource: { value, source }`;
+`value` is null when it sends none, and `source` says why. When the service
+refuses it (`resource_rejected`) or refuses the token it issued, declare the
+identifier the service documents, or `resource: null` to send none. Declaring the
+value discovery already found changes nothing. With `source: "operator"` the
+instance's own OAuth client sets it, and only the instance administrator can
+change it; the provider's `resource` does not apply. With
+`source: "inferred_scope_audience"` Executor sent none because the authorization
+server's metadata looks like Microsoft identity platform v2.0's, which takes the
+audience from the scopes. That is Executor's guess from the service's metadata;
+if the service refuses the sign-in, declare `resource`.
+
 Standard discovery requires the metadata's `issuer` to equal the issuer used to
 construct the well-known metadata URL.
 Microsoft Entra ID's multi-tenant `common` and `organizations` endpoints publish
diff --git a/packages/app-templates/executor/skills/app-authoring/deploy.md b/packages/app-templates/executor/skills/app-authoring/deploy.md
index 663ba96bba..d811ea03a3 100644
--- a/packages/app-templates/executor/skills/app-authoring/deploy.md
+++ b/packages/app-templates/executor/skills/app-authoring/deploy.md
@@ -48,9 +48,13 @@ Git clone has them all.
 Read these docs with
 `executor apps skills --app executor --name app-authoring --file deploy.md`.
 
-Commands target the local server at `http://127.0.0.1:4312` by default. It
-reads the local API key from `EXECUTOR_API_KEY`. If that variable is unset, ask
-the user to set it; do not search files for it. For hosted Executor, run
+Without `--host` or `EXECUTOR_HOST`, commands use the local background
+Executor, starting it if it is not running, and need no API key. A set
+`EXECUTOR_API_KEY` is sent in place of the background Executor's own
+credential, so it must be that server's current key. A `--host` that names
+another local server, such as `http://127.0.0.1:4400`, needs that server's API
+key in `EXECUTOR_API_KEY`; if the variable is unset, ask the user to set it, and
+do not search files for it. For hosted Executor, run
 `executor apps login --host https://api.executor.sh` once. It prints a link and
 a code and waits; ask the user to open the link and approve the code. Then pass
 the same `--host` to every command, or set `EXECUTOR_HOST` to it once.
@@ -505,7 +509,9 @@ Every call follows the active version, so nothing needs updating to pick up
 new code. The next `execute` lists and calls the new tools. Activating a
 version re-registers each webhook source's subscriptions on it in the
 background, usually within seconds, without blocking tool calls; the app's
-Webhooks tab shows their status. It also deletes the saved settings of schedules
+Webhooks tab shows their status. A manual (`setup`) subscription keeps its
+callback URL, secret and setup fields while the activated version keeps the same
+`signingSecret` and accepts the same `state` fields; changing either needs a new setup. It also deletes the saved settings of schedules
 the new version no longer declares.
 
 `apps.versions` lists retained versions. `apps.source` accepts an optional
diff --git a/packages/app-templates/executor/skills/app-authoring/integrations.md b/packages/app-templates/executor/skills/app-authoring/integrations.md
index 111535afc8..c22acc6db2 100644
--- a/packages/app-templates/executor/skills/app-authoring/integrations.md
+++ b/packages/app-templates/executor/skills/app-authoring/integrations.md
@@ -118,6 +118,13 @@ export default defineApp({}, async ({ signal }) => ({
 }));
 ```
 
+A tool the server marks `readOnlyHint: true` is a query, but that is the
+server's claim, so Executor still treats a failed call to it as one that may
+have written: the agent is told not to repeat it. A second argument, `kinds`,
+keyed by tool name, is the app's own classification: `{ search: "query" }`
+confirms a tool that only reads and keeps a read's retry advice, and
+`"mutation"` corrects a wrong hint. Confirm only tools you know do not write.
+
 Authenticated apps declare `user: { accounts: { service: provider.many() } }`,
 so each member links their own accounts, and combine discovery with
 `tools: await accountRouter(ctx.user?.accounts.service ?? [], account => mcpRouter({ ... }), { signal })`
@@ -298,7 +305,10 @@ operationId `listProjects` tagged `projects` becomes
 becomes `accounts.connect`. Both parts are camelCased from their words: tag
 `Team Members` with operationId `list_team_members` becomes
 `teamMembers.listTeamMembers`, and `GetUserByID` becomes `getUserById`.
-Without an operationId the name comes from the method and path. Names that
+Without an operationId the name comes from the method and path. A fixed query
+or fragment in a declared path, as in `/search?type=items`, is not part of the
+name; the query is sent before the operation's parameters and the fragment is
+not sent. Names that
 collide, whether or not they come from operationIds, are told apart in this
 order: first the path's version segment, as in `users.v2.listUsers`; then the
 path segments that differ, so `GET /builds` and `GET /builds/{build_num}` become
@@ -321,7 +331,9 @@ account: call `liveOpenapiRouter` without `accountRouter` and with
 normalized metadata. Use `contentType` to choose an alternate declared request
 media type. Binary request bodies and multipart binary fields take base64
 strings. Binary responses return `{ base64, contentType }`; text and JSON
-sequences (NDJSON, JSON Lines, `json-seq`) return text. Success responses have
+sequences (NDJSON, JSON Lines, `json-seq`) return text. An operation that can
+answer with an event stream or another type asks for the other type; one that
+answers only with an event stream is not a tool. Success responses have
 a 16 MiB / 30-second read bound. Live SSE
 requires an authored subscription.
 
diff --git a/packages/app-templates/executor/skills/app-authoring/webhooks.md b/packages/app-templates/executor/skills/app-authoring/webhooks.md
index 1e05c3616d..9841651fb5 100644
--- a/packages/app-templates/executor/skills/app-authoring/webhooks.md
+++ b/packages/app-templates/executor/skills/app-authoring/webhooks.md
@@ -60,7 +60,14 @@ with `setup: { instructions: "...", signingSecret: "executor" }`.
 Keep `handle` and both schemas. `state` describes the private setup fields;
 use `object({})` if only a signing secret is needed. `executor` means the operator
 copies a generated secret into the provider; `provider` means they paste the
-provider's secret into Executor's secure page.
+provider's secret into Executor's secure page. A version that keeps `signingSecret`
+and the fields `state` accepts keeps the subscription, callback URL and secret,
+also when an earlier version is activated again; reordering fields is no change.
+Changing either needs a new setup at the provider.
+
+An `app` webhook's subscription comes from linking an account to the app, so
+`webhooks.create` refuses it with `reason: "input"` and a message saying so;
+find it with `webhooks.list`.
 
 When creation returns `setup-required`, request `webhookLinks.link({ path: { app, subscription } })` (local) or
 the hosted `setupLink` operation and show the URL to the user. Do not ask for
diff --git a/packages/app-templates/executor/skills/app-authoring/workflows.md b/packages/app-templates/executor/skills/app-authoring/workflows.md
index 9bc9d46516..7bff93fc41 100644
--- a/packages/app-templates/executor/skills/app-authoring/workflows.md
+++ b/packages/app-templates/executor/skills/app-authoring/workflows.md
@@ -35,6 +35,15 @@ App mutations/webhooks can call `ctx.workflows.start({ workflow, input, key? })`
 and `terminate({ run })`. Queries also have `get({ run })` and `list(options?)`.
 Controls cannot target another app. Use stable start keys when retrying a caller;
 starting a workflow is never part of a SQL transaction.
+
+Limits: workflow and step names are 1–200 characters, `start` input is JSON of at
+most 1 MiB, a `key` is 1–128 characters, and `list` takes `limit` 1–100 (default
+20). A start with the same key and input returns that run; the same key with
+other input fails with reason `conflict`. Controls throw `WorkflowFailure` with
+`reason`, `retryable` and a `message`. Reason `input` is refused before any run
+starts; fix the call. A `start` that fails with reason `engine` and
+`retryable: false` may still have started its run: start again with the same key
+and input, or check `list`, before starting a run without a key.
 The SDK namespace is `executor.apps.workflowRuns`, with discovery through
 `executor.apps.workflows.list`. Do not invent `executor.workflowRuns`.
 
diff --git a/packages/app-templates/executor/skills/code-mode/SKILL.md b/packages/app-templates/executor/skills/code-mode/SKILL.md
index ac31e03210..67a06816c0 100644
--- a/packages/app-templates/executor/skills/code-mode/SKILL.md
+++ b/packages/app-templates/executor/skills/code-mode/SKILL.md
@@ -34,8 +34,7 @@ repeating them in every item.
 
 `namespace` is an app slug, such as `gmail`, or a namespace inside it. Without
 it, search loads and searches every app, which is slower. A page holds at most
-`limit` items, 10 by default, and stops sooner at a quarter of the output limit
-(16 KB by default). `remaining` counts the matches after the page, and `next`
+`limit` items, 10 by default, and stops sooner at about 25 KB of JSON. `remaining` counts the matches after the page, and `next`
 is the input for the following page, or `null` after the last match: call
 `tools.search(next)` to continue.
 
@@ -107,7 +106,8 @@ arguments or source, and never search their files for tokens. The Executor app
   it. Hosted
   management calls need the organization: call `context.get({})` first and pass
   its `organization` as `path.organization`. For an OAuth sign-in,
-  `accounts.oauthSetup` lists the scopes it will request; tell the user.
+  `accounts.oauthSetup` lists the scopes it will request and the resource
+  indicator it will send; tell the user.
 
 Search for these tools and read their input types first; the connect tools
 require `body`, so pass `body: {}` when it has nothing. Give the user the
@@ -167,9 +167,13 @@ These are the defaults. The source limit is fixed; a host can change the others.
 
 - Program source: 65,536 characters, including app source passed as data. With
   a shell, deploy large apps with the `executor apps` CLI instead.
-- Output: 65,536 bytes for the returned value, warnings and logs together. A
-  larger value comes back as a truncated string that says so. Return fewer
-  fields, a count, or one page.
+- Output: none. The returned value and logs come back whole, however large, but
+  they fill your context, so return only the fields, count or page you need.
+  The runtime limits one value crossing between an app and Executor, such as a
+  tool's result, to 32 MiB. On Cloud, a result of a few tens of megabytes can
+  also pass the session's 128 MB memory. Failures Executor recognizes get an
+  error naming the likely limit, never a cut value; a larger value can end with
+  no answer before your client's timeout.
 - Tool calls: 100 per execution.
 - Time: 5 minutes per execution, including discovery. Time spent waiting for
   the user does not count. Execute returns when the program ends or pauses for
@@ -198,8 +202,16 @@ Never rerun an entire `execute` program merely to retry one failed tool.
 - `ToolCallLimitExceeded`, `TimeoutExceeded`: split the work into smaller
   executions.
 
-Calls with outcome `success` took effect, and `interrupted` calls may have.
-Effects are never rolled back. When Executor could not confirm a failed write's
+A remote MCP tool returns its whole result. `isError: true` there means the
+tool says it failed: the call does not throw, and its outcome is `failure`.
+Check `isError` before using such a result. Other fields, such as `ok`, mean
+what the tool's description says.
+
+An outcome of `success` means only that the call returned normally, with no
+tool error reported to Executor. It does not show that the intended action
+happened: check the returned value, such as `isError` or the app's own status
+fields, before treating it as done. `failure` and `interrupted` calls may have
+had effects. Effects are never rolled back. When Executor could not confirm a failed write's
 outcome, its recovery says so: do not repeat it automatically.
 Inside a program, a caught tool error's `message` is the same JSON as
 `response`, so a program can handle expected failures itself.
diff --git a/packages/app-templates/executor/skills/executor/SKILL.md b/packages/app-templates/executor/skills/executor/SKILL.md
index 5dc1ed5741..686465e0d4 100644
--- a/packages/app-templates/executor/skills/executor/SKILL.md
+++ b/packages/app-templates/executor/skills/executor/SKILL.md
@@ -14,7 +14,7 @@ slug as its namespace. Credentials go only through Executor's secure connection
 links, never through chat or source code. Some calls pause for user approval.
 
 This is the Executor app's `executor` skill. Read its other skills with
-`skills`, such as `{app: "executor", name: "code-mode"}`; `{}` lists them all.
+`skills({app: "executor", name: "code-mode"})`; `skills({})` lists them all.
 
 ## Find and call tools
 
diff --git a/packages/app-templates/src/contracts/templates.ts b/packages/app-templates/src/contracts/templates.ts
index 55ae30c2a0..56f4bb3692 100644
--- a/packages/app-templates/src/contracts/templates.ts
+++ b/packages/app-templates/src/contracts/templates.ts
@@ -83,6 +83,14 @@ export interface GeneratedToolRules {
   readonly approvals?: Readonly<Record<string, "always" | "never">>;
   /** Exposed names the app leaves out. */
   readonly omitted?: readonly string[];
+  /**
+   * What a tool the rules do not name gets, for a server that lists its tools as it runs:
+   * `always` asks before it runs, `omitted` leaves it out. `known` are the names the rules decide,
+   * including the ones they leave to the app's default.
+   */
+  readonly otherwise?:
+    | { readonly rule: "always" | "omitted"; readonly known: readonly string[] }
+    | undefined;
 }
 
 /**
diff --git a/packages/app-templates/src/implementation/executor-intro.gen.ts b/packages/app-templates/src/implementation/executor-intro.gen.ts
index 4b2d7bb8ec..96a857cf9d 100644
--- a/packages/app-templates/src/implementation/executor-intro.gen.ts
+++ b/packages/app-templates/src/implementation/executor-intro.gen.ts
@@ -1,4 +1,4 @@
 // Generated by packages/app-templates/scripts/executor-intro.ts. Do not edit.
 
 /** The body of skills/executor/SKILL.md, without its frontmatter. MCP servers send it as their instructions. */
-export const executorIntro = "# Executor\n\n## What Executor is\n\nExecutor is a host that runs apps: TypeScript packages that expose tools,\nstorage, UI, accounts and background work. Agents reach every app through the\nMCP tools `skills`, `search`, `describe`, `call` and `execute`, with each app's\nslug as its namespace. Credentials go only through Executor's secure connection\nlinks, never through chat or source code. Some calls pause for user approval.\n\nThis is the Executor app's `executor` skill. Read its other skills with\n`skills`, such as `{app: \"executor\", name: \"code-mode\"}`; `{}` lists them all.\n\n## Find and call tools\n\n`search({ query: \"...\" })` returns each tool's exact `path`, such as\n`tools.<slug>.<tool>`, and input type; `describe({ paths })` returns full\nsignatures. Never guess argument names.\n\nFor a few independent calls, use `call({ calls: { path, input } })`; an array\nof calls runs concurrently. Each result has `ok` and its `value` or `error`.\n\nWrite a JavaScript program for `execute` when one call's result feeds another,\nor a large result should be filtered before it reaches you. Inside it, the same\npaths are async functions, and `tools.search` and `tools.search.describe` work\nas above. Return only the data you need. For depth, read the `code-mode` skill.\nWhen `call` or `execute` pauses for approval or input, show the request to the\nuser and resume it; never repeat the call or run the program again.\n\n## Build an app\n\nBuild an app when no existing app provides the tools, data, UI or automation\nthe user needs. For a known service, search the catalog first:\n`organization.catalog({ query: { search: \"gmail\", limit: \"20\" } })`, then\n`apps.install` a match or `apps.importCustom` a remote MCP URL. With a shell,\nuse the `executor apps` CLI, else `execute`; read the `app-authoring` skill first.\n\n## Send feedback\n\nSend feedback with the Executor app's `feedback.submit` tool when Executor gets\nin your way, can't do something you need, works especially well, or the user\nhas feedback. Before your final reply, check whether anything is worth\nreporting. Be specific; never include credentials or user data (`feedback.md`).";
+export const executorIntro = "# Executor\n\n## What Executor is\n\nExecutor is a host that runs apps: TypeScript packages that expose tools,\nstorage, UI, accounts and background work. Agents reach every app through the\nMCP tools `skills`, `search`, `describe`, `call` and `execute`, with each app's\nslug as its namespace. Credentials go only through Executor's secure connection\nlinks, never through chat or source code. Some calls pause for user approval.\n\nThis is the Executor app's `executor` skill. Read its other skills with\n`skills({app: \"executor\", name: \"code-mode\"})`; `skills({})` lists them all.\n\n## Find and call tools\n\n`search({ query: \"...\" })` returns each tool's exact `path`, such as\n`tools.<slug>.<tool>`, and input type; `describe({ paths })` returns full\nsignatures. Never guess argument names.\n\nFor a few independent calls, use `call({ calls: { path, input } })`; an array\nof calls runs concurrently. Each result has `ok` and its `value` or `error`.\n\nWrite a JavaScript program for `execute` when one call's result feeds another,\nor a large result should be filtered before it reaches you. Inside it, the same\npaths are async functions, and `tools.search` and `tools.search.describe` work\nas above. Return only the data you need. For depth, read the `code-mode` skill.\nWhen `call` or `execute` pauses for approval or input, show the request to the\nuser and resume it; never repeat the call or run the program again.\n\n## Build an app\n\nBuild an app when no existing app provides the tools, data, UI or automation\nthe user needs. For a known service, search the catalog first:\n`organization.catalog({ query: { search: \"gmail\", limit: \"20\" } })`, then\n`apps.install` a match or `apps.importCustom` a remote MCP URL. With a shell,\nuse the `executor apps` CLI, else `execute`; read the `app-authoring` skill first.\n\n## Send feedback\n\nSend feedback with the Executor app's `feedback.submit` tool when Executor gets\nin your way, can't do something you need, works especially well, or the user\nhas feedback. Before your final reply, check whether anything is worth\nreporting. Be specific; never include credentials or user data (`feedback.md`).";
diff --git a/packages/app-templates/src/implementation/executor-skill-digests.gen.ts b/packages/app-templates/src/implementation/executor-skill-digests.gen.ts
index ae435bd1be..8a5bba9d1f 100644
--- a/packages/app-templates/src/implementation/executor-skill-digests.gen.ts
+++ b/packages/app-templates/src/implementation/executor-skill-digests.gen.ts
@@ -3,19 +3,19 @@
 /** SHA-256 of each file the Executor app publishes as a skill, keyed by `<skill>/<file>`. */
 export const executorSkillDigests: Readonly<Record<string, string>> = {
   "app-authoring/SKILL.md": "87118b0f1b98968a64fd6ba64dce39d1fde6c78f781f34ba85063ef4e44355a3",
-  "app-authoring/accounts.md": "6bfd911f629a19b1d1ac96a5cb33977426ba47eb9695d1551395c4891b52a7df",
-  "app-authoring/deploy.md": "c720ab582e4e5e3c75996d989ed2f65840208506ed76df3fc00864cd29e7d1dc",
+  "app-authoring/accounts.md": "6876d5f25ab7ab458b248f5a12fec70baa9b3cbddf8894674bce7f6ab890c884",
+  "app-authoring/deploy.md": "01938ca5b8a23c872bc6233c6c941c055adfb59ce2aca0744e873438f11095ff",
   "app-authoring/events.md": "8f7465e35c6c94b06978b89680181df60c741225de3ba8158f22f76ee7e91a5a",
-  "app-authoring/integrations.md": "9484086b1cb68aa9a9a1a0eb4ca20654c76702eda82675b35f46861bedc30a3a",
+  "app-authoring/integrations.md": "3f9cecb591465a71c95c98046dab960750000c05a900fde3550aac4ea3a0171a",
   "app-authoring/starter.md": "382bd769d7b10e9c09eaa2367755f23153a31a484aaca9c449ab4aac7d61e224",
   "app-authoring/storage.md": "d2c2288c8a6dafa0a88f09e7e91409d9afc08158205ea6d25064d0dee67a33df",
   "app-authoring/tools.md": "020b78ecae944cd8c879755035a9acce3df4d62a7ef59c453bd7b68696745067",
   "app-authoring/ui.md": "09dacca76ef6997d4530a2a46561683017484915f0a4d89bed6fccd3fabb2a87",
   "app-authoring/upgrades/0.0.1-beta.38.md": "0e0e38e0334fbece5bdb8264a32be4f36cef9c51705e8f6b749dc0d3b86dcdb5",
   "app-authoring/upgrades/0.0.1-beta.90.md": "38c727888b2773efa1d83795e8704f7c38ad9ec27c62fcdd89b5177ec5e338c3",
-  "app-authoring/webhooks.md": "e4ca224cd413b591c3692b389bd88d644b337b4697a067d83551e6bcab657cf3",
-  "app-authoring/workflows.md": "db0dee9a36a2271c4e8f1715605fba8620e11be3668495cdfc6c40cfbb5aaf62",
-  "code-mode/SKILL.md": "40e2efdb28d0973c226126779aa313208db760b079e3ddf6c8cf3713e5d489dc",
-  "executor/SKILL.md": "f58448f79ea529ebadbba8f0e001f2c9fe46f73475b9f6e99423f6d81ff97709",
+  "app-authoring/webhooks.md": "8b6e4fa3fbc1641bfa741bc449d8ff1b1db7c7923c2ddec0a134be7a2f7de5d8",
+  "app-authoring/workflows.md": "1496edbdb85e138715efa138c63068a11674e6188179f6ee0a92b81e6d9d63e2",
+  "code-mode/SKILL.md": "683999bd21e33e53a0cc63fef2caace026e12e3f7c7544d5cf30da7d3cc45586",
+  "executor/SKILL.md": "d98a4bfa40ee0afbf8c31fac67b27b69c400ee2c3b434479c08deb72f0e07e99",
   "executor/feedback.md": "11397bd260917e5a21e92897a19368d0426bf5944a7c081adc2c061d1ea797cd"
 };
diff --git a/packages/app-templates/src/implementation/protocol-apps.ts b/packages/app-templates/src/implementation/protocol-apps.ts
index d40fd5bfeb..373a1d2f1a 100644
--- a/packages/app-templates/src/implementation/protocol-apps.ts
+++ b/packages/app-templates/src/implementation/protocol-apps.ts
@@ -355,8 +355,22 @@ export const toolsFile = (rules: GeneratedToolRules | undefined) => {
     names?.kind === "lower_snake" && Object.keys(names.overrides ?? {}).length > 0
       ? names.overrides
       : undefined;
-  if (names === undefined && omitted.length === 0 && Object.keys(approvals).length === 0)
+  // A fixed map names every tool the app exposes, so only a live list has tools the rules miss.
+  const otherwise = names?.kind === "map" ? undefined : rules.otherwise;
+  if (
+    names === undefined &&
+    omitted.length === 0 &&
+    Object.keys(approvals).length === 0 &&
+    otherwise === undefined
+  )
     return undefined;
+  const known =
+    otherwise === undefined
+      ? ""
+      : `/** The names the rules decide; the server may list others. */
+const known = new Set<string>(${json([...otherwise.known].sort())})
+
+`;
   const exposed =
     names?.kind === "map"
       ? `const names: Record<string, string> = ${json(
@@ -377,7 +391,9 @@ ${
 const overrides: Record<string, string> = ${json(overrides)}
 `
 }
-/** The name each tool is exposed under. Omitted tools are left out. */
+${known}/** The name each tool is exposed under. Omitted tools are left out${
+          otherwise?.rule === "omitted" ? ", and so are tools the rules do not name" : ""
+        }. */
 export const exposedName = (name: string): string | undefined => {
   const exposed = ${
     names?.kind === "lower_snake"
@@ -388,7 +404,7 @@ export const exposedName = (name: string): string | undefined => {
         ? `name.replace(/^(query|mutation)_/, "$1.")`
         : "name"
   }
-  return omitted.has(exposed) ? undefined : exposed
+  return omitted.has(exposed)${otherwise?.rule === "omitted" ? " || !known.has(exposed)" : ""} ? undefined : exposed
 }
 `;
   return `import { always, never } from "apps/operations/approval"
@@ -398,9 +414,13 @@ const approvals: Record<string, "always" | "never"> = ${json(
     Object.fromEntries(Object.entries(approvals).sort(([a], [b]) => (a < b ? -1 : 1))),
   )}
 
-/** A tool's own approval rule, by exposed name, or undefined to use the app's default. */
+/** A tool's own approval rule, by exposed name, or undefined to use the app's default${
+    otherwise?.rule === "always" ? "; a tool the rules do not name asks always" : ""
+  }. */
 export const approval = (name: string) =>
-  approvals[name] === "always" ? always() : approvals[name] === "never" ? never() : undefined
+  approvals[name] === "always" ? always() : approvals[name] === "never" ? never() : ${
+    otherwise?.rule === "always" ? "known.has(name) ? undefined : always()" : "undefined"
+  }
 `;
 };
 
diff --git a/packages/apps/package.json b/packages/apps/package.json
index eee5acba1d..0dbbabad3b 100644
--- a/packages/apps/package.json
+++ b/packages/apps/package.json
@@ -1,6 +1,6 @@
 {
   "name": "apps",
-  "version": "0.0.1-beta.100.shuv.3",
+  "version": "0.0.1-beta.119.shuv.1",
   "private": true,
   "description": "TypeScript apps with typed tools, accounts, storage, and UI.",
   "type": "module",
diff --git a/packages/apps/protocols/13.json b/packages/apps/protocols/13.json
index 003623b27b..f2966c480d 100644
--- a/packages/apps/protocols/13.json
+++ b/packages/apps/protocols/13.json
@@ -2527,6 +2527,13 @@
                     },
                     "isOptional": true
                   },
+                  {
+                    "name": "kindConfirmed",
+                    "type": {
+                      "_tag": "Boolean"
+                    },
+                    "isOptional": true
+                  },
                   {
                     "name": "title",
                     "type": {
@@ -2720,6 +2727,13 @@
                     },
                     "isOptional": true
                   },
+                  {
+                    "name": "kindConfirmed",
+                    "type": {
+                      "_tag": "Boolean"
+                    },
+                    "isOptional": true
+                  },
                   {
                     "name": "title",
                     "type": {
@@ -2891,6 +2905,13 @@
                     },
                     "isOptional": true
                   },
+                  {
+                    "name": "kindConfirmed",
+                    "type": {
+                      "_tag": "Boolean"
+                    },
+                    "isOptional": true
+                  },
                   {
                     "name": "title",
                     "type": {
diff --git a/packages/apps/src/contracts/graphql.ts b/packages/apps/src/contracts/graphql.ts
index 0b667d91c0..643e729f34 100644
--- a/packages/apps/src/contracts/graphql.ts
+++ b/packages/apps/src/contracts/graphql.ts
@@ -3,6 +3,7 @@ import type { NetworkRefused } from "./network.ts";
 /** GraphQL discovery contracts. Catalogs are evaluated with the selected account. */
 import { Schema, type Effect } from "effect";
 import { AccountId, HttpUrl, JsonObject, type JsonValue } from "./schema.ts";
+import { FailureFieldName, maxUpstreamMessageLength } from "./failure.ts";
 
 /** Provider timeout policy, independent of any enclosing operation deadline. */
 export const GraphqlClientLimits = Schema.Struct({
@@ -30,7 +31,48 @@ export const GraphqlToolsOptions = Schema.Struct({
 });
 export type GraphqlToolsOptions = typeof GraphqlToolsOptions.Type;
 
-/** Safe failures omit upstream bodies. Execution means a valid GraphQL error response, not malformed data. */
+/** Most errors of one GraphQL response that a failure carries. */
+export const maxGraphqlStatedErrors = 5;
+/** Most `extensions` entries carried for one stated error. */
+export const maxGraphqlStatedExtensions = 4;
+/** Longest path, path segment or `extensions` value carried for one stated error. */
+export const maxGraphqlStatedFieldLength = 256;
+
+/**
+ * One error a GraphQL server stated in its response's `errors` list, in the format the GraphQL
+ * specification documents: its message, the response path it names, and the scalar entries of its
+ * `extensions`, such as `code`. Text is bounded where it is read. The path keeps the server's
+ * segments, so account secrets are replaced in them before they are written as a path when the
+ * failure leaves the app.
+ */
+export const GraphqlStatedError = Schema.Struct({
+  message: Schema.String.check(Schema.isMaxLength(maxUpstreamMessageLength)),
+  /** The first segments of the path, as many as a path of the longest carried length shows. */
+  path: Schema.optional(
+    Schema.Array(
+      Schema.Union([
+        Schema.String.check(Schema.isMaxLength(maxGraphqlStatedFieldLength)),
+        Schema.Int,
+      ]),
+    ).check(Schema.isMaxLength(maxGraphqlStatedFieldLength + 1)),
+  ),
+  extensions: Schema.optional(
+    Schema.Record(
+      FailureFieldName,
+      Schema.Union([
+        Schema.String.check(Schema.isMaxLength(maxGraphqlStatedFieldLength)),
+        Schema.Finite,
+        Schema.Boolean,
+      ]),
+    ).check(Schema.isMaxProperties(maxGraphqlStatedExtensions)),
+  ),
+});
+export type GraphqlStatedError = typeof GraphqlStatedError.Type;
+
+/**
+ * Safe failures omit upstream bodies other than the errors a GraphQL server stated in its
+ * documented `errors` list. Execution means a valid GraphQL error response, not malformed data.
+ */
 export class GraphqlError extends Schema.TaggedError<GraphqlError>()("GraphqlError", {
   phase: Schema.Literals(["discover", "call"]),
   reason: Schema.Literals([
@@ -42,6 +84,17 @@ export class GraphqlError extends Schema.TaggedError<GraphqlError>()("GraphqlErr
     "execution",
   ]),
   status: Schema.optional(Schema.Number),
+  /** The first errors the server stated, in its order. */
+  errors: Schema.optional(
+    Schema.Array(GraphqlStatedError).check(Schema.isMaxLength(maxGraphqlStatedErrors)),
+  ),
+  /** How many errors the server stated in all, when it stated more than `errors` carries. */
+  stated: Schema.optional(Schema.Int),
+  /**
+   * Why Executor did not read the JSON body of a refused request: it was larger than error bodies
+   * may be, or it did not arrive in time. The status is still the server's answer.
+   */
+  unreadBody: Schema.optional(Schema.Literals(["too_large", "incomplete"])),
 }) {}
 
 const Name = Schema.String.check(Schema.isPattern(/^[_A-Za-z][_0-9A-Za-z]*$/u));
diff --git a/packages/apps/src/contracts/protocols/current.ts b/packages/apps/src/contracts/protocols/current.ts
index 18b643d0be..c27bec7799 100644
--- a/packages/apps/src/contracts/protocols/current.ts
+++ b/packages/apps/src/contracts/protocols/current.ts
@@ -337,7 +337,10 @@ export const InvocationDeadline = Schema.Finite.check(Schema.isGreaterThanOrEqua
 /**
  * Serializable live tool metadata; executable callbacks never cross this boundary. `name` is the
  * tool's full dotted path. `router` is the path of the router that owns it, omitted at the root.
- * `readOnly` marks a query; a tool without it is a mutation.
+ * `readOnly` marks a query; a tool without it is a mutation. `kindConfirmed` marks a kind that the
+ * app's code or the tool's protocol fixes, such as a declared operation, a `kinds` entry or an HTTP
+ * method, rather than an upstream claim such as an MCP server's `readOnlyHint`. Executor tells an
+ * agent that a call only read only when both are set.
  */
 export const HostedTool = Schema.Struct({
   schedules: Schema.optionalKey(Schema.Array(OperationSchedule)),
@@ -347,6 +350,7 @@ export const HostedTool = Schema.Struct({
   description: Schema.String,
   inputSchema: JsonObject,
   readOnly: Schema.optionalKey(Schema.Boolean),
+  kindConfirmed: Schema.optionalKey(Schema.Boolean),
   title: Schema.optionalKey(Schema.String),
   outputSchema: Schema.optionalKey(JsonObject),
   annotations: Schema.optionalKey(ToolAnnotations),
diff --git a/packages/apps/src/contracts/router.ts b/packages/apps/src/contracts/router.ts
index 4cb7211a64..486206b495 100644
--- a/packages/apps/src/contracts/router.ts
+++ b/packages/apps/src/contracts/router.ts
@@ -48,7 +48,8 @@ export interface AppRouter {
 /**
  * A router whose tools are discovered when read, such as an MCP server or OpenAPI document.
  * Names are relative to the router and may contain dots. `readOnly: true` marks a query;
- * anything else is a mutation. Resolution never requires listing.
+ * anything else is a mutation. `kindConfirmed: true` says the app's code or the protocol, not an
+ * upstream claim, decided the kind. Resolution never requires listing.
  */
 export interface DynamicRouter {
   readonly kind: "dynamic";
diff --git a/packages/apps/src/implementation/account-router.ts b/packages/apps/src/implementation/account-router.ts
index 42f849af1a..767da90f41 100644
--- a/packages/apps/src/implementation/account-router.ts
+++ b/packages/apps/src/implementation/account-router.ts
@@ -1,6 +1,6 @@
 import { accountProviderError } from "./provider-error.ts";
 /** Combine account-bound protocol operations without changing their upstream inputs. */
-import { Effect, Schema } from "effect";
+import { Effect, Result, Schema } from "effect";
 import { HostedTool, HostedToolSummary } from "../contracts/host.ts";
 import type { AppOperation } from "../contracts/operations.ts";
 import type { AppNode, AppRouter, DynamicRouter } from "../contracts/router.ts";
@@ -16,6 +16,16 @@ import {
 
 type Selection = { readonly accountId: string; readonly input: unknown };
 
+/**
+ * Some accounts listed their tools and at least one could not: the tools the others listed, and
+ * the first failing account's error. A catalog read keeps the tools and reports the error on the
+ * router, so one broken account does not hide every other account's tools.
+ */
+export class PartialListing extends Schema.TaggedError<PartialListing>()("PartialListing", {
+  tools: Schema.Array(Schema.Unknown),
+  error: Schema.Unknown,
+}) {}
+
 const decoderDocument = (decoder: Schema.Decoder<unknown>) => {
   const imported = importedJsonSchema(decoder);
   if (imported !== undefined) return Schema.decodeUnknownSync(JsonObject)(imported);
@@ -83,9 +93,14 @@ const outputDocument = (operation: AppOperation) =>
 
 /**
  * One operation whose input selects the account whose variant runs. It is a query only when every
- * account's variant is, matching how the merged tool is listed.
+ * account's variant is, matching how the merged tool is listed. An account in `failed` could not
+ * resolve the tool: selecting it fails with that account's error before anything runs, rather than
+ * as input naming an unknown account. It is not described and does not decide the kind.
  */
-const combineOperation = (accounts: ReadonlyMap<string, AppOperation>): AppOperation => {
+const combineOperation = (
+  accounts: ReadonlyMap<string, AppOperation>,
+  failed: ReadonlyMap<string, unknown> = new Map(),
+): AppOperation => {
   const variants = [...accounts.values()];
   const first = variants[0];
   if (first === undefined) throw new Error("An account operation must have at least one account");
@@ -96,11 +111,14 @@ const combineOperation = (accounts: ReadonlyMap<string, AppOperation>): AppOpera
       throw new Error("Account selection must be decoded before execution");
     return operation;
   };
-  const input = Schema.Union(
-    [...accounts].map(([accountId, operation]) =>
+  const input = Schema.Union([
+    ...[...accounts].map(([accountId, operation]) =>
       Schema.Struct({ accountId: Schema.Literal(accountId), input: operation.input }),
     ),
-  );
+    ...[...failed.keys()].map((accountId) =>
+      Schema.Struct({ accountId: Schema.Literal(accountId), input: Schema.Unknown }),
+    ),
+  ]);
   // Combined schemas are built when a tool is described, not on every evaluation for a call.
   const inputSchema = () =>
     accountBranches(
@@ -122,12 +140,16 @@ const combineOperation = (accounts: ReadonlyMap<string, AppOperation>): AppOpera
       : { _meta: first._meta }),
     input: withLazyJsonSchemaDocument(input, inputSchema),
     approval: (context) => {
+      // A failed account's call fails before it reaches the service, so it has nothing to approve.
+      if (failed.has(context.toolInput.accountId)) return Effect.succeed("approved" as const);
       const operation = select(context.toolInput);
       return operation.approval === undefined
         ? Effect.succeed("approved" as const)
         : operation.approval({ ...context, toolInput: context.toolInput.input });
     },
     run: (context, input: Selection) => {
+      if (failed.has(input.accountId))
+        return Effect.fail(accountProviderError(failed.get(input.accountId), input.accountId));
       const operation = select(input);
       return operation.run(context, input.input).pipe(
         Effect.mapError((error) => accountProviderError(error, input.accountId)),
@@ -180,6 +202,7 @@ const mergeSummary = (
     description: first.description,
     ...(first.title === undefined ? {} : { title: first.title }),
     readOnly: variants.every(([, tool]) => tool.readOnly === true),
+    ...(variants.every(([, tool]) => tool.kindConfirmed === true) ? { kindConfirmed: true } : {}),
     ...sameAcross("annotations", variants),
   });
 };
@@ -203,18 +226,55 @@ const merge = (name: string, variants: readonly (readonly [string, HostedTool])[
     ...sameAcross("_meta", variants),
   });
 
+/** Accounts whose sources are read at once. Each read may reach its account's upstream service. */
+const accountConcurrency = 8;
+
+/**
+ * Read every account's source, each on its own: one account's failure does not stop the others.
+ * Reads run together; values and failures are kept in account order, each failure attributed to
+ * its account.
+ */
+const eachAccount = <A>(
+  sources: ReadonlyMap<string, DynamicRouter>,
+  read: (source: DynamicRouter) => Effect.Effect<A, unknown>,
+) =>
+  Effect.gen(function* () {
+    const results = yield* Effect.forEach(
+      sources,
+      ([accountId, source]) =>
+        Effect.result(
+          read(source).pipe(Effect.mapError((error) => accountProviderError(error, accountId))),
+        ).pipe(Effect.map((result) => [accountId, result] as const)),
+      { concurrency: accountConcurrency },
+    );
+    const values = new Map<string, A>();
+    const failed = new Map<string, unknown>();
+    for (const [accountId, result] of results)
+      if (Result.isSuccess(result)) values.set(accountId, result.success);
+      else failed.set(accountId, result.failure);
+    return { values, failed };
+  });
+
+/** The first account's failure. A source no account could read fails with it, as one account would. */
+const firstFailure = (failed: ReadonlyMap<string, unknown>) => [...failed.values()][0];
+
 /** One dynamic router over every account's source; each tool's variants are merged by name. */
 const combineDynamic = (sources: ReadonlyMap<string, DynamicRouter>): DynamicRouter => {
   const first = [...sources.values()][0];
-  const grouped = <T extends HostedToolSummary>(
+  /**
+   * Every account's tools grouped by name. When some accounts fail and others list, it fails with
+   * `PartialListing`, which carries the others' tools; when every account fails, with the first
+   * account's error.
+   */
+  const grouped = <T extends HostedToolSummary, R>(
     read: (source: DynamicRouter) => Effect.Effect<readonly T[], unknown>,
+    merged: (name: string, variants: readonly (readonly [string, T])[]) => R,
   ) =>
     Effect.gen(function* () {
+      const { values: listed, failed } = yield* eachAccount(sources, read);
+      if (listed.size === 0 && failed.size > 0) return yield* Effect.fail(firstFailure(failed));
       const groups = new Map<string, [string, T][]>();
-      for (const [accountId, source] of sources) {
-        const tools = yield* read(source).pipe(
-          Effect.mapError((error) => accountProviderError(error, accountId)),
-        );
+      for (const [accountId, tools] of listed)
         for (const tool of tools) {
           const variants = groups.get(tool.name) ?? [];
           if (variants.some(([id]) => id === accountId))
@@ -222,48 +282,64 @@ const combineDynamic = (sources: ReadonlyMap<string, DynamicRouter>): DynamicRou
           variants.push([accountId, tool]);
           groups.set(tool.name, variants);
         }
-      }
-      return groups;
+      const tools = [...groups].map(([name, variants]) => merged(name, variants));
+      if (failed.size === 0) return tools;
+      return yield* new PartialListing({ tools, error: firstFailure(failed) });
     });
   return {
     kind: "dynamic",
-    // Accounts share one source, so the first account describes the router.
-    ...(first?.meta === undefined ? {} : { meta: first.meta }),
+    // Accounts share one source, so the first account that can describe it describes the router.
+    ...(first?.meta === undefined
+      ? {}
+      : {
+          meta: () =>
+            Effect.gen(function* () {
+              const failures: unknown[] = [];
+              for (const source of sources.values()) {
+                if (source.meta === undefined) continue;
+                const result = yield* Effect.result(source.meta());
+                if (Result.isSuccess(result)) return result.success;
+                failures.push(result.failure);
+              }
+              return yield* Effect.fail(failures[0]);
+            }),
+        }),
     ...(first?.overrides === undefined ? {} : { overrides: first.overrides }),
-    list: () =>
-      grouped((source) => source.list()).pipe(
-        Effect.map((groups) => [...groups].map(([name, variants]) => merge(name, variants))),
-      ),
+    list: () => grouped((source) => source.list(), merge),
     summaries: () =>
-      grouped((source) =>
-        source.summaries === undefined ? source.list() : source.summaries(),
-      ).pipe(
-        Effect.map((groups) => [...groups].map(([name, variants]) => mergeSummary(name, variants))),
+      grouped(
+        (source) => (source.summaries === undefined ? source.list() : source.summaries()),
+        mergeSummary,
       ),
     describe: (name: string) =>
-      Effect.gen(function* () {
-        const variants: [string, HostedTool][] = [];
-        for (const [accountId, source] of sources) {
-          const tool = yield* (
-            source.describe === undefined
-              ? source.list().pipe(Effect.map((tools) => tools.find((tool) => tool.name === name)))
-              : source.describe(name)
-          ).pipe(Effect.mapError((error) => accountProviderError(error, accountId)));
-          if (tool !== undefined) variants.push([accountId, tool]);
-        }
-        return variants.length === 0 ? undefined : merge(name, variants);
-      }),
+      eachAccount(sources, (source) =>
+        source.describe === undefined
+          ? source.list().pipe(Effect.map((tools) => tools.find((tool) => tool.name === name)))
+          : source.describe(name),
+      ).pipe(
+        Effect.flatMap(({ values, failed }) => {
+          const variants = [...values].flatMap(([accountId, tool]) =>
+            tool === undefined ? [] : [[accountId, tool] as const],
+          );
+          // No account that answered has it; it may be a failed account's.
+          if (variants.length === 0)
+            return failed.size > 0 ? Effect.fail(firstFailure(failed)) : Effect.succeed(undefined);
+          return Effect.succeed(merge(name, variants));
+        }),
+      ),
     resolve: (name: string) =>
-      Effect.gen(function* () {
-        const operations = new Map<string, AppOperation>();
-        for (const [accountId, source] of sources) {
-          const operation = yield* source
-            .resolve(name)
-            .pipe(Effect.mapError((error) => accountProviderError(error, accountId)));
-          if (operation !== undefined) operations.set(accountId, operation);
-        }
-        return operations.size === 0 ? undefined : combineOperation(operations);
-      }),
+      eachAccount(sources, (source) => source.resolve(name)).pipe(
+        Effect.flatMap(({ values, failed }) => {
+          const operations = new Map(
+            [...values].flatMap(([accountId, operation]) =>
+              operation === undefined ? [] : [[accountId, operation] as const],
+            ),
+          );
+          if (operations.size === 0)
+            return failed.size > 0 ? Effect.fail(firstFailure(failed)) : Effect.succeed(undefined);
+          return Effect.succeed(combineOperation(operations, failed));
+        }),
+      ),
   };
 };
 
@@ -322,6 +398,8 @@ const narrow = <T extends AppNode>(
  * Discover each selected account's router and combine matching names.
  * Calls take { accountId, input }; each branch retains its account's input schema,
  * credentials, approval and output validation. Empty selections expose no operations.
+ * An account whose source fails does not hide the others' tools; its error is reported on the
+ * router, and a call that selects it fails with that error.
  * Discovery is sequential and cancellation follows the caller's signal. `discover` may return the
  * router or a Promise of it, and the combined router keeps its operations' handler contexts.
  */
diff --git a/packages/apps/src/implementation/catalog-cache.ts b/packages/apps/src/implementation/catalog-cache.ts
index a1e69797fc..fa19db6094 100644
--- a/packages/apps/src/implementation/catalog-cache.ts
+++ b/packages/apps/src/implementation/catalog-cache.ts
@@ -1,6 +1,6 @@
 /** Revisioned catalog storage shared by remote protocols. Executables are never persisted. */
 import { CacheError } from "@executor-js/app-cache";
-import { Deferred, Duration, Effect, Exit, Schema } from "effect";
+import { Deferred, Duration, Effect, Exit, Fiber, Schema } from "effect";
 import type { AccountCredential, AppCache, CacheLoadContext } from "../contracts/cache.ts";
 import { JsonObject, type JsonValue } from "../contracts/schema.ts";
 import { fromPromise, method, toPromise } from "./authoring.ts";
@@ -53,6 +53,8 @@ export const catalogScope = <E>(
 };
 
 const schema = <A>(decoder: Schema.Decoder<A>) => wrap(decoder, false);
+/** Part writes a refresh keeps in flight at once. */
+const flushConcurrency = 4;
 
 /**
  * The revision this isolate last saw for each catalog, by the store key of its manifest. That key
@@ -191,6 +193,10 @@ export const catalogCache = <A extends { readonly name: string }, S>(
         let batch: { key: JsonValue; value: JsonValue }[] = [];
         let batchBytes = 0;
         let flushes = 0;
+        // Parts are immutable and independent, so writes need not land in order. A few stay in
+        // flight while the next batch is built; the oldest is awaited first, bounding memory. A
+        // refresh that fails interrupts the writes it left in flight.
+        const writing: Fiber.Fiber<void, unknown>[] = [];
         const flush = () =>
           Effect.suspend(() => {
             const entries = batch;
@@ -198,7 +204,10 @@ export const catalogCache = <A extends { readonly name: string }, S>(
             batch = [];
             batchBytes = 0;
             if (!entries.length) return Effect.void;
-            return fromPromise(method(context.cache, "write"), "cache")(entries, retention).pipe(
+            const write = fromPromise(method(context.cache, "write"), "cache")(
+              entries,
+              retention,
+            ).pipe(
               Effect.withSpan("app.cache.flush", {
                 attributes: {
                   "cache.flush.index": flushes++,
@@ -207,6 +216,11 @@ export const catalogCache = <A extends { readonly name: string }, S>(
                 },
               }),
             );
+            return Effect.gen(function* () {
+              const oldest = writing.length >= flushConcurrency ? writing.shift() : undefined;
+              if (oldest !== undefined) yield* Fiber.join(oldest);
+              writing.push(yield* Effect.forkScoped(write));
+            });
           });
         const append = (entry: { key: JsonValue; value: JsonValue }) =>
           Effect.gen(function* () {
@@ -249,6 +263,7 @@ export const catalogCache = <A extends { readonly name: string }, S>(
         yield* pageOut();
         yield* summaryOut();
         yield* flush();
+        for (const fiber of writing) yield* Fiber.join(fiber);
         // The cache publishes this manifest only after all parts, under its fenced loader lease.
         return {
           revision,
@@ -256,7 +271,7 @@ export const catalogCache = <A extends { readonly name: string }, S>(
           summaries,
           ...(header === undefined ? {} : { header: yield* json(header) }),
         };
-      });
+      }).pipe(Effect.scoped);
     const getOptions = {
       key,
       schema: schema(Manifest),
diff --git a/packages/apps/src/implementation/failure-detail.ts b/packages/apps/src/implementation/failure-detail.ts
index d86665f600..5266380d29 100644
--- a/packages/apps/src/implementation/failure-detail.ts
+++ b/packages/apps/src/implementation/failure-detail.ts
@@ -2,6 +2,7 @@ import { Match, Option, Predicate, Redacted, Schema } from "effect";
 import { CacheError, cacheLimits } from "@executor-js/app-cache/contracts";
 import { OpenapiError } from "../contracts/openapi.ts";
 import { OpenapiCompileError } from "../contracts/openapi-compile.ts";
+import { defaultOpenapiErrorLimits } from "../contracts/api-response-error.ts";
 import { FetchOptionUnsupported, NetworkRefused } from "../contracts/network.ts";
 import {
   McpError as HostMcpError,
@@ -11,8 +12,13 @@ import {
 import { McpCredentialsUnverified, McpError } from "../contracts/mcp.ts";
 import { SkillLoadFailed } from "../contracts/skills.ts";
 import type { ProviderError } from "../contracts/provider-error.ts";
+import {
+  GraphqlError,
+  maxGraphqlStatedFieldLength,
+  type GraphqlStatedError,
+} from "../contracts/graphql.ts";
 import { providerError } from "./provider-error.ts";
-import { isShortenedUpstream } from "./upstream-error.ts";
+import { isShortenedStated } from "./upstream-error.ts";
 import {
   FailureCode,
   FailureFieldName,
@@ -131,10 +137,26 @@ export const accountFieldSecrets = (accounts: unknown) => {
 export const accountSecrets = (accounts: Redacted.Redacted<ResolvedAccounts>) =>
   accountFieldSecrets(Redacted.value(accounts));
 
-/** Replace every whole account secret in the text. */
+/**
+ * The spellings a secret can have in text: as is, inside a JSON string, and URL-encoded, longest
+ * first. A text with a lone surrogate has no URL encoding.
+ */
+const secretSpellings = (secrets: readonly string[]) =>
+  [
+    ...new Set(
+      secrets.flatMap((secret) => [
+        secret,
+        JSON.stringify(secret).slice(1, -1),
+        ...(/\p{Cs}/u.test(secret) ? [] : [encodeURIComponent(secret)]),
+      ]),
+    ),
+  ].sort((a, b) => b.length - a.length);
+
+/** Replace every whole account secret in the text, in each of its spellings. */
 const replaceSecrets = (text: string, secrets: readonly string[]) => {
   let redacted = text;
-  for (const secret of secrets) redacted = redacted.split(secret).join("[redacted]");
+  for (const secret of secretSpellings(secrets))
+    redacted = redacted.split(secret).join("[redacted]");
   return redacted;
 };
 
@@ -174,12 +196,19 @@ export const redactUpstream = (
   secrets: readonly string[],
 ): UpstreamError | undefined => {
   if (upstream?.message === undefined) return upstream;
-  const message = isShortenedUpstream(upstream.message)
-    ? `${replaceSecretStart(replaceSecrets(upstream.message.slice(0, -1), secrets), secrets)}…`
-    : replaceSecrets(upstream.message, secrets);
+  const message = redactStated(upstream.message, secrets, maxUpstreamMessageLength);
   return { code: upstream.code, message: bound(message, maxUpstreamMessageLength) };
 };
 
+/**
+ * Replace account secrets in text a service stated, bounded to `maximum` where it was read. Text
+ * that bound shortened can end partway through a secret; that part is replaced too.
+ */
+const redactStated = (text: string, secrets: readonly string[], maximum: number) =>
+  isShortenedStated(text, maximum)
+    ? `${replaceSecretStart(replaceSecrets(text.slice(0, -1), secrets), secrets)}…`
+    : replaceSecrets(text, secrets);
+
 /**
  * A provider failure as it leaves the bundle: in the phase it happened, unless its raiser named a
  * more precise one, with account secrets replaced in the error the service stated.
@@ -238,6 +267,14 @@ const ownCode = (error: Error, secrets: readonly string[]) =>
     ? boundText(error.code, secrets, 128)
     : undefined;
 
+/**
+ * The `code` of the error the thrown one wraps. `ctx.fetch` rejects with an `HttpClientError` whose
+ * cause is the platform's rejection, which carries the code, as when Executor's network refuses its
+ * host's API document of another revision.
+ */
+const causeCode = (error: Error, secrets: readonly string[]) =>
+  error.cause instanceof Error ? ownCode(error.cause, secrets) : undefined;
+
 /** Properties that are the error itself, or that it already carries in its own slot. */
 const reservedFields = new Set(["name", "message", "stack", "cause", "_tag"]);
 
@@ -304,9 +341,102 @@ const openapiFailureMessage = (error: OpenapiError) => {
     : `${response}, which matches no error with a message in the API's OpenAPI document.`;
 };
 
+/** What the client was doing when a GraphQL server failed. */
+const graphqlStages = {
+  discover: "while Executor read its schema",
+  call: "to this tool call",
+} satisfies Record<GraphqlError["phase"], string>;
+
+/**
+ * A response path such as `projectCreate.input.items[0]`, bounded; unusual names are quoted.
+ * Secrets are replaced in each segment the server stated before it is quoted.
+ */
+const graphqlPathText = (
+  path: NonNullable<GraphqlStatedError["path"]>,
+  secrets: readonly string[],
+) =>
+  bound(
+    path
+      .map((segment, index) => {
+        if (typeof segment === "number") return `[${segment}]`;
+        const name = redactStated(segment, secrets, maxGraphqlStatedFieldLength);
+        return /^[_A-Za-z][_0-9A-Za-z]*$/u.test(name)
+          ? index === 0
+            ? name
+            : `.${name}`
+          : `[${JSON.stringify(name)}]`;
+      })
+      .join(""),
+    maxGraphqlStatedFieldLength,
+  );
+
+/**
+ * One error a GraphQL server stated: its quoted message, path and scalar `extensions`. Secrets are
+ * replaced in the text the server stated before it is quoted.
+ */
+const graphqlStatedText = (
+  { message, path, extensions }: GraphqlStatedError,
+  secrets: readonly string[],
+) => {
+  const field = (text: string) => redactStated(text, secrets, maxGraphqlStatedFieldLength);
+  const entries = Object.entries(extensions ?? {}).map(
+    ([name, value]) =>
+      `${name}: ${JSON.stringify(typeof value === "string" ? field(value) : value)}`,
+  );
+  return `${JSON.stringify(redactStated(message, secrets, maxUpstreamMessageLength))}${
+    path === undefined ? "" : ` at ${graphqlPathText(path, secrets)}`
+  }${entries.length === 0 ? "" : ` (${entries.join(", ")})`}`;
+};
+
+/** Why Executor did not read a refused request's body. */
+const unreadBodies = {
+  too_large: `Executor did not read its response body, which was larger than ${defaultOpenapiErrorLimits.maxBodyBytes / 1024} KiB.`,
+  incomplete: "Executor did not read its response body, which did not arrive in time.",
+} satisfies Record<NonNullable<GraphqlError["unreadBody"]>, string>;
+
+/**
+ * Fixed text from the safe fields, then the errors the server stated in its response's `errors`
+ * list, quoted as its statement. Server URLs, headers and other response content never enter the
+ * message.
+ */
+const graphqlFailureMessage = (error: GraphqlError, secrets: readonly string[]) => {
+  const stage = graphqlStages[error.phase];
+  const answered = error.status === undefined ? "answered" : `answered HTTP ${error.status}`;
+  const explanation = Match.value(error.reason).pipe(
+    Match.when("timeout", () => `The GraphQL server did not respond in time ${stage}.`),
+    Match.when("unauthorized", () => `The GraphQL server rejected the credentials ${stage}.`),
+    Match.when(
+      "invalid_response",
+      () => `The GraphQL server returned a response Executor could not use ${stage}.`,
+    ),
+    Match.when("invalid_input", () =>
+      error.phase === "call"
+        ? "The input could not be encoded as a GraphQL request for this tool."
+        : "The GraphQL endpoint URL or connection settings are invalid.",
+    ),
+    Match.when("request", () =>
+      error.status === undefined
+        ? `The request to the GraphQL server failed ${stage}.`
+        : `The GraphQL server ${answered} ${stage}.`,
+    ),
+    Match.when("execution", () => `The GraphQL server ${answered} with errors ${stage}.`),
+    Match.exhaustive,
+  );
+  if (error.unreadBody !== undefined) return `${explanation} ${unreadBodies[error.unreadBody]}`;
+  const errors = error.errors ?? [];
+  if (errors.length === 0) return explanation;
+  const total = error.stated ?? errors.length;
+  const more = total - errors.length;
+  return `${explanation} It stated${total === 1 ? "" : ` ${total} errors`}: ${errors
+    .map((stated) => graphqlStatedText(stated, secrets))
+    .join("; ")}.${
+    more === 0 ? "" : ` ${more} more ${more === 1 ? "error is" : "errors are"} not shown.`
+  }`;
+};
+
 /**
  * Describe what an operation raised for the app's own caller. App data failures keep their
- * reason as a code, as do app cache failures and OpenAPI and MCP service failures, such as an
+ * reason as a code, as do app cache failures and OpenAPI, GraphQL and MCP service failures, such as an
  * `mcpHealth` check that cannot reach its server or cannot verify the credentials; any other thrown
  * value is the app's own error, with its own code and scalar fields. Account secrets are replaced.
  */
@@ -326,6 +456,13 @@ export const failureDetail = (error: unknown, secrets: readonly string[]): Failu
       code: error.reason,
       message: boundFailureMessage(openapiFailureMessage(error), secrets),
     };
+  if (Schema.is(GraphqlError)(error))
+    return {
+      source: "service",
+      errorName: "GraphqlError",
+      code: error.reason,
+      message: boundFailureMessage(graphqlFailureMessage(error, secrets), secrets),
+    };
   if (Schema.is(McpError)(error))
     return {
       source: "service",
@@ -366,8 +503,9 @@ export const failureDetail = (error: unknown, secrets: readonly string[]): Failu
       message: boundFailureMessage(error.message, secrets),
     };
   if (error instanceof Error) {
-    const code = ownCode(error, secrets);
-    const fields = ownFields(error, code, secrets);
+    const own = ownCode(error, secrets);
+    const code = own ?? causeCode(error, secrets);
+    const fields = ownFields(error, own, secrets);
     return {
       source: "app",
       errorName: errorName(error),
diff --git a/packages/apps/src/implementation/graphql-catalog.ts b/packages/apps/src/implementation/graphql-catalog.ts
index 72180d4860..4767478aeb 100644
--- a/packages/apps/src/implementation/graphql-catalog.ts
+++ b/packages/apps/src/implementation/graphql-catalog.ts
@@ -66,6 +66,8 @@ export const graphqlCatalog = (options: GraphqlCatalogOptions, kinds: OperationK
       name: tool.name,
       description: tool.description,
       readOnly: kindOf(tool) === "query",
+      // The app's `kinds`, or the GraphQL operation type Executor sends.
+      kindConfirmed: true,
     });
     const describe = (tool: GraphqlToolDefinition) => ({
       ...summarize(tool),
diff --git a/packages/apps/src/implementation/graphql.ts b/packages/apps/src/implementation/graphql.ts
index 4522528acd..0323fb1ffe 100644
--- a/packages/apps/src/implementation/graphql.ts
+++ b/packages/apps/src/implementation/graphql.ts
@@ -4,8 +4,13 @@ import { ProviderError } from "../contracts/provider-error.ts";
 import { NetworkRefused } from "../contracts/network.ts";
 import { failOnNetworkRefusal } from "./network.ts";
 /** Discover GraphQL tools live; transport, decoding and cancellation stay in Effect. */
-import { Effect, Redacted, Schema } from "effect";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { Effect, Option, Redacted, Ref, Result, Schema, Stream } from "effect";
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientRequest,
+  type HttpClientResponse,
+} from "effect/http";
 import {
   getIntrospectionQuery,
   Kind,
@@ -21,13 +26,20 @@ import {
   GraphqlIntrospection,
   GraphqlResponse,
   GraphqlToolsOptions,
+  maxGraphqlStatedErrors,
+  maxGraphqlStatedExtensions,
+  maxGraphqlStatedFieldLength,
+  type GraphqlStatedError,
   type GraphqlToolDefinition,
   type GraphqlField,
   type GraphqlTools,
   type GraphqlTypeRef,
 } from "../contracts/graphql.ts";
+import { FailureFieldName, maxUpstreamMessageLength } from "../contracts/failure.ts";
+import { defaultOpenapiErrorLimits } from "../contracts/api-response-error.ts";
 import { JsonObject } from "../effect.ts";
 import { jsonSchemaDecoder } from "../effect.ts";
+import { boundStated } from "./upstream-error.ts";
 
 function wrapped(type: GraphqlTypeRef): GraphqlTypeRef {
   if (!type.ofType) throw new GraphqlError({ phase: "discover", reason: "invalid_response" });
@@ -135,6 +147,118 @@ function fieldInput(
   };
 }
 
+/** One error of a GraphQL response's `errors` list; fields the specification does not document are not read. */
+const ResponseError = Schema.Struct({
+  message: Schema.String,
+  path: Schema.optional(Schema.Array(Schema.Union([Schema.String, Schema.Int]))),
+  extensions: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+});
+
+/**
+ * The first segments of a response path, as many as a path of the longest carried length shows,
+ * each bounded. They stay the server's segments: a segment can carry an account secret, which is
+ * replaced before the path is written. A written segment is at least as long as counted here.
+ */
+const boundedPath = (path: ReadonlyArray<string | number>) => {
+  const segments: Array<string | number> = [];
+  let length = 0;
+  for (const segment of path) {
+    if (length > maxGraphqlStatedFieldLength) break;
+    const bounded =
+      typeof segment === "number" ? segment : boundStated(segment, maxGraphqlStatedFieldLength);
+    length +=
+      typeof bounded === "number"
+        ? String(bounded).length + 2
+        : Math.max(bounded.length, 1) + (segments.length === 0 ? 0 : 1);
+    segments.push(bounded);
+  }
+  return segments;
+};
+
+/** The scalar `extensions` entries, `code` first; objects and lists, such as stack traces, are left out. */
+const extensionEntries = (extensions: Readonly<Record<string, unknown>>) => {
+  const entries: Record<string, string | number | boolean> = {};
+  let count = 0;
+  for (const key of [
+    ...(Object.hasOwn(extensions, "code") ? ["code"] : []),
+    ...Object.keys(extensions).filter((key) => key !== "code"),
+  ]) {
+    if (count === maxGraphqlStatedExtensions) break;
+    const value = extensions[key];
+    if (!Schema.is(FailureFieldName)(key)) continue;
+    if (typeof value === "string") entries[key] = boundStated(value, maxGraphqlStatedFieldLength);
+    else if (typeof value === "boolean" || (typeof value === "number" && Number.isFinite(value)))
+      entries[key] = value;
+    else continue;
+    count++;
+  }
+  return count === 0 ? undefined : entries;
+};
+
+/**
+ * The first errors a GraphQL server stated, bounded, and how many it stated when that is more.
+ * Only the first errors of the list are read. Account secrets are not known here; they are
+ * replaced when the failure leaves the app.
+ */
+const statedErrors = (errors: ReadonlyArray<unknown>) => {
+  const stated = errors
+    .slice(0, maxGraphqlStatedErrors)
+    .flatMap((error) => Option.toArray(Schema.decodeUnknownOption(ResponseError)(error)))
+    .map(({ message, path, extensions }): GraphqlStatedError => {
+      const entries = extensions === undefined ? undefined : extensionEntries(extensions);
+      return {
+        message: boundStated(message, maxUpstreamMessageLength),
+        ...(path === undefined || path.length === 0 ? {} : { path: boundedPath(path) }),
+        ...(entries === undefined ? {} : { extensions: entries }),
+      };
+    });
+  return {
+    ...(stated.length === 0 ? {} : { errors: stated }),
+    ...(errors.length > stated.length ? { stated: errors.length } : {}),
+  };
+};
+
+type UnreadBody = NonNullable<GraphqlError["unreadBody"]>;
+
+/** The `errors` list of a refused request's body; other content is not decoded. */
+const RefusedBody = Schema.fromJsonString(
+  Schema.Struct({ errors: Schema.optional(Schema.Array(Schema.Unknown)) }),
+);
+
+/**
+ * The errors a refused request's JSON body stated, read within the bounds of OpenAPI error bodies.
+ * Other bodies state nothing. A body that is too large or does not arrive in time is not read; the
+ * refusal keeps its status.
+ */
+const refusedBody = (response: HttpClientResponse.HttpClientResponse) =>
+  Effect.gen(function* () {
+    if (
+      !/^application\/(?:[\w.-]+\+)?json$/i.test(
+        response.headers["content-type"]?.split(";")[0]?.trim() ?? "",
+      )
+    )
+      return {};
+    const length = response.headers["content-length"];
+    if (length !== undefined && Number(length) > defaultOpenapiErrorLimits.maxBodyBytes)
+      return { unreadBody: "too_large" as const };
+    const text = yield* response.stream.pipe(
+      Stream.mapError((): UnreadBody => "incomplete"),
+      Stream.limitBytes(defaultOpenapiErrorLimits.maxBodyBytes, () =>
+        Stream.fail<UnreadBody>("too_large"),
+      ),
+      Stream.decodeText,
+      Stream.mkString,
+      Effect.timeoutOrElse({
+        duration: defaultOpenapiErrorLimits.readTimeoutMs,
+        orElse: () => Effect.fail<UnreadBody>("incomplete"),
+      }),
+      Effect.result,
+    );
+    if (Result.isFailure(text)) return { unreadBody: text.failure };
+    const body = Schema.decodeUnknownOption(RefusedBody)(text.success);
+    return Option.isSome(body) && body.value.errors?.length ? statedErrors(body.value.errors) : {};
+  });
+
 function selection(text: string): SelectionSetNode {
   const document = parse("query { result { " + text + " } }");
   const definition = document.definitions[0];
@@ -162,62 +286,94 @@ export const graphqlClientEffect = (input: GraphqlToolsOptions) =>
       return yield* new GraphqlError({ phase: "discover", reason: "invalid_input" });
     const headers = Redacted.make({ ...options.headers });
     const request = (phase: "discover" | "call", query: string, variables: JsonObject = {}) =>
-      Effect.scoped(
-        Effect.gen(function* () {
-          const client = yield* HttpClient.HttpClient;
-          const response = yield* HttpClient.withScope(client).execute(
-            HttpClientRequest.post(url.href).pipe(
-              // GitHub requires this header; Workers do not supply one by default.
-              HttpClientRequest.setHeader("user-agent", "Executor"),
-              HttpClientRequest.setHeaders(Redacted.value(headers)),
-              HttpClientRequest.bodyJsonUnsafe({ query, variables }),
-            ),
-          );
-          // Executor's network refused the request; its reason names the host or credential at fault.
-          yield* failOnNetworkRefusal(response);
-          if (response.status < 200 || response.status >= 300)
-            return yield* (
-              httpProviderError(response.status, response.headers) ??
-                new GraphqlError({ phase, reason: "request", status: response.status })
+      Effect.gen(function* () {
+        // The status of a refused request, so a body still arriving at the deadline keeps it.
+        const refusal = yield* Ref.make(Option.none<number>());
+        return yield* Effect.scoped(
+          Effect.gen(function* () {
+            const client = yield* HttpClient.HttpClient;
+            const response = yield* HttpClient.withScope(client).execute(
+              HttpClientRequest.post(url.href).pipe(
+                // GitHub requires this header; Workers do not supply one by default.
+                HttpClientRequest.setHeader("user-agent", "Executor"),
+                HttpClientRequest.setHeaders(Redacted.value(headers)),
+                HttpClientRequest.bodyJsonUnsafe({ query, variables }),
+              ),
             );
-          const result = yield* response.json.pipe(
-            owned("upstream", "provider.http.response.read"),
-            Effect.flatMap(Schema.decodeUnknownEffect(GraphqlResponse)),
-            Effect.mapError(() => new GraphqlError({ phase, reason: "invalid_response" })),
-          );
-          if (result.errors?.length)
-            return yield* (
-              graphqlProviderError(result.errors, response.status) ??
-                new GraphqlError({ phase, reason: "execution", status: response.status })
+            // Executor's network refused the request; its reason names the host or credential at fault.
+            yield* failOnNetworkRefusal(response);
+            if (response.status < 200 || response.status >= 300) {
+              const classified = httpProviderError(response.status, response.headers);
+              if (classified !== undefined) return yield* classified;
+              // A server can answer a request it refuses, such as one that fails validation, with
+              // a client error status and its errors in a GraphQL response body.
+              yield* Ref.set(refusal, Option.some(response.status));
+              const refused = yield* refusedBody(response).pipe(
+                owned("upstream", "provider.http.response.read"),
+              );
+              return yield* new GraphqlError({
+                phase,
+                reason: "request",
+                status: response.status,
+                ...refused,
+              });
+            }
+            const result = yield* response.json.pipe(
+              owned("upstream", "provider.http.response.read"),
+              Effect.flatMap(Schema.decodeUnknownEffect(GraphqlResponse)),
+              Effect.mapError(() => new GraphqlError({ phase, reason: "invalid_response" })),
             );
-          if (result.data == null)
-            return yield* new GraphqlError({ phase, reason: "invalid_response" });
-          return result.data;
-        }),
-      ).pipe(
-        owned("upstream", "provider.graphql.request", {
-          attributes: {
-            "executor.operation": phase,
-            "server.address": url.hostname,
-          },
-        }),
-        Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }),
-        Effect.provideService(FetchHttpClient.Fetch, globalThis.fetch),
-        Effect.provide(FetchHttpClient.layer),
-        Effect.timeoutOrElse({
-          duration: options.timeoutMs ?? defaultGraphqlClientLimits.timeoutMs,
-          orElse: () => Effect.fail(new GraphqlError({ phase, reason: "timeout" })),
-        }),
-        Effect.mapError((error) =>
-          error instanceof ProviderError && options.accountId !== undefined
-            ? accountProviderError(error, options.accountId)
-            : error instanceof GraphqlError ||
-                error instanceof ProviderError ||
-                error instanceof NetworkRefused
-              ? error
-              : new GraphqlError({ phase, reason: "request" }),
-        ),
-      );
+            if (result.errors?.length)
+              return yield* (
+                graphqlProviderError(result.errors, response.status) ??
+                  new GraphqlError({
+                    phase,
+                    reason: "execution",
+                    status: response.status,
+                    ...statedErrors(result.errors),
+                  })
+              );
+            if (result.data == null)
+              return yield* new GraphqlError({ phase, reason: "invalid_response" });
+            return result.data;
+          }),
+        ).pipe(
+          owned("upstream", "provider.graphql.request", {
+            attributes: {
+              "executor.operation": phase,
+              "server.address": url.hostname,
+            },
+          }),
+          Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }),
+          Effect.provideService(FetchHttpClient.Fetch, globalThis.fetch),
+          Effect.provide(FetchHttpClient.layer),
+          Effect.timeoutOrElse({
+            duration: options.timeoutMs ?? defaultGraphqlClientLimits.timeoutMs,
+            orElse: () =>
+              Effect.flatMap(Ref.get(refusal), (status) =>
+                Effect.fail(
+                  Option.isSome(status)
+                    ? new GraphqlError({
+                        phase,
+                        reason: "request",
+                        status: status.value,
+                        unreadBody: "incomplete",
+                      })
+                    : new GraphqlError({ phase, reason: "timeout" }),
+                ),
+              ),
+          }),
+          Effect.mapError((error) =>
+            error instanceof ProviderError && options.accountId !== undefined
+              ? accountProviderError(error, options.accountId)
+              : error instanceof GraphqlError ||
+                  error instanceof ProviderError ||
+                  error instanceof NetworkRefused
+                ? error
+                : new GraphqlError({ phase, reason: "request" }),
+          ),
+        );
+      });
     const discover = request("discover", getIntrospectionQuery()).pipe(
       Effect.flatMap(Schema.decodeUnknownEffect(GraphqlIntrospection)),
       Effect.mapError((error) =>
diff --git a/packages/apps/src/implementation/mcp-catalog.ts b/packages/apps/src/implementation/mcp-catalog.ts
index 1a8a9a9787..e256e682a8 100644
--- a/packages/apps/src/implementation/mcp-catalog.ts
+++ b/packages/apps/src/implementation/mcp-catalog.ts
@@ -100,10 +100,17 @@ export const mcpCatalog = (options: McpCatalogOptions, kinds: OperationKinds) =>
       ...tool.annotations,
       readOnlyHint: kindOf(tool) === "query",
     });
+    /**
+     * Only the app's `kinds` confirms a kind. The server's `readOnlyHint` is its claim: a server can
+     * label a tool that writes read-only, so Executor never tells an agent the call only read.
+     */
+    const confirmed = (tool: McpToolSummary) =>
+      Object.hasOwn(kinds, tool.name) ? { kindConfirmed: true } : {};
     const summarize = (tool: McpToolSummary) => ({
       name: tool.name,
       description: tool.description ?? tool.title ?? tool.name,
       readOnly: kindOf(tool) === "query",
+      ...confirmed(tool),
       ...(tool.title === undefined ? {} : { title: tool.title }),
       annotations: annotationsOf(tool),
     });
@@ -124,7 +131,12 @@ export const mcpCatalog = (options: McpCatalogOptions, kinds: OperationKinds) =>
         Effect.flatMap((selected) =>
           selected === undefined
             ? Effect.succeed(undefined)
-            : operationDescription(tool.name, "", selected),
+            : operationDescription(tool.name, "", selected).pipe(
+                Effect.map(({ kindConfirmed: _declared, ...described }) => ({
+                  ...described,
+                  ...confirmed(tool),
+                })),
+              ),
         ),
       );
     const router: DynamicRouter = {
diff --git a/packages/apps/src/implementation/mcp.ts b/packages/apps/src/implementation/mcp.ts
index 0d7b072f19..b94284c914 100644
--- a/packages/apps/src/implementation/mcp.ts
+++ b/packages/apps/src/implementation/mcp.ts
@@ -154,6 +154,7 @@ const transportFetch =
     telemetry: Effect.Success<typeof captureTelemetry>,
     rejected: Deferred.Deferred<never, ProviderError | NetworkRefused>,
     answered: Ref.Ref<ErrorResponses>,
+    kind: "http" | "sse",
   ): FetchLike =>
   (url, init) =>
     Effect.runPromiseWith(telemetry.context)(
@@ -197,7 +198,11 @@ const transportFetch =
           );
         const { body, upstream } = yield* errorBody(response);
         const provider = httpProviderError(response.status, response.headers);
-        if (provider !== undefined) {
+        // The Streamable HTTP client's GET only opens the optional server-initiated stream. A
+        // server can refuse it and still answer every POST, and the client carries on without the
+        // stream, so its refusal does not fail the session. The SSE transport's GET is the session.
+        const optionalStream = kind === "http" && request.method === "GET";
+        if (provider !== undefined && !optionalStream) {
           // EventSource replaces rejected fetch errors. Retain our safe failure
           // within this session so SSE cannot erase its status or reason.
           const refused = providerErrorDetail(provider, { upstream });
@@ -293,7 +298,7 @@ function withClient<A, E>(
         const pending = new Set<Promise<void>>();
         const { client, transport } = yield* Effect.acquireRelease(
           Effect.sync(() => {
-            const fetch = transportFetch(connection, telemetry, rejected, answered);
+            const fetch = transportFetch(connection, telemetry, rejected, answered, kind);
             const client = new Client(
               { name: "executor-apps", version: "0.1.0" },
               {
diff --git a/packages/apps/src/implementation/openapi-compile.ts b/packages/apps/src/implementation/openapi-compile.ts
index 59bbdbff2f..1f6a8c6eb4 100644
--- a/packages/apps/src/implementation/openapi-compile.ts
+++ b/packages/apps/src/implementation/openapi-compile.ts
@@ -43,11 +43,20 @@ function fail(code: TemplateError["code"], reason: string): never {
   throw new TemplateError({ code, reason });
 }
 const record = (value: unknown): JsonObject => documentObject(value);
+/**
+ * An Operation Object without its null fields. YAML writes a field left empty, such as
+ * `operationId:`, as null; it means the field is absent, as Executor v1 read it.
+ */
+const withoutNulls = (operation: JsonObject): JsonObject =>
+  Object.values(operation).includes(null)
+    ? Object.fromEntries(Object.entries(operation).filter(([, value]) => value !== null))
+    : operation;
 /** Naming reads only these fields of each declared Operation Object. */
 const OperationNaming = Schema.Struct({
   operationId: Schema.optionalKey(Schema.String),
-  tags: Schema.optionalKey(Schema.Array(Schema.String)),
+  tags: Schema.optionalKey(Schema.Array(Schema.Unknown)),
 });
+const isParameterLocation = Schema.is(Parameter.fields.in);
 const identifier = (name: string) => name.replace(/[^a-zA-Z0-9_]/g, "_");
 /** Parse an absolute URL from the definition. Failures never echo it: a URL can hold credentials. */
 function parseUrl(value: string, base?: string): URL {
@@ -119,6 +128,17 @@ const binaryInput: JsonObject = {
   description: "File bytes encoded as base64.",
   contentEncoding: "base64",
 };
+/**
+ * A Parameter Object's documentation, which OpenAPI keeps beside its schema rather than in it.
+ * It describes this use of the schema, so it replaces the schema's own on the input property;
+ * requests never read it. Documentation alone never fails an operation that is otherwise valid.
+ */
+const parameterDocumentation = (parameter: JsonObject): JsonObject => ({
+  ...(typeof parameter.description === "string" && parameter.description.trim() !== ""
+    ? { description: parameter.description }
+    : {}),
+  ...(parameter.deprecated === true ? { deprecated: true } : {}),
+});
 /**
  * Where a Responses, Request Body or Parameter entry is declared: the object a reference resolved
  * to, or the entry's own place under its operation.
@@ -190,6 +210,45 @@ function errorContent(document: OpenApiDocument, response: JsonObject): Json | u
   }
 }
 
+const isEventStream = (type: string) =>
+  type.split(";")[0]?.trim().toLowerCase() === "text/event-stream";
+/** Whether a response, resolved or not, offers an event stream. */
+const offersEventStream = (document: OpenApiDocument, response: unknown) => {
+  const content = errorContent(document, record(response));
+  return content !== undefined && Object.keys(record(content)).some(isEventStream);
+};
+/**
+ * An operation that can answer with an event stream or with another media type, such as JSON,
+ * without the event stream in its responses, so it asks for and returns the other type, as
+ * Executor v1 called it. An operation whose successes offer only an event stream keeps it.
+ */
+function withoutStreamAlternatives(document: OpenApiDocument, operation: JsonObject): JsonObject {
+  if (operation.responses === undefined) return operation;
+  const responses = Object.entries(record(operation.responses));
+  if (!responses.some(([, response]) => offersEventStream(document, response))) return operation;
+  const alternative = responses.some(([status, response]) => {
+    if (!/^2(?:[0-9]{2}|XX)$/i.test(status)) return false;
+    const content = errorContent(document, record(response));
+    return (
+      content !== undefined && Object.keys(record(content)).some((type) => !isEventStream(type))
+    );
+  });
+  if (!alternative) return operation;
+  return {
+    ...operation,
+    responses: Object.fromEntries(
+      responses.map(([status, response]) => {
+        if (!offersEventStream(document, response)) return [status, response];
+        const resolved = document.resolve(record(response));
+        const content = Object.entries(record(resolved.content)).filter(
+          ([type]) => !isEventStream(type),
+        );
+        return [status, { ...resolved, content: Object.fromEntries(content) }];
+      }),
+    ),
+  };
+}
+
 /** Keep tagged errors, including response/component refs and anyOf alternatives.
  * Public text comes from a declared string message or the schema's static description.
  * `scripts/check-api-errors.ts` applies this to Executor's own API documents.
@@ -315,6 +374,79 @@ function prefixParameters(prefix: string): readonly string[] {
   return names;
 }
 
+/**
+ * Every operation a definition declares, in definition order, with the tool name it has. Names are
+ * planned over every declared operation, so whether the compiler supports one operation never
+ * renames another, and a left-out operation keeps the name it would have.
+ */
+function declaredOperations(document: OpenApiDocument) {
+  const { spec } = document;
+  // OpenAPI 3.2 adds QUERY and `additionalOperations`, keyed by the exact method to send.
+  const version32 = spec.openapi.startsWith("3.2.");
+  const candidates = Object.entries(spec.paths).flatMap(([path, source]) => {
+    const item = document.resolve(source);
+    const itemAt = declaredAt(document, source, `#/paths/${pointerToken(path)}`);
+    const additional =
+      version32 && item.additionalOperations !== undefined
+        ? Object.entries(record(item.additionalOperations)).map(([method, value]) => ({
+            method,
+            value,
+            at: `${itemAt}/additionalOperations/${pointerToken(method)}`,
+          }))
+        : [];
+    const fixed = (version32 ? fixedMethods32 : fixedMethods)
+      .filter((method) => item[method.toLowerCase()] !== undefined)
+      .map((method): { method: string; value: Json | undefined; at: string } => ({
+        method,
+        value: item[method.toLowerCase()],
+        at: `${itemAt}/${method.toLowerCase()}`,
+      }));
+    return [...fixed, ...additional].map((operation) => ({ ...operation, path, item, itemAt }));
+  });
+  return planOperationNames(
+    candidates.map((candidate) => {
+      const resolved = resolvedOrUndefined(document, candidate.value);
+      const naming = Schema.decodeUnknownOption(OperationNaming)(
+        resolved === undefined ? undefined : withoutNulls(resolved),
+      ).pipe(Option.getOrUndefined);
+      return {
+        ...candidate,
+        operationId: naming?.operationId,
+        tag: naming?.tags?.find(
+          (tag): tag is string => typeof tag === "string" && tag.trim() !== "",
+        ),
+      };
+    }),
+  );
+}
+
+/**
+ * The tool name, method and declared path of every operation a definition declares, in definition
+ * order, whether or not the compiler imports it: the names `compileOpenApiDocument` gives them.
+ * The document is consumed, as compilation consumes it.
+ */
+export const compiledOperationNames = (document: JsonObject) =>
+  // oxlint-disable-next-line executor/authored-code-through-adapter -- this module's own parser
+  Effect.tryPromise({
+    try: async () =>
+      declaredOperations(await openApiDocument(document)).map(({ name, method, path }) => ({
+        name,
+        method,
+        path,
+      })),
+    catch: (error) =>
+      error instanceof TemplateError
+        ? Exit.fail(error)
+        : Schema.isSchemaError(error)
+          ? Exit.fail(
+              new TemplateError({
+                code: "invalid_document",
+                reason: "The definition's structure does not match OpenAPI.",
+              }),
+            )
+          : Exit.die(error),
+  }).pipe(Effect.catch((exit) => exit));
+
 /** Compile a revision of a live OpenAPI source into tool declarations for the app runtime.
  * The document is consumed: compilation upgrades it in place instead of copying it. It must be a
  * tree, with no object reached twice, as parsed JSON is.
@@ -461,43 +593,8 @@ export const compileOpenApiDocument = (
         if ("error" in known) throw known.error;
         return known.address;
       };
-      // OpenAPI 3.2 adds QUERY and `additionalOperations`, keyed by the exact method to send.
-      const version32 = spec.openapi.startsWith("3.2.");
-      const candidates = Object.entries(spec.paths).flatMap(([path, source]) => {
-        const item = document.resolve(source);
-        const itemAt = declaredAt(document, source, `#/paths/${pointerToken(path)}`);
-        const additional =
-          version32 && item.additionalOperations !== undefined
-            ? Object.entries(record(item.additionalOperations)).map(([method, value]) => ({
-                method,
-                value,
-                at: `${itemAt}/additionalOperations/${pointerToken(method)}`,
-              }))
-            : [];
-        const fixed = (version32 ? fixedMethods32 : fixedMethods)
-          .filter((method) => item[method.toLowerCase()] !== undefined)
-          .map((method): { method: string; value: Json | undefined; at: string } => ({
-            method,
-            value: item[method.toLowerCase()],
-            at: `${itemAt}/${method.toLowerCase()}`,
-          }));
-        return [...fixed, ...additional].map((operation) => ({ ...operation, path, item, itemAt }));
-      });
-      if (!candidates.length) fail("no_operations", "This API does not contain any operations.");
-      // Names are planned over every declared operation, so whether this compiler supports one
-      // operation never renames another, and a left-out operation keeps the name it would have.
-      const named = planOperationNames(
-        candidates.map((candidate) => {
-          const naming = Schema.decodeUnknownOption(OperationNaming)(
-            resolvedOrUndefined(document, candidate.value),
-          ).pipe(Option.getOrUndefined);
-          return {
-            ...candidate,
-            operationId: naming?.operationId,
-            tag: naming?.tags?.find((tag) => tag.trim() !== ""),
-          };
-        }),
-      );
+      const named = declaredOperations(document);
+      if (!named.length) fail("no_operations", "This API does not contain any operations.");
       // Left-out operations are reported in definition order, whatever stage left them out.
       const order = new Map(named.map(({ name }, index) => [name, index]));
       const inDefinitionOrder = (operations: readonly OpenapiSkippedOperation[]) =>
@@ -505,15 +602,17 @@ export const compileOpenApiDocument = (
       for (const [index, { name, path, item, itemAt, method, value, at }] of named.entries()) {
         if (index % 100 === 99) await yieldToRuntime();
         try {
-          if (!path.startsWith("/") || path.includes("?") || path.includes("#"))
-            fail("operation_path", "The path must start with / and contain no ? or #.");
+          if (!path.startsWith("/")) fail("operation_path", "The path must start with /.");
           if (!isImportedMethod(method))
             fail(
               "operation_method",
               `Executor does not send the HTTP method ${method}. It imports ${fixedMethods32.join(", ")} operations.`,
             );
           const operationMethods: GeneratedSecrets[] = [];
-          const resolved = document.resolve(record(value));
+          const resolved = withoutStreamAlternatives(
+            document,
+            withoutNulls(document.resolve(record(value))),
+          );
           const operation = decodeDefinition(Operation, resolved, at, "operation");
           // Tags only label the tool; a malformed list is dropped rather than rejecting it.
           const tags = Option.getOrUndefined(
@@ -561,14 +660,16 @@ export const compileOpenApiDocument = (
               }),
             ),
           ];
-          const parameters = new Map<string, { parameter: Parameter; at: string | undefined }>();
+          const parameters = new Map<
+            string,
+            { parameter: Parameter; documentation: JsonObject; at: string | undefined }
+          >();
           for (const { parameter, at: parameterAt } of declared) {
-            const p = decodeDefinition(
-              Parameter,
-              document.resolve(record(parameter)),
-              parameterAt,
-              "parameter",
-            );
+            const declaration = document.resolve(record(parameter));
+            // A parameter in a place OpenAPI 3 does not have, such as Swagger 2.0's `body`, is not
+            // sent, as Executor v1 left it out.
+            if (!isParameterLocation(declaration.in)) continue;
+            const p = decodeDefinition(Parameter, declaration, parameterAt, "parameter");
             if (p.in === "querystring") {
               const [media, ...others] = Object.keys(p.content ?? {});
               const kind =
@@ -579,7 +680,11 @@ export const compileOpenApiDocument = (
                   `The querystring parameter at ${parameterAt} must declare one form, JSON or text media type in content.`,
                 );
             }
-            parameters.set(`${p.in}:${p.name}`, { parameter: p, at: parameterAt });
+            parameters.set(`${p.in}:${p.name}`, {
+              parameter: p,
+              documentation: parameterDocumentation(declaration),
+              at: parameterAt,
+            });
           }
           // A path prefix parameter the operation declares without placing it keeps its schema.
           for (const name of prefix) {
@@ -592,6 +697,7 @@ export const compileOpenApiDocument = (
             if (!parameters.has(key))
               parameters.set(key, {
                 parameter: { name, in: "path", required: true, schema: { type: "string" } },
+                documentation: {},
                 at: undefined,
               });
           }
@@ -600,7 +706,7 @@ export const compileOpenApiDocument = (
             string,
             { properties: Record<string, (api: ApiSchema) => Json>; required: string[] }
           >();
-          for (const { parameter: p, at: parameterAt } of parameters.values()) {
+          for (const { parameter: p, documentation, at: parameterAt } of parameters.values()) {
             const key = p.in === "header" ? "headers" : p.in;
             const group = groups.get(key) ?? { properties: {}, required: [] };
             const [mediaType, content] =
@@ -613,7 +719,9 @@ export const compileOpenApiDocument = (
                 : mediaSchemaAt(document, `${parameterAt}`, mediaType, content);
             // A parameter that only the path prefix declares is Executor's own Draft 2020-12.
             group.properties[p.name] =
-              parameterAt === undefined ? () => schema : (api) => api(schema, schemaAt);
+              parameterAt === undefined
+                ? () => schema
+                : (api) => ({ ...api(schema, schemaAt), ...documentation });
             if (p.required || p.in === "path") group.required.push(p.name);
             groups.set(key, group);
           }
@@ -632,14 +740,18 @@ export const compileOpenApiDocument = (
           }
           const bodyVariants: Array<(api: ApiSchema) => JsonObject> = [];
           let retainedBody: GeneratedOperation["request"]["requestBody"];
-          if (operation.requestBody) {
-            const bodyAt = declaredAt(document, resolved.requestBody, `${at}/requestBody`);
-            const request = decodeDefinition(
-              RequestBody,
-              document.resolve(operation.requestBody),
-              bodyAt,
-              "request body",
-            );
+          const bodyAt = declaredAt(document, resolved.requestBody, `${at}/requestBody`);
+          const request =
+            operation.requestBody === undefined
+              ? undefined
+              : decodeDefinition(
+                  RequestBody,
+                  document.resolve(operation.requestBody),
+                  bodyAt,
+                  "request body",
+                );
+          // A request body that declares no media types has nothing to send, as Executor v1 read it.
+          if (request !== undefined && Object.keys(request.content).length > 0) {
             const rawContent = record(document.resolve(record(resolved.requestBody)).content);
             const retainedContent: Record<string, (typeof RequestBody.Type.content)[string]> = {};
             for (const [contentType, content] of Object.entries(request.content)) {
@@ -696,8 +808,6 @@ export const compileOpenApiDocument = (
               }));
             }
             retainedBody = { ...request, content: retainedContent };
-            if (!bodyVariants.length)
-              fail("request_body", "The request body declares no media types.");
             properties.body = () => ({});
             properties.contentType = () => ({
               type: "string",
@@ -757,10 +867,10 @@ export const compileOpenApiDocument = (
             fail("input_schema", "Its input schema is not valid JSON.");
           }
           const outputSchema = responseSchema(document, resolved, at, method);
-          const streaming = Object.values(operation.responses ?? {}).some((response) => {
-            const content = errorContent(document, response);
-            return content !== undefined && Object.hasOwn(record(content), "text/event-stream");
-          });
+          // Only an operation without another success type is left with an event stream.
+          const streaming = Object.values(operation.responses ?? {}).some((response) =>
+            offersEventStream(document, response),
+          );
           built.push({
             methods: operationMethods,
             declared: { name, method, path },
diff --git a/packages/apps/src/implementation/openapi-document.ts b/packages/apps/src/implementation/openapi-document.ts
index 48272d0be9..aade53dcb6 100644
--- a/packages/apps/src/implementation/openapi-document.ts
+++ b/packages/apps/src/implementation/openapi-document.ts
@@ -98,54 +98,82 @@ const holdsReference = (value: unknown): boolean =>
       (typeof value.$ref === "string" || Object.values(value).some(holdsReference));
 
 /**
- * Reject a schema keyword whose value is not a schema but holds a reference, such as an array
- * `items` of `$ref`s, which JSON Schema 2020-12 and OpenAPI 3.0 both forbid. Converters pass such a
- * value through without reading it, so its reference would stay unresolved and fail validation.
- * Such a value without a reference passes through unchanged, as validators accept it. The failure
- * names the keyword's JSON Pointer, starting from `at`.
+ * Check a schema's keywords and write each reference in it as `canonical` names it. A schema keyword
+ * whose value is not a schema but holds a reference, such as an array `items` of `$ref`s, which
+ * JSON Schema 2020-12 and OpenAPI 3.0 both forbid, is rejected: converters pass such a value
+ * through without reading it, so its reference would stay unresolved and fail validation. Such a
+ * value without a reference passes through unchanged, as validators accept it. The failure names
+ * the keyword's JSON Pointer, starting from `at`. Only the objects on the way to a rewritten
+ * reference are copied; a schema without one is returned as it is.
  */
-const checkSchemaKeywords = (schema: JsonObject, at: string) => {
+const prepareSchema = (
+  schema: JsonObject,
+  at: string,
+  canonical: (ref: string) => string,
+): JsonObject => {
   const path: string[] = [];
   /** Visit a schema, or reject a value that is not one when it holds a reference. */
-  const child = (value: Schema.Json, problem: () => string) => {
+  const child = (value: Schema.Json, problem: () => string): Schema.Json => {
     if (isSchemaValue(value)) return visit(value);
     if (holdsReference(value))
       fail(
         "schema_keyword",
         `The schema at ${[at, ...path].join("/")} is invalid: ${problem()}, so the reference inside it cannot be resolved.`,
       );
+    return value;
   };
-  const visit = (node: Schema.Json) => {
-    if (!isObject(node)) return;
+  const visit = (node: Schema.Json): Schema.Json => {
+    if (!isObject(node)) return node;
+    let copy: Record<string, Schema.Json> | undefined;
+    const set = (key: string, value: Schema.Json) => {
+      if (value !== node[key]) (copy ??= { ...node })[key] = value;
+    };
     for (const [key, value] of Object.entries(node)) {
       path.push(pointerToken(key));
-      if (schemaKeywords.has(key))
-        child(value, () => `"${key}" must be a schema, not ${jsonKind(value)}`);
-      else if (schemaArrayKeywords.has(key) || schemaMapKeywords.has(key)) {
-        const entries = schemaArrayKeywords.has(key)
-          ? Array.isArray(value)
-            ? [...value.entries()]
-            : undefined
-          : isObject(value)
-            ? Object.entries(value)
-            : undefined;
-        if (entries === undefined)
+      if (key === "$ref" && typeof value === "string") set(key, canonical(value));
+      else if (schemaKeywords.has(key))
+        set(
+          key,
+          child(value, () => `"${key}" must be a schema, not ${jsonKind(value)}`),
+        );
+      else if (schemaArrayKeywords.has(key) && Array.isArray(value)) {
+        let items: Schema.Json[] | undefined;
+        for (const [index, item] of value.entries()) {
+          path.push(String(index));
+          const next = child(
+            item,
+            () => `each "${key}" entry must be a schema, not ${jsonKind(item)}`,
+          );
+          if (next !== item) (items ??= [...value])[index] = next;
+          path.pop();
+        }
+        if (items !== undefined) set(key, items);
+      } else if (schemaMapKeywords.has(key) && isObject(value)) {
+        let entries: Record<string, Schema.Json> | undefined;
+        for (const [name, item] of Object.entries(value)) {
+          path.push(pointerToken(name));
+          const next = child(
+            item,
+            () => `each "${key}" entry must be a schema, not ${jsonKind(item)}`,
+          );
+          if (next !== item) (entries ??= { ...value })[name] = next;
+          path.pop();
+        }
+        if (entries !== undefined) set(key, entries);
+      } else if (schemaArrayKeywords.has(key) || schemaMapKeywords.has(key))
+        set(
+          key,
           child(value, () =>
             schemaArrayKeywords.has(key)
               ? `"${key}" must be an array of schemas, not ${jsonKind(value)}`
               : `"${key}" must map names to schemas, not ${jsonKind(value)}`,
-          );
-        else
-          for (const [name, item] of entries) {
-            path.push(pointerToken(String(name)));
-            child(item, () => `each "${key}" entry must be a schema, not ${jsonKind(item)}`);
-            path.pop();
-          }
-      }
+          ),
+        );
       path.pop();
     }
+    return copy ?? node;
   };
-  visit(schema);
+  return record(visit(schema));
 };
 /** Fields that map names to Path Item Objects, whose `$ref` siblings extend the referenced item. */
 const pathItemMaps = new Set(["paths", "webhooks", "pathItems"]);
@@ -369,6 +397,59 @@ export async function openApiDocument(input: JsonObject) {
   const definitions = new Map<string, JsonObject>();
   // Component names each definition references directly, for transitive reach checks.
   const references = new Map<string, ReadonlySet<string>>();
+  // Schemas a reference reaches somewhere other than a whole component, by definition name.
+  const pointed = new Map<string, Schema.Json>();
+  const componentSection = (path: readonly string[]) =>
+    path[0] === "components" && path[1] === "schemas" && path[2] !== undefined;
+  /**
+   * The definition name of the schema a local reference reaches: a component's own name, or, for
+   * any other place in the definition, such as a component's property, a Parameter Object's schema
+   * or an operation's request body schema, the JSON Pointer the reference holds.
+   * Documents often leave characters such as `[` or spaces unencoded in the fragment, which is then
+   * read as a plain JSON Pointer.
+   */
+  const definitionName = (
+    ref: string,
+  ): { readonly name: string } | { readonly problem: "outside" | "missing" | "conflict" } => {
+    const path = localPath(ref);
+    if (path === undefined || path.length === 0) return { problem: "outside" };
+    const component = componentSection(path) ? path[2] : undefined;
+    if (component !== undefined && !Object.hasOwn(components, component))
+      return { problem: "missing" };
+    if (component !== undefined && path.length === 3) return { name: component };
+    // A JSON Pointer, which a URI fragment would prefix with `#`: the validator does not encode
+    // that character in definition names.
+    const name = path.map((token) => `/${JsonPointer.escapeToken(token)}`).join("");
+    if (pointed.has(name)) return { name };
+    if (Object.hasOwn(components, name)) return { problem: "conflict" };
+    let node: Schema.Json | undefined = component === undefined ? restored : components[component];
+    for (const token of component === undefined ? path : path.slice(3)) {
+      node = isObject(node)
+        ? Object.hasOwn(node, token)
+          ? node[token]
+          : undefined
+        : Array.isArray(node) && /^(?:0|[1-9][0-9]*)$/.test(token)
+          ? node[Number(token)]
+          : undefined;
+      if (node === undefined) return { problem: "missing" };
+    }
+    if (!isSchemaValue(node)) return { problem: "missing" };
+    pointed.set(name, node);
+    return { name };
+  };
+  const conflictReason = (ref: string) =>
+    `The reference ${JSON.stringify(ref)} reaches a schema whose definition name a component schema already has.`;
+  /** The API schema a definition name stands for. Boolean schemas read as the objects they mean. */
+  const definitionSchema = (name: string): JsonObject | undefined => {
+    const schema = Object.hasOwn(components, name) ? components[name] : pointed.get(name);
+    return schema === undefined
+      ? undefined
+      : schema === true
+        ? {}
+        : schema === false
+          ? { not: {} }
+          : record(schema);
+  };
 
   return {
     spec: parsed,
@@ -380,19 +461,16 @@ export async function openApiDocument(input: JsonObject) {
     origin(value: unknown): string | undefined {
       return isObject(value) ? origins.get(value) : undefined;
     },
-    /** Inspect a component schema without expanding its children. OpenAPI object refs must already be resolved by Swagger. */
+    /**
+     * Inspect the schema a reference reaches without expanding its children: a component, or any
+     * other schema in the definition. OpenAPI object references are already resolved.
+     */
     resolve(value: JsonObject): JsonObject {
       const visited = new Set<string>();
       while (value.$ref !== undefined) {
         const ref = value.$ref;
-        const path = typeof ref === "string" ? JsonPointer.parseUriFragment(ref) : undefined;
-        if (
-          typeof ref !== "string" ||
-          path?.length !== 3 ||
-          path[0] !== "components" ||
-          path[1] !== "schemas" ||
-          path[2] === undefined
-        )
+        const found = typeof ref === "string" ? definitionName(ref) : { problem: "outside" };
+        if (typeof ref !== "string" || ("problem" in found && found.problem === "outside"))
           fail(
             "external_reference",
             `The reference ${JSON.stringify(ref)} does not resolve within the definition. Only local references to objects the definition declares are supported.`,
@@ -400,12 +478,15 @@ export async function openApiDocument(input: JsonObject) {
         if (visited.has(ref))
           fail("circular_reference", `The schema ${ref} is a circular alias of itself.`);
         visited.add(ref);
-        if (!Object.hasOwn(components, path[2]))
+        if ("problem" in found && found.problem === "conflict")
+          fail("schema_reference", conflictReason(ref));
+        const schema = "name" in found ? definitionSchema(found.name) : undefined;
+        if (schema === undefined)
           fail(
             "missing_component",
             `The reference ${ref} names a schema the definition does not declare.`,
           );
-        value = record(components[path[2]]);
+        value = schema;
       }
       return value;
     },
@@ -420,28 +501,32 @@ export async function openApiDocument(input: JsonObject) {
       const direct = new Set<string>();
       const local: Record<string, Schema.Json> = {};
       const visit = (input: JsonObject, direct: Set<string>, at: string): JsonObject => {
-        checkSchemaKeywords(input, at);
+        // Every reference is written as the component reference the converter rewrites to
+        // `#/$defs/<name>`, whatever schema in the definition it reaches.
+        const prepared = prepareSchema(input, at, (ref) => {
+          const found = definitionName(ref);
+          if ("name" in found)
+            return JsonPointer.formatUriFragment(["components", "schemas", found.name]);
+          return fail(
+            found.problem === "missing" ? "missing_component" : "schema_reference",
+            found.problem === "missing"
+              ? `The schema at ${at} references ${ref}, which the definition does not declare.`
+              : found.problem === "conflict"
+                ? conflictReason(ref)
+                : `The schema at ${at} references ${JSON.stringify(ref)}, which is outside the definition. Only references within it are supported.`,
+          );
+        });
         let document: ReturnType<typeof convert>;
         try {
-          document = convert(input, {
+          document = convert(prepared, {
             onReference(ref) {
               const path = JsonPointer.parseUriFragment(ref);
-              const name = path?.[2];
-              if (
-                path?.length !== 3 ||
-                path[0] !== "components" ||
-                path[1] !== "schemas" ||
-                name === undefined
-              )
-                fail(
+              const name = path?.length === 3 && componentSection(path) ? path[2] : undefined;
+              const component = name === undefined ? undefined : definitionSchema(name);
+              if (name === undefined || component === undefined)
+                return fail(
                   "schema_reference",
-                  `The schema at ${at} references ${JSON.stringify(ref)}. Only references to #/components/schemas/<name> are supported.`,
-                );
-              const component = Object.hasOwn(components, name) ? components[name] : undefined;
-              if (component === undefined)
-                fail(
-                  "missing_component",
-                  `The schema at ${at} references ${ref}, which the definition does not declare.`,
+                  `The schema at ${at} references ${JSON.stringify(ref)}, which does not resolve.`,
                 );
               direct.add(name);
               if (!definitions.has(name)) {
@@ -451,7 +536,11 @@ export async function openApiDocument(input: JsonObject) {
                 const names = new Set<string>();
                 definitions.set(
                   name,
-                  visit(component, names, `#/components/schemas/${pointerToken(name)}`),
+                  visit(
+                    component,
+                    names,
+                    pointed.has(name) ? `#${name}` : `#/components/schemas/${pointerToken(name)}`,
+                  ),
                 );
                 references.set(name, names);
               }
diff --git a/packages/apps/src/implementation/openapi-names.ts b/packages/apps/src/implementation/openapi-names.ts
index a047d068f1..349f1f7d4f 100644
--- a/packages/apps/src/implementation/openapi-names.ts
+++ b/packages/apps/src/implementation/openapi-names.ts
@@ -33,8 +33,12 @@ const pascal = (value: string) => {
 };
 
 const version = /^v\d+(?:[._-]\d+)?$/i;
+/**
+ * The path's segments. A fixed query or fragment, as in `/search?type=items`, names nothing; only
+ * the last round, the hash, reads the whole path, so paths that differ only there stay distinct.
+ */
 const segments = (path: string) =>
-  path
+  (path.split(/[?#]/)[0] ?? path)
     .split("/")
     .map((segment) => segment.trim())
     .filter((segment) => segment.length > 0);
@@ -128,12 +132,16 @@ export const planOperationNames = <I extends OperationNameInput>(
     return { input, group, leaf, prefix, versionSegment, tokens, name: `${group}.${leaf}` };
   });
   type Staged = (typeof staged)[number];
+  // A name only one operation wanted is kept. A refined name that lands on it is refined again.
+  const wanted = new Map<string, number>();
+  for (const item of staged) wanted.set(item.name, (wanted.get(item.name) ?? 0) + 1);
+  const settled = new Set(staged.filter((item) => wanted.get(item.name) === 1));
   const refine = (rename: (item: Staged, bucket: readonly Staged[]) => string) => {
     const buckets = new Map<string, Staged[]>();
     for (const item of staged) buckets.set(item.name, [...(buckets.get(item.name) ?? []), item]);
     for (const bucket of buckets.values())
       if (bucket.length > 1) {
-        const names = bucket.map((item) => rename(item, bucket));
+        const names = bucket.map((item) => (settled.has(item) ? item.name : rename(item, bucket)));
         for (const [index, item] of bucket.entries()) item.name = names[index] ?? item.name;
       }
   };
diff --git a/packages/apps/src/implementation/openapi-request.ts b/packages/apps/src/implementation/openapi-request.ts
index 97ac1e6faa..c17f722637 100644
--- a/packages/apps/src/implementation/openapi-request.ts
+++ b/packages/apps/src/implementation/openapi-request.ts
@@ -1,7 +1,7 @@
 import { owned } from "@executor-js/telemetry";
 import { loadSwaggerClient } from "./swagger-client.ts";
 import { httpProviderError, accountProviderError, providerErrorDetail } from "./provider-error.ts";
-import { bodyUpstreamError } from "./upstream-error.ts";
+import { bodyUpstreamError, statedUpstream } from "./upstream-error.ts";
 import { NetworkRefused } from "../contracts/network.ts";
 import { failOnNetworkRefusal } from "./network.ts";
 import { ProviderError } from "../contracts/provider-error.ts";
@@ -162,8 +162,21 @@ function reservedPathValue(value: unknown): string {
  * A prefix check alone permits an empty item ID to reach a collection endpoint.
  * Reserved resource names may span segments; ordinary values must stay in one segment.
  */
+/**
+ * A declared path's route and its fixed query. A path Executor v1 imported can carry a query, such
+ * as `/search?type=items`, which is sent before the operation's own parameters, and a fragment,
+ * which is never sent.
+ */
+function declaredPath(path: string) {
+  const [declared = path] = path.split("#");
+  const at = declared.indexOf("?");
+  return at === -1
+    ? { route: declared, query: "" }
+    : { route: declared.slice(0, at), query: declared.slice(at + 1) };
+}
+
 function operationPath(op: OpenapiOperation): RegExp {
-  const template = op.baseUrl.replace(/\/$/, "") + op.path;
+  const template = op.baseUrl.replace(/\/$/, "") + declaredPath(op.path).route;
   // Keep real template parameters distinct from literal percent-encoded braces.
   let marker = "executorPathParameter";
   while (template.includes(marker)) marker += "_";
@@ -278,13 +291,21 @@ export function createRequest(config: {
             if (authorized === undefined)
               throw new Error("The selected account cannot call this tool");
             const parameters: Record<string, unknown> = {};
-            // Reserved path values are expanded before Swagger sees the operation.
-            let path = op.path;
+            // Reserved path values are expanded before Swagger sees the operation's route.
+            const declared = declaredPath(op.path);
+            let path = declared.route;
+            // A path parameter the fixed query names is filled in there too, as Executor v1 did.
+            let fixedQuery = declared.query;
             // Swagger has no `querystring` serializer, so the whole query string is added here.
             const querystrings: string[] = [];
             const swaggerParameters = op.request.parameters.filter((p) => {
               const group = args[p.in === "header" ? "headers" : p.in];
               const value = group === undefined ? undefined : object(group)[p.name];
+              if (p.in === "path" && value !== undefined && fixedQuery.includes(`{${p.name}}`))
+                fixedQuery = fixedQuery.replaceAll(
+                  `{${p.name}}`,
+                  encodeURIComponent(scalar(value)),
+                );
               if (p.in === "path" && p.allowReserved === true && p.content === undefined) {
                 if (value === undefined) throw new Error("A required path parameter is missing");
                 path = path.replaceAll(`{${p.name}}`, reservedPathValue(value));
@@ -352,8 +373,8 @@ export function createRequest(config: {
             if (pathname.split("/").some((segment) => /^(?:\.|%2e){1,2}$/i.test(segment)))
               throw new Error("This path value would change the request path");
             const url = new URL(prepared.url);
-            if (querystrings.length > 0)
-              url.search = [url.search.slice(1), ...querystrings]
+            if (fixedQuery !== "" || querystrings.length > 0)
+              url.search = [fixedQuery, url.search.slice(1), ...querystrings]
                 .filter((part) => part !== "")
                 .join("&");
             const origin = new URL(op.baseUrl).origin;
@@ -389,16 +410,29 @@ export function createRequest(config: {
         yield* failOnNetworkRefusal(response);
         if (response.status < 200 || response.status >= 300) {
           // Status and header evidence (401, 429, 5xx, rate-limit or scope headers) keeps its
-          // account recovery. A bare 403 proves nothing: a declared error body explains it, or
-          // the error the service stated in its body goes with the rejection.
+          // account recovery, with the error a declared body states as the service's own words:
+          // without it, an API that explains its 5xx, as Executor's own does, reads as a bare
+          // server error. A Bearer challenge's error is the service's words already, and takes
+          // precedence, so the body is not read for it. A bare 403 proves nothing: a declared
+          // error body explains it, or the error the service stated in its body goes with the
+          // rejection.
           const provider = httpProviderError(response.status, response.headers);
-          if (provider !== undefined && provider.reason !== "rejected") return yield* provider;
-          const json =
-            provider !== undefined || errors.some((error) => error.status === response.status)
-              ? yield* errorBody(response)
-              : undefined;
+          const declares = errors.some((error) => error.status === response.status);
+          if (
+            provider !== undefined &&
+            provider.reason !== "rejected" &&
+            (!declares || provider.upstream !== undefined)
+          )
+            return yield* provider;
+          const json = provider !== undefined || declares ? yield* errorBody(response) : undefined;
           const declared =
             json === undefined ? undefined : yield* responseError(response.status, json, errors);
+          if (provider !== undefined && provider.reason !== "rejected")
+            return yield* declared === undefined
+              ? provider
+              : providerErrorDetail(provider, {
+                  upstream: statedUpstream(declared.code, declared.message),
+                });
           const upstream = json === undefined ? undefined : bodyUpstreamError(json);
           return yield* (
             declared ??
diff --git a/packages/apps/src/implementation/openapi-source.ts b/packages/apps/src/implementation/openapi-source.ts
index 82b6ded179..442adf7fb9 100644
--- a/packages/apps/src/implementation/openapi-source.ts
+++ b/packages/apps/src/implementation/openapi-source.ts
@@ -1,5 +1,5 @@
 /** Revisioned OpenAPI sources. Calls read a manifest, one operation and only its schema dependencies. */
-import { Clock, Deferred, Effect, Option, Schema, Duration } from "effect";
+import { Clock, Deferred, Effect, Option, Result, Schema, Duration } from "effect";
 import { RouterMeta } from "../contracts/router.ts";
 import { parse as parseYamlStrictly } from "yaml";
 import { CORE_SCHEMA, load as loadYaml } from "js-yaml";
@@ -862,14 +862,20 @@ export const liveOpenapiRouter = (options: OpenapiSourceOptions): RouterDeclarat
   // Every operation, in the document's order, which the summaries keep.
   const operationsFor = (manifest: typeof Manifest.Type) =>
     Effect.gen(function* () {
-      const summaries = yield* summariesFor(manifest);
-      if (summaries === undefined) return undefined;
-      const buckets = yield* read(
-        manifest.revision,
-        "operations",
-        range(manifest.operations),
-        Bucket,
+      // Both read the manifest's revision, so they read together; the summaries' failure is
+      // reported first, as when the operations were read after them.
+      const [listed, stored] = yield* Effect.all(
+        [
+          Effect.result(summariesFor(manifest)),
+          Effect.result(read(manifest.revision, "operations", range(manifest.operations), Bucket)),
+        ],
+        { concurrency: "unbounded" },
       );
+      if (Result.isFailure(listed)) return yield* Effect.fail(listed.failure);
+      const summaries = listed.success;
+      if (summaries === undefined) return undefined;
+      if (Result.isFailure(stored)) return yield* Effect.fail(stored.failure);
+      const buckets = stored.success;
       const all: OpenapiOperation[] = [];
       for (const { name } of summaries) {
         const bucket = buckets[bucketOf(name, manifest.operations)];
@@ -923,6 +929,8 @@ export const liveOpenapiRouter = (options: OpenapiSourceOptions): RouterDeclarat
     name: operation.name,
     description: operation.description,
     readOnly: readOnly(operation),
+    // The app's `kinds`, or the HTTP method Executor sends.
+    kindConfirmed: true,
     ...(operation.tags === undefined ? {} : { tags: operation.tags }),
   });
   const describe = (
diff --git a/packages/apps/src/implementation/router-catalog.ts b/packages/apps/src/implementation/router-catalog.ts
index ced6562c2a..006ef4858c 100644
--- a/packages/apps/src/implementation/router-catalog.ts
+++ b/packages/apps/src/implementation/router-catalog.ts
@@ -12,7 +12,7 @@ import {
   type HostRouterError,
 } from "../contracts/host.ts";
 import type { AppOperation } from "../contracts/operations.ts";
-import type { AppRouter, DynamicRouter, RouterMeta } from "../contracts/router.ts";
+import type { AppNode, AppRouter, DynamicRouter, RouterMeta } from "../contracts/router.ts";
 import { skillFormatLimits, type AppSkillSource } from "../contracts/skills.ts";
 import {
   failureDetail,
@@ -20,6 +20,7 @@ import {
   parseMcpError,
   parseSkillLoadFailed,
 } from "./failure-detail.ts";
+import { PartialListing } from "./account-router.ts";
 import { parseProviderError } from "./provider-error.ts";
 import { joinPath, mergeMeta } from "./router.ts";
 import { skillFromFiles } from "./skill-files.ts";
@@ -131,6 +132,8 @@ const summaryFields = (
     description: operation.description ?? `${readOnly ? "Query" : "Mutate"} ${name}`,
     ...(operation.title === undefined ? {} : { title: operation.title }),
     readOnly,
+    // A declared operation's kind is the app's own, or its protocol's, such as an HTTP method.
+    kindConfirmed: true,
     annotations: { ...operation.annotations, readOnlyHint: readOnly },
   };
 };
@@ -225,6 +228,12 @@ const jsonTools = (
   );
 const DescribedTools = Schema.Array(ListedTool).pipe(Schema.refine(jsonTools));
 
+/** Tools and routers of a catalog, or of part of one, in router order. */
+interface Catalog {
+  readonly tools: ReadonlyArray<HostedTool | HostedToolSummary>;
+  readonly routers: ReadonlyArray<HostedRouter>;
+}
+
 export interface CatalogOptions {
   /** Omit schemas. */
   readonly summary: boolean;
@@ -253,19 +262,35 @@ const within = (wanted: ReadonlySet<string>, path: string) =>
  */
 export const readCatalog = (root: AppRouter | DynamicRouter | undefined, options: CatalogOptions) =>
   Effect.gen(function* () {
-    const tools: Array<HostedTool | HostedToolSummary> = [];
-    const routers: HostedRouter[] = [];
     const { wanted, secrets } = options;
-    /** One source's metadata and tools, named under `path`. `relative` limits a filtered read. */
+    /**
+     * A source's listing and, when it listed only some of its accounts' tools (`PartialListing`),
+     * the safe error of the accounts it could not list.
+     */
+    const listing = (read: () => Effect.Effect<readonly unknown[], unknown>) =>
+      sourced(
+        () =>
+          read().pipe(
+            Effect.map((tools) => ({ tools, error: undefined })),
+            Effect.catchIf(Schema.is(PartialListing), ({ tools, error }) =>
+              Effect.succeed({ tools, error: safeFailure(error, secrets) }),
+            ),
+          ),
+        secrets,
+      );
+    /**
+     * One source's metadata and tools, named under `path`, and the error of any of its accounts
+     * that could not list. `relative` limits a filtered read.
+     */
     const readSource = (source: DynamicRouter, path: string, relative?: readonly string[]) =>
       Effect.gen(function* () {
         const describe = source.describe;
         // Read together, so a source that keeps both in one cached manifest reads it once.
-        const [meta, listed] = yield* Effect.all(
+        const [meta, { tools: listed, error }] = yield* Effect.all(
           [
             routerMeta(source, secrets),
             options.summary && source.summaries !== undefined
-              ? sourced(source.summaries, secrets)
+              ? listing(source.summaries)
               : relative !== undefined && describe !== undefined
                 ? sourced(
                     () =>
@@ -273,8 +298,13 @@ export const readCatalog = (root: AppRouter | DynamicRouter | undefined, options
                         concurrency: "unbounded",
                       }),
                     secrets,
-                  ).pipe(Effect.map((tools) => tools.filter((tool) => tool !== undefined)))
-                : sourced(source.list, secrets),
+                  ).pipe(
+                    Effect.map((tools) => ({
+                      tools: tools.filter((tool) => tool !== undefined),
+                      error: undefined,
+                    })),
+                  )
+                : listing(source.list),
           ],
           { concurrency: "unbounded" },
         );
@@ -298,62 +328,88 @@ export const readCatalog = (root: AppRouter | DynamicRouter | undefined, options
             annotations: { ...tool.annotations, readOnlyHint: readOnly },
           });
         }
-        return { meta, found };
+        return { meta, found, error };
       });
     /**
      * Read a source into this catalog. The root is the whole app, so its failure fails the read,
      * as a single-source app did before routers. Elsewhere the failure is returned for the entry.
+     * A source that listed only some accounts keeps their tools and returns the others' error,
+     * at the root too.
      */
     const include = (source: DynamicRouter, path: string, relative?: readonly string[]) =>
       Effect.gen(function* () {
-        if (path === "") {
-          const { meta, found } = yield* readSource(source, path, relative);
-          tools.push(...found);
-          return { meta, error: undefined };
-        }
+        if (path === "") return yield* readSource(source, path, relative);
         const result = yield* Effect.result(readSource(source, path, relative));
-        if (Result.isFailure(result)) return { meta: source.overrides, error: result.failure };
-        tools.push(...result.success.found);
-        return { meta: result.success.meta, error: undefined };
+        if (Result.isFailure(result))
+          return { meta: source.overrides, found: [], error: result.failure };
+        return result.success;
       });
-    const visit = (node: AppRouter, path: string): Effect.Effect<void, HostRouterError> =>
+    const none: Catalog = { tools: [], routers: [] };
+    /** One child's tools and routers, named under its router's `path`. */
+    const child = (
+      node: AppNode,
+      name: string,
+      path: string,
+    ): Effect.Effect<Catalog, HostRouterError> =>
       Effect.gen(function* () {
-        if (path !== "" || (wanted === undefined && node.meta !== undefined))
-          routers.push(yield* entry(path, node.meta));
-        for (const [key, child] of Object.entries(node.children)) {
-          const name = joinPath(path, key);
-          switch (child.kind) {
-            case "query":
-            case "mutation":
-              if (options.scheduled === true && options.schedules(name).length === 0) break;
-              if (wanted === undefined || wanted.has(name))
-                tools.push(
-                  options.summary
-                    ? yield* operationSummary(name, path, child, options.schedules(name))
-                    : yield* operationDescription(name, path, child, options.schedules(name)),
-                );
-              break;
-            case "router":
-              if (wanted === undefined || within(wanted, name).length > 0)
-                yield* visit(child, name);
-              break;
-            case "dynamic": {
-              if (options.scheduled === true) break;
-              const relative = wanted === undefined ? undefined : within(wanted, name);
-              if (relative !== undefined && relative.length === 0) break;
-              const read = yield* include(child, name, relative);
-              routers.push(yield* entry(name, read.meta, read.error));
-            }
+        switch (node.kind) {
+          case "query":
+          case "mutation":
+            if (options.scheduled === true && options.schedules(name).length === 0) return none;
+            if (wanted !== undefined && !wanted.has(name)) return none;
+            return {
+              tools: [
+                options.summary
+                  ? yield* operationSummary(name, path, node, options.schedules(name))
+                  : yield* operationDescription(name, path, node, options.schedules(name)),
+              ],
+              routers: [],
+            };
+          case "router":
+            return wanted === undefined || within(wanted, name).length > 0
+              ? yield* visit(node, name)
+              : none;
+          case "dynamic": {
+            if (options.scheduled === true) return none;
+            const relative = wanted === undefined ? undefined : within(wanted, name);
+            if (relative !== undefined && relative.length === 0) return none;
+            const read = yield* include(node, name, relative);
+            return { tools: read.found, routers: [yield* entry(name, read.meta, read.error)] };
           }
         }
       });
-    if (root?.kind === "router") yield* visit(root, "");
-    else if (root?.kind === "dynamic" && options.scheduled !== true) {
+    /**
+     * A router's tools and routers. Its children are read together, so sibling sources load their
+     * catalogs at once; their entries still follow the router's key order.
+     */
+    const visit = (node: AppRouter, path: string): Effect.Effect<Catalog, HostRouterError> =>
+      Effect.gen(function* () {
+        const own =
+          path !== "" || (wanted === undefined && node.meta !== undefined)
+            ? [yield* entry(path, node.meta)]
+            : [];
+        const children = yield* Effect.forEach(
+          Object.entries(node.children),
+          ([key, value]) => child(value, joinPath(path, key), path),
+          { concurrency: "unbounded" },
+        );
+        return {
+          tools: children.flatMap((read) => read.tools),
+          routers: [...own, ...children.flatMap((read) => read.routers)],
+        };
+      });
+    if (root?.kind === "router") return yield* visit(root, "");
+    if (root?.kind === "dynamic" && options.scheduled !== true) {
       const read = yield* include(root, "", wanted === undefined ? undefined : [...wanted]);
-      if (wanted === undefined && read.meta !== undefined)
-        routers.push(yield* entry("", read.meta));
+      return {
+        tools: read.found,
+        routers:
+          wanted === undefined && (read.meta !== undefined || read.error !== undefined)
+            ? [yield* entry("", read.meta, read.error)]
+            : [],
+      };
     }
-    return { tools, routers };
+    return none;
   });
 
 /**
diff --git a/packages/apps/src/implementation/router.ts b/packages/apps/src/implementation/router.ts
index 59b6b30bf8..2b8259e969 100644
--- a/packages/apps/src/implementation/router.ts
+++ b/packages/apps/src/implementation/router.ts
@@ -116,7 +116,8 @@ const withOverrides = (overrides: RouterMeta | undefined) =>
 
 /**
  * Declare a router whose tools are discovered when read. `list` returns tools with names relative
- * to this router; mark queries with `readOnly: true`. `resolve` receives one of those names.
+ * to this router; mark queries with `readOnly: true`, and add `kindConfirmed: true` when your code,
+ * not an upstream service's claim, decides the kind. `resolve` receives one of those names.
  * The router carries the handler contexts of the operations `resolve` returns, so `defineApp`
  * checks them like a static router's.
  */
diff --git a/packages/apps/src/implementation/skills.ts b/packages/apps/src/implementation/skills.ts
index cc1764bd13..7ae956764d 100644
--- a/packages/apps/src/implementation/skills.ts
+++ b/packages/apps/src/implementation/skills.ts
@@ -1,5 +1,5 @@
 /** Remote skill readers return complete portable bundles, never installed host files. */
-import { Effect, Ref, Schema, Stream } from "effect";
+import { Effect, Ref, Result, Schema, Stream } from "effect";
 import { Base64, Hex } from "effect/encoding";
 import { FetchHttpClient, HttpBody, HttpClient } from "effect/http";
 import { skillFromFiles } from "./skill-files.ts";
@@ -431,11 +431,24 @@ const cachedCatalog = (
         summary: { schema: AppSkillMetadata, of: ({ files: _files, ...metadata }) => metadata },
         load: (context, kept) =>
           Effect.gen(function* () {
-            const source = yield* context === undefined
-              ? publication(options, options.cache)
-              : publication({ fetch: options.fetch, signal: context.signal }, context.cache);
+            // The check and the kept catalog's manifest are read together. The kept read decides
+            // nothing until the check succeeds with an identified publication.
+            const [checkedSource, keptCatalog] = yield* Effect.all(
+              [
+                Effect.result(
+                  context === undefined
+                    ? publication(options, options.cache)
+                    : publication({ fetch: options.fetch, signal: context.signal }, context.cache),
+                ),
+                Effect.result(kept ?? Effect.succeed(undefined)),
+              ],
+              { concurrency: "unbounded" },
+            );
+            if (Result.isFailure(checkedSource)) return yield* Effect.fail(checkedSource.failure);
+            const source = checkedSource.success;
             if (source.id === undefined) return { tools: yield* source.load };
-            const previous = kept === undefined ? undefined : yield* kept;
+            if (Result.isFailure(keptCatalog)) return yield* Effect.fail(keptCatalog.failure);
+            const previous = keptCatalog.success;
             const tools =
               previous?.header?.["publication"] === source.id
                 ? yield* previous.tools
diff --git a/packages/apps/src/implementation/ui-account-notice.ts b/packages/apps/src/implementation/ui-account-notice.ts
index b2f7183acb..9db2c4de09 100644
--- a/packages/apps/src/implementation/ui-account-notice.ts
+++ b/packages/apps/src/implementation/ui-account-notice.ts
@@ -25,7 +25,7 @@ export const accountProblemText = (problem: UiAccountProblem) => {
     case "incompatible":
       return `Linked account can't be used as the ${problem.provider} account`;
     case "credentials_rejected":
-      return `${problem.account} (${problem.provider}): sign-in rejected at last check`;
+      return `${problem.account} (${problem.provider}): credentials not working at last check`;
     case "forbidden":
       return `${problem.account} (${problem.provider}): missing permission at last check`;
     case "upstream_unavailable":
diff --git a/packages/apps/src/implementation/ui-serving.ts b/packages/apps/src/implementation/ui-serving.ts
index ef2ad38e5f..0b547fd8df 100644
--- a/packages/apps/src/implementation/ui-serving.ts
+++ b/packages/apps/src/implementation/ui-serving.ts
@@ -19,17 +19,15 @@ import {
 import { appPrivateHeaders } from "./ui-auth.ts";
 import { versionDocument } from "./ui-document.ts";
 import { appFailureBootstrap } from "./ui-errors.ts";
+import { appWatchSource } from "./browser-scripts.gen.ts";
 
 /**
- * Render an authorized version with a host-owned version watcher. Account problems that stop
- * the app replace its document with a page that links to their fix; others add a dismissible card.
+ * The version's public file a page path names, or a 404 for a missing file. `None` means the path
+ * is the page itself. Hosts answer files before the page's account and usage work, which a file
+ * needs none of.
  */
-export const appDocument = <E, R>(options: {
-  readonly version: string;
-  /** The account IDs the page runs with, by requirement. */
-  readonly accountIds?: Readonly<Record<string, readonly string[]>> | undefined;
+export const appFile = <E, R>(options: {
   readonly origin: string;
-  readonly accounts?: UiAccountNotice | undefined;
   readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
 }) =>
   Effect.gen(function* () {
@@ -44,15 +42,33 @@ export const appDocument = <E, R>(options: {
         ? undefined
         : yield* options.asset(path);
     if (file !== undefined && "body" in file)
-      return HttpServerResponse.uint8Array(file.body, {
-        contentType: file.contentType,
-        headers: appPrivateHeaders,
-      });
+      return Option.some(
+        HttpServerResponse.uint8Array(file.body, {
+          contentType: file.contentType,
+          headers: appPrivateHeaders,
+        }),
+      );
     // The page's origin serves the active version, so the same URL can change content on the
     // next activation: browsers revalidate against the content hash.
-    if (file !== undefined) return yield* storedFile(file, "private, no-cache");
+    if (file !== undefined) return Option.some(yield* storedFile(file, "private, no-cache"));
     if (pathname.includes(".") && pathname !== "/index.html")
-      return HttpServerResponse.empty({ status: 404 });
+      return Option.some(HttpServerResponse.empty({ status: 404 }));
+    return Option.none();
+  });
+
+/**
+ * Render an authorized version with a host-owned version watcher, for a path `appFile` left to
+ * the page. Account problems that stop the app replace its document with a page that links to
+ * their fix; others add a dismissible card.
+ */
+export const appDocument = <E, R>(options: {
+  readonly version: string;
+  /** The account IDs the page runs with, by requirement. */
+  readonly accountIds?: Readonly<Record<string, readonly string[]>> | undefined;
+  readonly accounts?: UiAccountNotice | undefined;
+  readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
+}) =>
+  Effect.gen(function* () {
     const notice = options.accounts;
     if (notice?.problems.some(accountProblemBlocks))
       return HttpServerResponse.text(accountBlockedPage(notice), {
@@ -78,7 +94,9 @@ export const appDocument = <E, R>(options: {
       telemetry === undefined
         ? ""
         : `<meta name="executor-build" content="${attribute(telemetry.version)}"><meta name="executor-environment" content="${attribute(telemetry.environment)}">`;
-    const boot = `${metadata}<script type="application/json" id="executor-context">${context}</script>${appFailureBootstrap}${notice === undefined || notice.problems.length === 0 ? "" : accountNoticeBootstrap(notice)}<script src="/_executor/watch.js" defer></script>`;
+    // The watcher is inline so a page costs no extra request. An inline module runs after
+    // parsing, as the deferred file it replaces did.
+    const boot = `${metadata}<script type="application/json" id="executor-context">${context}</script>${appFailureBootstrap}${notice === undefined || notice.problems.length === 0 ? "" : accountNoticeBootstrap(notice)}<script type="module">${appWatchSource}</script>`;
     return HttpServerResponse.text(
       versionDocument(new TextDecoder().decode(document.body), options.version).replace(
         "<!--executor-ui-->",
diff --git a/packages/apps/src/implementation/ui-watch.ts b/packages/apps/src/implementation/ui-watch.ts
deleted file mode 100644
index ed9abd10ee..0000000000
--- a/packages/apps/src/implementation/ui-watch.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-import { appWatchSource } from "./browser-scripts.gen.ts";
-
-/** Dependency-free browser source served by each host after app authorization. */
-export const appWatchScript = appWatchSource;
diff --git a/packages/apps/src/implementation/upstream-error.ts b/packages/apps/src/implementation/upstream-error.ts
index c2469dfbe7..dd2679240d 100644
--- a/packages/apps/src/implementation/upstream-error.ts
+++ b/packages/apps/src/implementation/upstream-error.ts
@@ -25,18 +25,26 @@ const OAuthError = Schema.Struct({
 /**
  * A stated message is bounded where it is read, before the invocation's account secrets are known,
  * so a cut can split a secret. Leaving the bundle replaces the part of one a shortened message
- * ends with; see `isShortenedUpstream`.
+ * ends with; see `isShortenedStated`.
  */
-const bounded = (message: string) =>
-  message.length <= maxUpstreamMessageLength
-    ? message
-    : `${message.slice(0, maxUpstreamMessageLength - 1)}…`;
+export const boundStated = (text: string, maximum: number) =>
+  text.length <= maximum ? text : `${text.slice(0, maximum - 1)}…`;
 
-/** Whether `bounded` shortened this message, so it may end partway through a secret. */
+/** Whether `boundStated` shortened this text, so it may end partway through a secret. */
+export const isShortenedStated = (text: string, maximum: number) =>
+  text.length === maximum && text.endsWith("…");
+
+const bounded = (message: string) => boundStated(message, maxUpstreamMessageLength);
+
+/** Whether a stated message was shortened where it was read. */
 export const isShortenedUpstream = (message: string) =>
-  message.length === maxUpstreamMessageLength && message.endsWith("…");
+  isShortenedStated(message, maxUpstreamMessageLength);
 
-const stated = (code: number | string, message: string | undefined): UpstreamError => ({
+/** A service's stated error code and message, the message bounded. */
+export const statedUpstream = (
+  code: number | string,
+  message: string | undefined,
+): UpstreamError => ({
   code,
   ...(message === undefined || message === "" ? {} : { message: bounded(message) }),
 });
@@ -44,9 +52,10 @@ const stated = (code: number | string, message: string | undefined): UpstreamErr
 /** The error a JSON error body states, if it uses a nested error object or OAuth's format. */
 export const bodyUpstreamError = (json: unknown): UpstreamError | undefined => {
   const nested = Schema.decodeUnknownOption(NestedError)(json);
-  if (Option.isSome(nested)) return stated(nested.value.error.code, nested.value.error.message);
+  if (Option.isSome(nested))
+    return statedUpstream(nested.value.error.code, nested.value.error.message);
   const oauth = Schema.decodeUnknownOption(OAuthError)(json);
-  if (Option.isSome(oauth)) return stated(oauth.value.error, oauth.value.error_description);
+  if (Option.isSome(oauth)) return statedUpstream(oauth.value.error, oauth.value.error_description);
   return undefined;
 };
 
@@ -62,5 +71,7 @@ export const challengeUpstreamError = (header: string | undefined): UpstreamErro
     if (name !== undefined && !params.has(name.toLowerCase()))
       params.set(name.toLowerCase(), quoted?.replace(/\\(.)/g, "$1") ?? token ?? "");
   const code = Schema.decodeUnknownOption(ErrorToken)(params.get("error"));
-  return Option.isNone(code) ? undefined : stated(code.value, params.get("error_description"));
+  return Option.isNone(code)
+    ? undefined
+    : statedUpstream(code.value, params.get("error_description"));
 };
diff --git a/packages/apps/src/implementation/workflow-rpc.ts b/packages/apps/src/implementation/workflow-rpc.ts
index e3c1bb1b99..92da498234 100644
--- a/packages/apps/src/implementation/workflow-rpc.ts
+++ b/packages/apps/src/implementation/workflow-rpc.ts
@@ -78,41 +78,74 @@ export const isolatedWorkflowExecution = (
   };
 };
 
+/**
+ * Why a control call has no answer: Executor did not reply, or this framework could not read the
+ * reply. Either way a start or terminate may have taken effect, so neither is reported as a failure
+ * to repeat.
+ */
+type Operation = "start" | "get" | "list" | "terminate";
+const unanswered = (
+  { operation, key }: { readonly operation: Operation; readonly key?: string | undefined },
+  unread: boolean,
+) => {
+  const cause = unread
+    ? `This app's apps release could not read Executor's reply to ctx.workflows.${operation}; redeploy the app on the current apps release.`
+    : `Executor did not answer ctx.workflows.${operation}.`;
+  switch (operation) {
+    case "start":
+      return new WorkflowFailure({
+        reason: "engine",
+        retryable: false,
+        message:
+          key === undefined
+            ? `${cause} The run may have started. This start had no key, so check ctx.workflows.list before starting again: another start creates another run.`
+            : `${cause} The run may have started. Start it again with the same key and input, which returns the run if it exists, or check ctx.workflows.list before starting another.`,
+      });
+    case "terminate":
+      return new WorkflowFailure({
+        reason: "engine",
+        retryable: false,
+        message: `${cause} The run may have stopped. Read it with ctx.workflows.get before terminating it again.`,
+      });
+    default:
+      return new WorkflowFailure({
+        reason: "engine",
+        retryable: !unread,
+        message: unread ? cause : `${cause} Try again.`,
+      });
+  }
+};
+
 /** Reconstruct app-scoped controls from one invocation-owned RPC function. */
 export const isolatedWorkflowControls = (
   deliver: (input: unknown) => Promise<unknown>,
 ): WorkflowHostControls => {
-  const request = (input: unknown) =>
+  const request = <A>(
+    input: { readonly operation: Operation; readonly key?: string | undefined },
+    schema: Schema.Decoder<A>,
+  ) =>
     // oxlint-disable-next-line executor/authored-code-through-adapter -- the host's workflow RPC
     Effect.tryPromise({
       try: () => deliver(input),
-      catch: () => new WorkflowFailure({ reason: "engine", retryable: true }),
+      catch: () => unanswered(input, false),
     }).pipe(
-      Effect.flatMap(Schema.decodeUnknownEffect(WorkflowRpcResult)),
-      Effect.mapError(() => new WorkflowFailure({ reason: "engine", retryable: true })),
-      Effect.flatMap((result) =>
-        result.ok ? Effect.succeed(result.value) : Effect.fail(result.error),
-      ),
-    );
-  const run = (input: unknown) =>
-    request(input).pipe(
-      Effect.flatMap((value) =>
-        Schema.decodeUnknownEffect(WorkflowRun)(value).pipe(
-          Effect.mapError(() => new WorkflowFailure({ reason: "engine", retryable: true })),
+      Effect.flatMap((reply) =>
+        Schema.decodeUnknownEffect(WorkflowRpcResult)(reply).pipe(
+          Effect.mapError(() => unanswered(input, true)),
         ),
       ),
+      Effect.flatMap((result) =>
+        result.ok
+          ? Schema.decodeUnknownEffect(schema)(result.value).pipe(
+              Effect.mapError(() => unanswered(input, true)),
+            )
+          : Effect.fail(result.error),
+      ),
     );
   return {
-    start: (input) => run({ operation: "start", ...input }),
-    get: (input) => run({ operation: "get", ...input }),
-    terminate: (input) => run({ operation: "terminate", ...input }),
-    list: (input) =>
-      request({ operation: "list", ...input }).pipe(
-        Effect.flatMap((value) =>
-          Schema.decodeUnknownEffect(WorkflowRunPage)(value).pipe(
-            Effect.mapError(() => new WorkflowFailure({ reason: "engine", retryable: true })),
-          ),
-        ),
-      ),
+    start: (input) => request({ operation: "start", ...input }, WorkflowRun),
+    get: (input) => request({ operation: "get", ...input }, WorkflowRun),
+    terminate: (input) => request({ operation: "terminate", ...input }, WorkflowRun),
+    list: (input) => request({ operation: "list", ...input }, WorkflowRunPage),
   };
 };
diff --git a/packages/apps/src/openapi.ts b/packages/apps/src/openapi.ts
index 50043a54c7..80fd3dfe85 100644
--- a/packages/apps/src/openapi.ts
+++ b/packages/apps/src/openapi.ts
@@ -1,8 +1,10 @@
 /** OpenAPI helpers over normalized operation metadata; no optional dependency is needed. */
 import { protocolRouter, type OperationKinds } from "./implementation/protocol-operations.ts";
-import { Effect } from "effect";
+import { Effect, Schema } from "effect";
 import type { OpenapiToolsOptions } from "./contracts/openapi.ts";
+import { JsonObject } from "./contracts/schema.ts";
 import { openapiToolsEffect } from "./implementation/openapi.ts";
+import { compiledOperationNames } from "./implementation/openapi-compile.ts";
 export {
   OpenapiError,
   isOpenapiTextMedia,
@@ -34,6 +36,34 @@ export * from "./contracts/openapi-compile.ts";
  * operationId, first tag, method and path alone. It reads no document and compiles nothing.
  */
 export { planOperationNames, type OperationNameInput } from "./implementation/openapi-names.ts";
+
+/** One operation a document declares, as `openapiOperationNames` lists it. */
+export interface OpenapiDeclaredOperation {
+  /** The tool name `liveOpenapiRouter` gives the operation. */
+  readonly name: string;
+  /** The HTTP method, such as `GET`. */
+  readonly method: string;
+  /** The path as the document declares it. */
+  readonly path: string;
+}
+
+/**
+ * Every operation a document declares, in document order, with the name `liveOpenapiRouter` gives
+ * it, whether or not the router can import it. Unlike `planOperationNames`, it reads the document
+ * as the router does, references included. It rejects with `OpenapiCompileError` when the
+ * document is not one the router reads. The document is not modified.
+ */
+export const openapiOperationNames = (
+  document: Readonly<Record<string, unknown>>,
+): Promise<readonly OpenapiDeclaredOperation[]> =>
+  Effect.runPromise(
+    Effect.suspend(() =>
+      compiledOperationNames(
+        // A copy the reader can own, as a tree.
+        Schema.decodeUnknownSync(JsonObject)(JSON.parse(JSON.stringify(document))),
+      ),
+    ),
+  );
 export {
   liveOpenapiRouter,
   openapiToolNames,
diff --git a/packages/apps/src/ui-serving.ts b/packages/apps/src/ui-serving.ts
index 588b7b64c1..48e982703d 100644
--- a/packages/apps/src/ui-serving.ts
+++ b/packages/apps/src/ui-serving.ts
@@ -1,3 +1,8 @@
 /** Host-only rendering utilities; the host supplies authorized retained assets. */
-export { appDocument, appAsset, assetPath, storedAppFile } from "./implementation/ui-serving.ts";
-export { appWatchScript } from "./implementation/ui-watch.ts";
+export {
+  appDocument,
+  appAsset,
+  appFile,
+  assetPath,
+  storedAppFile,
+} from "./implementation/ui-serving.ts";
diff --git a/packages/catalog/src/contracts/imports.ts b/packages/catalog/src/contracts/imports.ts
index 15db664282..f7e4cfbb62 100644
--- a/packages/catalog/src/contracts/imports.ts
+++ b/packages/catalog/src/contracts/imports.ts
@@ -1,6 +1,6 @@
 /** Custom imports retain public configuration; credentials are connected after deploying. */
 import { Schema } from "effect";
-import { HttpUrl } from "@executor-js/sdk";
+import { AppName, HttpUrl } from "@executor-js/sdk";
 
 /** Credential-free URL syntax; the product decides which network destinations are allowed. */
 export const ImportUrl = HttpUrl.check(
@@ -18,7 +18,7 @@ export const ImportUrl = HttpUrl.check(
  */
 export const CustomAppInput = Schema.Struct({
   kind: Schema.Literal("mcp"),
-  name: Schema.NonEmptyString,
+  name: AppName,
   url: ImportUrl,
 });
 export type CustomAppInput = typeof CustomAppInput.Type;
diff --git a/packages/dashboard-start/src/implementation/batch-host.ts b/packages/dashboard-start/src/implementation/batch-host.ts
index 7cba0b2310..ae7e5d2c4d 100644
--- a/packages/dashboard-start/src/implementation/batch-host.ts
+++ b/packages/dashboard-start/src/implementation/batch-host.ts
@@ -146,6 +146,18 @@ const answerOf = (read: BatchRead, response: HttpServerResponse.HttpServerRespon
   );
 };
 
+/**
+ * The read's span records the status it answered. The batch request itself answers 200 whatever
+ * its reads answer, so a server error fails the read's own span; a refusal (4xx) is the endpoint's
+ * answer, not a failure.
+ */
+const recordAnswer = ({ status }: BatchAnswer) =>
+  Effect.annotateCurrentSpan(
+    status >= 500
+      ? { "http.response.status_code": status, "executor.outcome": "failed" }
+      : { "http.response.status_code": status },
+  );
+
 /**
  * Run one read through its endpoint's route, under the batch request's identity. Like a request
  * of its own, the read has its own scope, so request-scoped resources such as its database client
@@ -172,6 +184,7 @@ const answer = (
         Effect.map(HttpServerError.causeResponse(cause), ([response]) => response),
       ),
       Effect.flatMap((response) => answerOf(read, response)),
+      Effect.tap(recordAnswer),
       Effect.withSpan("dashboard.batch.read", {
         attributes: {
           "http.route": target.route.path,
diff --git a/packages/fumadb-effect/src/implementation/sql/query.ts b/packages/fumadb-effect/src/implementation/sql/query.ts
index fddcbe3746..bb264195ec 100644
--- a/packages/fumadb-effect/src/implementation/sql/query.ts
+++ b/packages/fumadb-effect/src/implementation/sql/query.ts
@@ -68,6 +68,20 @@ const computedSelect = (
 /** Join fragments with a single space, without adding parentheses. */
 const spaced = Statement.join(" ", false, "");
 
+/**
+ * Label a query's statements with the FumaDB operation and table that ran them. The operation
+ * has no span of its own: each statement's `sql.execute` span already covers its interval, so a
+ * wrapper span would only repeat it. A nested operation, such as an upsert's read back, labels
+ * its own statements.
+ */
+const operation =
+  (name: string) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>, table: AnyTable): Effect.Effect<A, E, R> =>
+    Effect.annotateSpans(effect, {
+      "fumadb.operation": name,
+      "db.collection.name": table.names.sql,
+    });
+
 /** `NULL`, absent, or `Option.none()`: a join value that can never match a row. */
 const isAbsentKey = (value: unknown): boolean =>
   value === null || value === undefined || (Option.isOption(value) && Option.isNone(value));
@@ -561,27 +575,29 @@ export const makeSqlOrmAdapter = (
   const findManyImpl: (
     table: AnyTable,
     options: CompiledFindOptions,
-  ) => Effect.Effect<Array<Row>, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.findMany")(
-    function* (table: AnyTable, options: CompiledFindOptions) {
-      return yield* findRows(table, options);
-    },
-  );
+  ) => Effect.Effect<Array<Row>, OrmError, SqlClient> = Effect.fnUntraced(function* (
+    table: AnyTable,
+    options: CompiledFindOptions,
+  ) {
+    return yield* findRows(table, options);
+  }, operation("findMany"));
 
-  // One span per call: a nested findMany span would repeat this one's interval.
+  // Reads through findRows, not findMany, so its statements are labelled findFirst.
   const findFirstImpl: (
     table: AnyTable,
     options: CompiledFindOptions,
-  ) => Effect.Effect<Row | null, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.findFirst")(
-    function* (table: AnyTable, options: CompiledFindOptions) {
-      const records = yield* findRows(table, { ...options, limit: 1 });
-      return records[0] ?? null;
-    },
-  );
+  ) => Effect.Effect<Row | null, OrmError, SqlClient> = Effect.fnUntraced(function* (
+    table: AnyTable,
+    options: CompiledFindOptions,
+  ) {
+    const records = yield* findRows(table, { ...options, limit: 1 });
+    return records[0] ?? null;
+  }, operation("findFirst"));
 
   const countImpl: (
     table: AnyTable,
     options: { readonly where: Condition | undefined },
-  ) => Effect.Effect<number, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.count")(function* (
+  ) => Effect.Effect<number, OrmError, SqlClient> = Effect.fnUntraced(function* (
     table: AnyTable,
     options: { readonly where: Condition | undefined },
   ) {
@@ -601,7 +617,7 @@ export const makeSqlOrmAdapter = (
       });
     }
     return count;
-  });
+  }, operation("count"));
 
   /** Read one row back by its id, for providers or statements without a returning clause. */
   const selectById: (
@@ -694,7 +710,7 @@ export const makeSqlOrmAdapter = (
   };
 
   const createImpl: (table: AnyTable, values: Row) => Effect.Effect<Row, OrmError, SqlClient> =
-    Effect.fn("FumaDB.SqlQuery.create")(function* (table: AnyTable, values: Row) {
+    Effect.fnUntraced(function* (table: AnyTable, values: Row) {
       const sql = yield* SqlClient;
       const prepared = yield* prepareValues(table, values, true);
 
@@ -733,62 +749,62 @@ export const makeSqlOrmAdapter = (
         });
       }
       return row;
-    });
+    }, operation("create"));
 
   const createManyImpl: (
     table: AnyTable,
     values: ReadonlyArray<Row>,
-  ) => Effect.Effect<Array<{ readonly _id: unknown }>, OrmError, SqlClient> = Effect.fn(
-    "FumaDB.SqlQuery.createMany",
-  )(function* (table: AnyTable, values: ReadonlyArray<Row>) {
-    if (values.length === 0) return [];
-    const sql = yield* SqlClient;
-    const prepared = yield* Effect.forEach(values, (value) => prepareValues(table, value, true));
-    const encoded = prepared.map((item) => item.encoded);
-    // One INSERT per parameter budget; several chunks run in one transaction so the batch stays atomic.
-    const columnCount = Math.max(1, Object.keys(table.columns).length);
-    const rowsPerStatement = Math.max(1, Math.floor(parameterBudget(provider) / columnCount));
-    const chunks = chunk(encoded, rowsPerStatement);
-    const insertAll = Effect.forEach(
-      chunks,
-      (rows) => sql`INSERT INTO ${sql(table.names.sql)} ${insertFragment(sql, rows, undefined)}`,
-      { discard: true },
-    );
-    yield* chunks.length > 1 ? sql.withTransaction(insertAll) : insertAll;
-    const idName = table.getIdColumn().names.sql;
-    return encoded.map((row) => ({ _id: row[idName] }));
-  });
+  ) => Effect.Effect<Array<{ readonly _id: unknown }>, OrmError, SqlClient> = Effect.fnUntraced(
+    function* (table: AnyTable, values: ReadonlyArray<Row>) {
+      if (values.length === 0) return [];
+      const sql = yield* SqlClient;
+      const prepared = yield* Effect.forEach(values, (value) => prepareValues(table, value, true));
+      const encoded = prepared.map((item) => item.encoded);
+      // One INSERT per parameter budget; several chunks run in one transaction so the batch stays atomic.
+      const columnCount = Math.max(1, Object.keys(table.columns).length);
+      const rowsPerStatement = Math.max(1, Math.floor(parameterBudget(provider) / columnCount));
+      const chunks = chunk(encoded, rowsPerStatement);
+      const insertAll = Effect.forEach(
+        chunks,
+        (rows) => sql`INSERT INTO ${sql(table.names.sql)} ${insertFragment(sql, rows, undefined)}`,
+        { discard: true },
+      );
+      yield* chunks.length > 1 ? sql.withTransaction(insertAll) : insertAll;
+      const idName = table.getIdColumn().names.sql;
+      return encoded.map((row) => ({ _id: row[idName] }));
+    },
+    operation("createMany"),
+  );
 
   const updateManyImpl: (
     table: AnyTable,
     options: { readonly where: Condition | undefined; readonly set: Row },
-  ) => Effect.Effect<void, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.updateMany")(
-    function* (
-      table: AnyTable,
-      options: { readonly where: Condition | undefined; readonly set: Row },
-    ) {
-      const sql = yield* SqlClient;
-      const prepared = yield* prepareValues(table, options.set, false);
-      if (Object.keys(prepared.encoded).length === 0) return;
-      const parts: Array<Statement.Fragment> = [
-        sql`UPDATE ${sql(table.names.sql)} SET ${assignments(sql, prepared.encoded)}`,
-      ];
-      if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
-      yield* sql`${spaced(parts)}`;
-    },
-  );
+  ) => Effect.Effect<void, OrmError, SqlClient> = Effect.fnUntraced(function* (
+    table: AnyTable,
+    options: { readonly where: Condition | undefined; readonly set: Row },
+  ) {
+    const sql = yield* SqlClient;
+    const prepared = yield* prepareValues(table, options.set, false);
+    if (Object.keys(prepared.encoded).length === 0) return;
+    const parts: Array<Statement.Fragment> = [
+      sql`UPDATE ${sql(table.names.sql)} SET ${assignments(sql, prepared.encoded)}`,
+    ];
+    if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
+    yield* sql`${spaced(parts)}`;
+  }, operation("updateMany"));
 
   const deleteManyImpl: (
     table: AnyTable,
     options: { readonly where: Condition | undefined },
-  ) => Effect.Effect<void, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.deleteMany")(
-    function* (table: AnyTable, options: { readonly where: Condition | undefined }) {
-      const sql = yield* SqlClient;
-      const parts: Array<Statement.Fragment> = [sql`DELETE FROM ${sql(table.names.sql)}`];
-      if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
-      yield* sql`${spaced(parts)}`;
-    },
-  );
+  ) => Effect.Effect<void, OrmError, SqlClient> = Effect.fnUntraced(function* (
+    table: AnyTable,
+    options: { readonly where: Condition | undefined },
+  ) {
+    const sql = yield* SqlClient;
+    const parts: Array<Statement.Fragment> = [sql`DELETE FROM ${sql(table.names.sql)}`];
+    if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
+    yield* sql`${spaced(parts)}`;
+  }, operation("deleteMany"));
 
   /** Update the row with this id, returning it when `returning` is set. */
   const updateById: (
@@ -840,78 +856,79 @@ export const makeSqlOrmAdapter = (
   const upsertImpl: (
     table: AnyTable,
     options: CompiledUpsert,
-  ) => Effect.Effect<Row | undefined, OrmError, SqlClient> = Effect.fn("FumaDB.SqlQuery.upsert")(
-    function* (table: AnyTable, options: CompiledUpsert) {
-      const sql = yield* SqlClient;
-      const idColumn = table.getIdColumn();
-      const prepared = yield* prepareValues(table, options.update, false);
-
-      // Equality on the supplied primary key has an exact conflict target. Let the
-      // database arbitrate concurrent inserts instead of racing a read then create.
-      const condition = options.where;
-      if (
-        (provider === "postgresql" || provider === "cockroachdb" || provider === "sqlite") &&
-        condition !== undefined &&
-        Condition.$is("Compare")(condition) &&
-        condition.column.isId &&
-        condition.operator === "=" &&
-        !isAbsentKey(condition.value) &&
-        Equal.equals(condition.value, options.create[idColumn.ormName])
-      ) {
-        const created = yield* prepareValues(table, options.create, true);
-        const conflict =
-          Object.keys(prepared.encoded).length === 0
-            ? sql`DO NOTHING`
-            : sql`DO UPDATE SET ${sql.update(prepared.encoded)}`;
-        const statement = sql`INSERT INTO ${sql(table.names.sql)} ${insertFragment(sql, [created.encoded], undefined)} ON CONFLICT (${sql(idColumn.names.sql)}) ${conflict}`;
-        if (!options.returning) {
-          yield* statement;
-          return undefined;
-        }
-        const rows = yield* sql<RawRow>`${statement} RETURNING ${returningList(sql, table)}`;
-        const row = rows[0];
-        return row === undefined
-          ? yield* selectById(table, condition.value)
-          : yield* Effect.fromResult(decodeResult(row, table));
-      }
+  ) => Effect.Effect<Row | undefined, OrmError, SqlClient> = Effect.fnUntraced(function* (
+    table: AnyTable,
+    options: CompiledUpsert,
+  ) {
+    const sql = yield* SqlClient;
+    const idColumn = table.getIdColumn();
+    const prepared = yield* prepareValues(table, options.update, false);
 
-      // MSSQL has no row count on `.raw`, so the update reports itself through
-      // `OUTPUT INSERTED`: one round trip when a row already exists.
-      if (provider === "mssql" && Object.keys(prepared.encoded).length > 0) {
-        const output = options.returning
-          ? outputList(sql, table)
-          : sql`${sql(`INSERTED.${idColumn.names.sql}`)} AS ${sql(idColumn.ormName)}`;
-        const parts: Array<Statement.Fragment> = [
-          sql`UPDATE TOP (1) ${sql(table.names.sql)} SET ${assignments(sql, prepared.encoded)} OUTPUT ${output}`,
-        ];
-        if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
-        const rows = yield* sql<RawRow>`${spaced(parts)}`;
-        const row = rows[0];
-        if (row !== undefined)
-          return options.returning ? yield* Effect.fromResult(decodeResult(row, table)) : undefined;
-        if (options.returning) return yield* createImpl(table, options.create);
-        yield* createManyImpl(table, [options.create]);
+    // Equality on the supplied primary key has an exact conflict target. Let the
+    // database arbitrate concurrent inserts instead of racing a read then create.
+    const condition = options.where;
+    if (
+      (provider === "postgresql" || provider === "cockroachdb" || provider === "sqlite") &&
+      condition !== undefined &&
+      Condition.$is("Compare")(condition) &&
+      condition.column.isId &&
+      condition.operator === "=" &&
+      !isAbsentKey(condition.value) &&
+      Equal.equals(condition.value, options.create[idColumn.ormName])
+    ) {
+      const created = yield* prepareValues(table, options.create, true);
+      const conflict =
+        Object.keys(prepared.encoded).length === 0
+          ? sql`DO NOTHING`
+          : sql`DO UPDATE SET ${sql.update(prepared.encoded)}`;
+      const statement = sql`INSERT INTO ${sql(table.names.sql)} ${insertFragment(sql, [created.encoded], undefined)} ON CONFLICT (${sql(idColumn.names.sql)}) ${conflict}`;
+      if (!options.returning) {
+        yield* statement;
         return undefined;
       }
+      const rows = yield* sql<RawRow>`${statement} RETURNING ${returningList(sql, table)}`;
+      const row = rows[0];
+      return row === undefined
+        ? yield* selectById(table, condition.value)
+        : yield* Effect.fromResult(decodeResult(row, table));
+    }
 
-      const existing = yield* findManyImpl(table, {
-        select: [idColumn.ormName],
-        computed: [],
-        where: options.where,
-        orderBy: undefined,
-        join: undefined,
-        limit: 1,
-        offset: undefined,
-      });
-      const found = existing[0];
-      if (found === undefined) {
-        if (options.returning) return yield* createImpl(table, options.create);
-        yield* createManyImpl(table, [options.create]);
-        return undefined;
-      }
-      return yield* updateById(table, found[idColumn.ormName], options.update, options.returning);
-    },
-  );
+    // MSSQL has no row count on `.raw`, so the update reports itself through
+    // `OUTPUT INSERTED`: one round trip when a row already exists.
+    if (provider === "mssql" && Object.keys(prepared.encoded).length > 0) {
+      const output = options.returning
+        ? outputList(sql, table)
+        : sql`${sql(`INSERTED.${idColumn.names.sql}`)} AS ${sql(idColumn.ormName)}`;
+      const parts: Array<Statement.Fragment> = [
+        sql`UPDATE TOP (1) ${sql(table.names.sql)} SET ${assignments(sql, prepared.encoded)} OUTPUT ${output}`,
+      ];
+      if (options.where !== undefined) parts.push(yield* whereClause(sql, options.where));
+      const rows = yield* sql<RawRow>`${spaced(parts)}`;
+      const row = rows[0];
+      if (row !== undefined)
+        return options.returning ? yield* Effect.fromResult(decodeResult(row, table)) : undefined;
+      if (options.returning) return yield* createImpl(table, options.create);
+      yield* createManyImpl(table, [options.create]);
+      return undefined;
+    }
+
+    const existing = yield* findManyImpl(table, {
+      select: [idColumn.ormName],
+      computed: [],
+      where: options.where,
+      orderBy: undefined,
+      join: undefined,
+      limit: 1,
+      offset: undefined,
+    });
+    const found = existing[0];
+    if (found === undefined) {
+      if (options.returning) return yield* createImpl(table, options.create);
+      yield* createManyImpl(table, [options.create]);
+      return undefined;
+    }
+    return yield* updateById(table, found[idColumn.ormName], options.update, options.returning);
+  }, operation("upsert"));
 
   return {
     tables: schema.tables,
diff --git a/packages/mcp-auth/src/implementation/backend.ts b/packages/mcp-auth/src/implementation/backend.ts
index 826b1e2e84..d8cc6f27a2 100644
--- a/packages/mcp-auth/src/implementation/backend.ts
+++ b/packages/mcp-auth/src/implementation/backend.ts
@@ -84,15 +84,12 @@ export const restrictMcpBackend = <E extends Error, G extends Error>(
   ): GrantRefusal | undefined =>
     appRefusal(policy, app) ??
     (permitsAccounts(policy, app, ids) ? undefined : targetRefusal(app, ids));
+  const appCheck = (policy: AuthorizationPolicy, app: AppId, accounts: AppAccounts | undefined) => {
+    const ids = named(accounts);
+    return refuse(ids.length === 0 ? appRefusal(policy, app) : accountsRefusal(policy, app, ids));
+  };
   const checkApp = (app: AppId, accounts: AppAccounts | undefined) =>
-    authority.pipe(
-      Effect.flatMap((policy) => {
-        const ids = named(accounts);
-        return refuse(
-          ids.length === 0 ? appRefusal(policy, app) : accountsRefusal(policy, app, ids),
-        );
-      }),
-    );
+    authority.pipe(Effect.flatMap((policy) => appCheck(policy, app, accounts)));
   /** The page's tools and routers this policy lets the caller discover. */
   const permittedPage = (policy: AuthorizationPolicy, app: AppId, page: ToolPage): ToolPage => ({
     ...page,
@@ -339,9 +336,9 @@ export const restrictMcpBackend = <E extends Error, G extends Error>(
       }),
     searchableTools: (input, options) =>
       Effect.gen(function* () {
-        yield* checkApp(input.app, input.accounts);
-        const searchable = yield* backend.searchableTools(input, options);
         const policy = yield* authority;
+        yield* appCheck(policy, input.app, input.accounts);
+        const searchable = yield* backend.searchableTools(input, options);
         // The listing names the accounts the host resolved; one entry must permit all of them.
         yield* refuse(accountsRefusal(policy, input.app, named(searchable.accounts)));
         // Failed routers list no tools, so the grant decides them without the catalog.
diff --git a/packages/mcp/src/contracts/browser-tools.ts b/packages/mcp/src/contracts/browser-tools.ts
index 8aea8d54b5..5609b403de 100644
--- a/packages/mcp/src/contracts/browser-tools.ts
+++ b/packages/mcp/src/contracts/browser-tools.ts
@@ -30,7 +30,7 @@ export const BrowserResumeInput = Schema.Struct({ requestId: AdvertisedInteracti
 /** Execute with browser-based delivery of every pending interaction. */
 export const BrowserExecuteTool = McpTool.make("execute", {
   description:
-    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's executor skill with the skills tool. Never ask the user for secrets in chat; accounts connect through Executor's secure links. If approval-required or input-required is returned, show the user approvalUrl and call resume with requestId only; the user answers in their browser. Never submit the decision yourself or rerun the program to continue it. Earlier effects are not rolled back. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
+    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's entry skill with skills({app:'executor',name:'executor'}). Never ask the user for secrets in chat; accounts connect through Executor's secure links. If approval-required or input-required is returned, show the user approvalUrl and call resume with requestId only; the user answers in their browser. Never submit the decision yourself or rerun the program to continue it. Earlier effects are not rolled back. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
   dependencies: [HttpServerRequest.HttpServerRequest],
   parameters: ExecuteInput,
   success: BrowserExecutionResult,
diff --git a/packages/mcp/src/contracts/execute.ts b/packages/mcp/src/contracts/execute.ts
index 6a4268d57f..296e44a557 100644
--- a/packages/mcp/src/contracts/execute.ts
+++ b/packages/mcp/src/contracts/execute.ts
@@ -5,7 +5,6 @@ import { HttpServerRequest } from "effect/http";
 import { McpSchema, Tool as McpTool } from "effect/ai";
 import { ApiErrorResponse, ElicitationResponse } from "apps/contracts";
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
-import { ToolName } from "@executor-js/sdk/core";
 import {
   AdvertisedInteractionId,
   InteractionId,
@@ -30,7 +29,7 @@ export const McpRuntimeLimits = Schema.Struct({
   discoveryIdleMs: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export type McpRuntimeLimits = typeof McpRuntimeLimits.Type;
-/** Existing runtime defaults; execution time, output and call budgets remain in McpLimits. */
+/** Existing runtime defaults; execution time and call budgets remain in McpLimits. */
 export const defaultMcpRuntimeLimits = McpRuntimeLimits.make({
   maxCodeChars: 65_536,
   maxExecutions: 64,
@@ -83,31 +82,6 @@ export const AppDiscoveryTimedOut = UserFacingError.define({
   }),
 });
 
-/**
- * A call that needs approval made a request larger than the output budget, measured on what its
- * delivery sends: the whole request as an execute result, or only the prompt a native client
- * shows. Executor never offers it and cancels the saved call, so no one is asked to approve a call
- * whose request did not reach them and it can never run. App code asks for approval after it has
- * run, so the copy says what Executor did with the call, never that the tool did not run.
- */
-export const ApprovalTooLarge = UserFacingError.define({
-  tag: "ApprovalTooLarge",
-  status: 413,
-  fields: { tool: ToolName, bytes: Schema.Int, limit: Schema.Int },
-  recorded: ({ bytes, limit }) =>
-    `Approval request of ${bytes} bytes is over the ${limit}-byte limit`,
-  presentation: ({ tool, bytes, limit }) => ({
-    title: "Approval request too large",
-    description: `The approval request for “${tool}” is ${bytes} bytes, over the ${limit}-byte limit for an approval request, so Executor did not ask for approval and will not run the call.`,
-    recovery: {
-      action:
-        "Make the arguments smaller, for example by passing large content as a URL or an uploaded file, then call the tool again.",
-      instructions: `An approval request carries the call's arguments and must fit in ${limit} bytes of JSON; this one is ${bytes}. Calling it again with the same arguments fails the same way, and changing unrelated arguments does not help. Pass large content by reference instead of inline: a URL, an upload or file ID the tool accepts, or several smaller calls if the tool supports that. Code that ran before approval was requested, in this tool or earlier in the program, may already have made changes; check current state with a safe read before calling again.`,
-    },
-  }),
-});
-export type ApprovalTooLarge = typeof ApprovalTooLarge.Type;
-
 /**
  * Executor will not run an approved call, for a reason only its own state establishes. App code
  * asks for approval after it has already run, so the copy says what Executor did with the saved
@@ -208,15 +182,27 @@ export type ApprovalUnavailable = typeof ApprovalUnavailable.Type;
 
 /**
  * Why a resume found no request it could answer. Executor's own record of the request decides it;
- * a request issued to another caller is indistinguishable from an unknown one.
+ * a request issued to another caller is indistinguishable from an unknown one. `answered`,
+ * `expired` and `ended` are recorded ends. `lost`: Executor recorded issuing it to this caller and
+ * it is no longer waiting, but no end is recorded. Most often the host holding its program
+ * restarted, but a failed write can also leave the end out, so `lost` never shows that the request
+ * went unanswered or what its program did. `malformed`: the ID is not in the
+ * form Executor issues. `not-found`: Executor keeps no record of it for this caller, which does not
+ * show that it was never issued: a record can be missing after a restart, pruning or a storage
+ * failure.
  */
 export const ResumeUnavailableReason = Schema.Literals([
   "answered",
   "expired",
   "ended",
+  "lost",
+  "malformed",
   "not-found",
 ]);
 export type ResumeUnavailableReason = typeof ResumeUnavailableReason.Type;
+/** The IDs Executor issues: SDK approvals and live tool questions, each a prefix and a UUID. */
+export const issuedInteractionId =
+  /^(apr|elc)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 /** The guidance a resume returns with each reason. */
 export const resumeUnavailableMessage = (reason: ResumeUnavailableReason): string => {
   const check =
@@ -228,10 +214,43 @@ export const resumeUnavailableMessage = (reason: ResumeUnavailableReason): strin
       return `This request expired before it was answered, so Executor will not resume its program. ${check}`;
     case "ended":
       return `The program that asked this ended before it was answered: it was cancelled, timed out, or stopped. Executor will not resume it. ${check}`;
+    case "lost":
+      return "Executor recorded issuing this request to this caller, but it is no longer waiting for an answer and Executor has no retained record of an answer or of how it ended, so it cannot continue and resuming again will not help. Most often the Executor host holding its program restarted, which loses the program; a record of how it ended can also be missing when Executor failed to store it. Executor cannot confirm what happened: the request may have been answered, and an earlier approved call, or code a tool ran before asking, may have completed and made changes. Never repeat the call or program automatically. Check current state with a safe read, tell the user what you found, and repeat a call that may change something only if the user explicitly decides to.";
+    case "malformed":
+      return `This requestId is not one Executor issues: request IDs are apr_ or elc_ followed by a UUID, so it was probably shortened, redacted or mistyped. Resume with the exact requestId from the approval-required or input-required result; pending lists this caller's open requests. ${check}`;
     case "not-found":
-      return `Executor has no pending request with this ID for this caller. It may belong to another grant, scoped connection or approval mode; it may have ended or been answered long enough ago that Executor no longer remembers it; or it was lost when Executor restarted. In model mode, a new MCP session on the same grant can still answer its requests. ${check}`;
+      return `Executor has no retained record of this request for this caller, so it cannot say whether it was issued or what became of it. It may belong to another user, grant, scoped connection or approval mode, or the ID may be mistyped. A record can also be missing after Executor restarted, after it pruned old requests, or when its storage was unavailable. pending lists this caller's open requests. In model mode, a new MCP session on the same grant can still answer its requests. ${check}`;
   }
 };
+/** One of the caller's open requests, listed when a resume names one it cannot answer. */
+export const OpenInteraction = Schema.Struct({
+  requestId: InteractionId,
+  status: Schema.Literals(["approval-required", "input-required"]),
+  app: Schema.String,
+  tool: Schema.String,
+  expiresAt: Schema.Number,
+});
+export type OpenInteraction = typeof OpenInteraction.Type;
+/** Why an issued request stopped being pending without the program losing it. */
+export type InteractionEnd = Extract<ResumeUnavailableReason, "answered" | "expired" | "ended">;
+/** What a host remembers of a request it issued. */
+export interface IssuedInteraction {
+  readonly caller: string;
+  readonly expiresAt: number;
+  readonly end?: InteractionEnd;
+}
+/**
+ * The host's record of the requests it issued, kept beyond its memory. Programs live in memory,
+ * so after a restart only this record tells a late resume that its request expired, was answered,
+ * or was lost with its program. Calls are synchronous: each is one step that no other request can
+ * interleave. A failure to record an issue leaves it unknown (`not-found`), as without a store; a
+ * failure to record an end leaves the issue without one (`lost`).
+ */
+export interface InteractionRecords {
+  readonly issued: (id: InteractionId, caller: string, expiresAt: number) => void;
+  readonly ended: (id: InteractionId, end: InteractionEnd) => void;
+  readonly read: (id: InteractionId) => IssuedInteraction | undefined;
+}
 
 /** Generated code is bounded before it reaches the parser. */
 export const ExecuteInput = Schema.Struct({
@@ -249,7 +268,9 @@ export const UnavailableApp = Schema.Struct({
   router: Schema.optionalKey(Schema.String),
 });
 /**
- * One admitted tool call in call order. `interrupted` calls were still running when the
+ * One admitted tool call in call order. `failure` calls threw, or returned a result that says the
+ * tool failed, such as a remote MCP tool's `isError: true`; the program received that result
+ * whole. A failed call may still have had effects. `interrupted` calls were still running when the
  * execution ended; the upstream may or may not have applied them. `awaiting-approval` calls
  * were still waiting for approval when the execution ended; Executor did not resume the saved
  * call, though the tool may have had effects before it asked.
@@ -266,9 +287,24 @@ export type McpToolCall = typeof McpToolCall.Type;
  * does not guarantee success, and correcting the input, configuration or access may allow a new
  * attempt even when it is false.
  */
+/**
+ * Which part of Executor's work on an app a failure stopped, as Executor observed it: loading the
+ * app's definition (`evaluate`), listing its tools (`discover`) or running one (`call`). Only
+ * Executor's own code sets it; a phase the app reports stays in the message as its account.
+ */
+export const McpFailurePhase = Schema.Literals(["evaluate", "discover", "call"]);
+export type McpFailurePhase = typeof McpFailurePhase.Type;
+/**
+ * The trace ID of the request that met a failure: the one Executor's tracer created, or continued
+ * from the MCP client's `traceparent`, never one an app chose. The request's spans and error
+ * reports carry it, so a user can share it to find the failure.
+ */
+export const FailureReference = Schema.String.check(Schema.isPattern(/^[0-9a-f]{32}$/u));
 export const McpErrorResponse = Schema.Struct({
   ...ApiErrorResponse.fields,
   retryable: Schema.Boolean,
+  phase: Schema.optionalKey(McpFailurePhase),
+  reference: Schema.optionalKey(FailureReference),
 });
 export type McpErrorResponse = typeof McpErrorResponse.Type;
 /** Program result plus apps that could not expose a live catalog during this execution. */
@@ -294,6 +330,8 @@ export const ExecutionOutcome = Schema.Union([
     requestId: InteractionId,
     reason: ResumeUnavailableReason,
     message: Schema.String,
+    /** The caller's other open requests, which it can still resume. */
+    pending: Schema.Array(OpenInteraction),
   }),
   Schema.Struct({ status: Schema.Literal("busy"), requestId: InteractionId }),
   Schema.Struct({ status: Schema.Literal("capacity-exceeded") }),
@@ -313,15 +351,15 @@ export const ResumeToolInput = Schema.Struct({
 });
 /**
  * Claude Code saves a text result over 50,000 characters to a file unless the tool raises that
- * threshold. Execution results are already bounded by the output budget, so ask it to show them
- * inline up to its 500,000-character ceiling.
+ * threshold. Ask it to show execution results inline up to its 500,000-character ceiling; a larger
+ * result still reaches it whole, saved to a file.
  */
 export const ExecutionResultMeta = { "anthropic/maxResultSizeChars": 500_000 };
 
 /** Continue an existing program after the agent has obtained the user's decision. Never restarts source. */
 export const ResumeTool = McpTool.make("resume", {
   description:
-    "Continue a paused execute program using its pending requestId and the user's MCP elicitation response: {action: 'accept', content: {...}}, {action: 'decline'}, or {action: 'cancel'}. Ask the user before approving. Return the user's form fields in content on accept. Returns the next pending interaction or the completed program result. An approved call that fails reports its own error. Unavailable carries a reason (answered, expired, ended or not-found) and what to do; do not rerun the whole program because earlier calls may have completed. Busy means another resume is advancing this program; wait for that response. Results are not replayed.",
+    "Continue a paused execute program using its pending requestId and the user's MCP elicitation response: {action: 'accept', content: {...}}, {action: 'decline'}, or {action: 'cancel'}. Ask the user before approving. Return the user's form fields in content on accept. Returns the next pending interaction or the completed program result. An approved call that fails reports its own error. Unavailable carries a reason (answered, expired, ended, lost, malformed or not-found), what to do and the caller's open requests in pending; do not rerun the whole program because earlier calls may have completed. Busy means another resume is advancing this program; wait for that response. Results are not replayed.",
   dependencies: [HttpServerRequest.HttpServerRequest],
   parameters: ResumeToolInput,
   success: McpExecutionResult,
@@ -462,32 +500,27 @@ export class CatalogUnavailable extends Schema.TaggedError<CatalogUnavailable>()
   "CatalogUnavailable",
   { message: Schema.String },
 ) {}
-/** Server-controlled execution budgets; clients cannot override them. */
+/**
+ * Server-controlled execution budgets; clients cannot override them. Executor sets no limit on the
+ * size of a result: `execute` and `call` return the whole value, or fail with the platform's error.
+ */
 export const McpLimits = Schema.Struct({
   timeoutMs: Schema.Int.check(Schema.isGreaterThan(0)),
   maxToolCalls: Schema.Int.check(Schema.isGreaterThan(0)),
-  maxOutputBytes: Schema.Int.check(Schema.isGreaterThan(0)),
 });
 export type McpLimits = typeof McpLimits.Type;
-/**
- * Default interpreter budgets; each product may supply different limits. The output budget is
- * about Claude Code's default 25,000-token MCP result limit.
- */
+/** Default interpreter budgets; each product may supply different limits. */
 export const defaultMcpLimits: McpLimits = {
   timeoutMs: 5 * 60_000,
   maxToolCalls: 100,
-  maxOutputBytes: 100_000,
 };
-/**
- * UTF-8 bytes of JSON one search page may hold: a quarter of the execute output budget, so a
- * program can return a page beside other data without the result being truncated.
- */
-export const searchPageBytes = (limits: McpLimits) => Math.floor(limits.maxOutputBytes / 4);
+/** UTF-8 bytes of JSON one search page may hold; `next` continues past it. */
+export const searchPageBytes = 25_000;
 
 /** Execute programs over the host-provided app catalog. */
 export const ExecuteTool = McpTool.make("execute", {
   description:
-    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's executor skill with the skills tool. Never ask the user for secrets in chat; accounts connect through Executor's secure links. If approval-required or input-required is returned, show it to the user and call resume with their answer; never run the program's source again. External effects are not rolled back on error or cancellation. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
+    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's entry skill with skills({app:'executor',name:'executor'}). Never ask the user for secrets in chat; accounts connect through Executor's secure links. If approval-required or input-required is returned, show it to the user and call resume with their answer; never run the program's source again. External effects are not rolled back on error or cancellation. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
   dependencies: [HttpServerRequest.HttpServerRequest],
   parameters: ExecuteInput,
   success: McpExecutionResult,
@@ -497,7 +530,7 @@ export const ExecuteTool = McpTool.make("execute", {
 /** Native-mode execution obtains policy decisions through server-initiated MCP requests. */
 export const NativeExecuteTool = McpTool.make("execute", {
   description:
-    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's executor skill with the skills tool. Never ask the user for secrets in chat; accounts connect through Executor's secure links. Approvals and tool input open the MCP client's own prompt, and execute continues the same program. Earlier tool calls may already have completed and are not rolled back; never rerun the program automatically after an error. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
+    "Run a JavaScript program over Executor apps, for work where one result feeds another call or a large result should be filtered before it reaches you; for one or a few independent calls, use call instead. Find tools with the search tool or tools.search inside the program, and full signatures with describe or tools.search.describe({ paths }). First read the Executor app's entry skill with skills({app:'executor',name:'executor'}). Never ask the user for secrets in chat; accounts connect through Executor's secure links. Approvals and tool input open the MCP client's own prompt, and execute continues the same program. Earlier tool calls may already have completed and are not rolled back; never rerun the program automatically after an error. Send feedback with the Executor app's feedback.submit tool when Executor gets in your way or something works especially well.",
   dependencies: [HttpServerRequest.HttpServerRequest, McpSchema.McpRequestContext],
   parameters: ExecuteInput,
   success: McpExecutionResult,
@@ -532,7 +565,7 @@ export const DescribeTool = McpTool.make("describe", {
 
 /** Shared by every delivery mode; each appends how pending interactions are answered. */
 export const callDescription =
-  "Call Executor app tools directly by exact path from search. Pass one {path, input} as calls, or an array of independent calls to run them concurrently; results come back in the same order, each with ok and its value or error. Use execute instead when one call's output feeds another, or to filter a large result before it reaches you. Results over the output limit are refused, not cut. Never ask the user for secrets in chat; accounts connect through Executor's secure links.";
+  "Call Executor app tools directly by exact path from search. Pass one {path, input} as calls, or an array of independent calls to run them concurrently; results come back in the same order, each with ok and its value or error. Use execute instead when one call's output feeds another, or to filter a large result before it reaches you. Never ask the user for secrets in chat; accounts connect through Executor's secure links.";
 /** Call tools without a program. Pending interactions return as from execute. */
 export const CallTool = McpTool.make("call", {
   description: `${callDescription} If approval-required or input-required is returned, show it to the user and call resume with their answer; never repeat the call to continue it.`,
diff --git a/packages/mcp/src/contracts/skills.ts b/packages/mcp/src/contracts/skills.ts
index 88749dcdcd..157bbc4d10 100644
--- a/packages/mcp/src/contracts/skills.ts
+++ b/packages/mcp/src/contracts/skills.ts
@@ -9,51 +9,93 @@ import {
   SourceFilePath,
   SkillRevision,
 } from "@executor-js/sdk/core";
-import { Schema } from "effect";
+import { type JsonSchema, Schema } from "effect";
 import { Tool as McpTool } from "effect/ai";
 import { RecordedMessage } from "@executor-js/utils/recorded-message";
 import { UnavailableApp } from "./execute.ts";
 
-const absent = Schema.optionalKey(Schema.Never);
-const version = Schema.optionalKey(VersionId);
 /**
- * Reads no longer choose accounts. The key is still read so a caller that sets it gets
- * `AccountChoiceUnsupported`, presented as a {@link SkillAccessFailed} with its code and status,
- * rather than having it ignored.
+ * The keys each key needs: everything but a full listing names an app, and a reference file
+ * names its skill. `{}` lists every skill, `{app}` one app's and `{app, name}` reads one.
+ */
+const needs = {
+  name: ["app"],
+  file: ["app", "name"],
+  version: ["app"],
+  revision: ["app"],
+  accounts: ["app"],
+} as const satisfies Record<string, ReadonlyArray<"app" | "name">>;
+const missing = (input: object) =>
+  Object.entries(needs).flatMap(([key, required]) =>
+    Object.hasOwn(input, key)
+      ? required.filter((need) => !Object.hasOwn(input, need)).map((need) => ({ key, need }))
+      : [],
+  );
+/**
+ * The read shapes as one struct whose key dependencies are a check, because MCP clients need an
+ * object-root input schema. The check emits them as `dependentRequired`, so the tool's advertised
+ * input schema ({@link SkillsInputJsonSchema}) and its decoding come from this one value.
  */
-const accounts = Schema.optionalKey(
-  Schema.Unknown.annotate({
-    description:
-      "Not supported: skills are read with the accounts linked to the app. Setting it fails.",
-  }),
-);
-const selection = { revision: Schema.optionalKey(SkillRevision), accounts };
-const SkillSelection = Schema.Union([
-  Schema.Struct({
-    app: absent,
-    name: absent,
-    file: absent,
-    version: absent,
-    revision: absent,
-    accounts: absent,
-  }),
-  Schema.Struct({ app: AppSlug, name: absent, file: absent, version: version, ...selection }),
-  Schema.Struct({
-    app: AppSlug,
-    ...selection,
-    name: AppSkillName,
-    file: Schema.optionalKey(SourceFilePath),
-    version: version,
-  }),
-]);
-/** MCP needs an object-root wire schema; decoding enforces list/document/reference combinations. */
 export const SkillsInput = Schema.Struct({
   app: Schema.optionalKey(AppSlug),
   name: Schema.optionalKey(AppSkillName),
   file: Schema.optionalKey(SourceFilePath),
-  version: version,
-  ...selection,
-}).pipe(Schema.decodeTo(SkillSelection));
+  version: Schema.optionalKey(VersionId),
+  revision: Schema.optionalKey(SkillRevision),
+  /**
+   * Reads no longer choose accounts. The key is still read so a caller that sets it gets
+   * `AccountChoiceUnsupported`, presented as a {@link SkillAccessFailed} with its code and status,
+   * rather than having it ignored.
+   */
+  accounts: Schema.optionalKey(
+    Schema.Unknown.annotate({
+      description:
+        "Not supported: skills are read with the accounts linked to the app. Setting it fails.",
+    }),
+  ),
+}).check(
+  Schema.makeFilter(
+    (input) =>
+      missing(input).map(({ key, need }) => ({
+        path: [need],
+        issue:
+          need === "app"
+            ? `${key} needs app, the slug of the app that ships the skill. Read the Executor app's entry skill with {app: "executor", name: "executor"}; {} lists every visible skill with its app.`
+            : `${key} needs name, the skill whose file it reads, as in {app: "executor", name: "app-authoring", file: "deploy.md"}.`,
+      })),
+    {
+      expected: "{} to list skills, {app} to list one app's skills or {app, name} to read one",
+      toJsonSchema: () => ({ dependentRequired: needs }),
+    },
+  ),
+);
+/**
+ * {@link SkillsInput} as JSON Schema. Effect puts the check's keywords in a top-level `allOf`
+ * member, and model APIs reject top-level combinators in tool input schemas, so its members move
+ * to the root. They hold only `dependentRequired`, which the root does not have.
+ */
+const { allOf, ...root } = McpTool.getJsonSchemaFromSchema(SkillsInput);
+export const SkillsInputJsonSchema: JsonSchema.JsonSchema = Object.assign(
+  root,
+  ...(Array.isArray(allOf) ? allOf : []),
+);
+/**
+ * The input is not one of the read shapes {@link SkillsInputJsonSchema} advertises. The handler
+ * decodes it, because the tool advertises raw JSON Schema; the text matches the one Effect's
+ * toolkit gives every other tool's invalid input.
+ */
+export class SkillsInputInvalid extends Schema.TaggedError<SkillsInputInvalid>()(
+  "SkillsInputInvalid",
+  { reason: Schema.String },
+) {
+  override get message() {
+    return `Invalid parameters for tool 'skills': ${this.reason}`;
+  }
+  // The reason can quote the caller's input.
+  get [RecordedMessage]() {
+    return "The skills input is not a read shape the tool accepts";
+  }
+}
 /** Every summary identifies the installed app and source version, without returning its body. */
 export const SkillSummary = Schema.Struct({
   ...AppSkillMetadata.fields,
@@ -133,14 +175,18 @@ export const SkillsFailure = Schema.Union([
   SkillAppNotFound,
   SkillAppSlugAmbiguous,
   SkillAccountRequired,
+  SkillsInputInvalid,
 ]);
 export type SkillsFailure = typeof SkillsFailure.Type;
 
-/** List summaries first, then read documents/references on demand through app evaluation. */
-export const SkillsTool = McpTool.make("skills", {
+/**
+ * List summaries first, then read documents/references on demand through app evaluation. The
+ * handler decodes its input with {@link SkillsInput}, which this schema is generated from.
+ */
+export const SkillsTool = McpTool.dynamic("skills", {
   description:
-    "Read instructions that apps ship. Start with the Executor app's executor skill: {app:'executor',name:'executor'}, using the slug {} returns if the app was renamed. {} lists visible skills; {app:'support-inbox'} lists one app's skills; {app:'support-inbox',name:'triage'} reads SKILL.md. Pass the returned version and revision with a listed file to read a reference. App slugs are the namespaces used in search, call and execute. Skill text and allowed-tools metadata never grant tool permissions.",
-  parameters: SkillsInput,
+    "Read instructions that apps ship. Every input except {} needs app, the app's slug. Start with the Executor app's entry skill: {app:'executor',name:'executor'}; if that app was renamed, use the slug {} lists for it. {} lists every visible skill; {app:'executor'} lists one app's skills; {app:'executor',name:'code-mode'} reads that skill's SKILL.md. Pass the returned version and revision with a listed file to read a reference. App slugs are the namespaces used in search, call and execute. Skill text and allowed-tools metadata never grant tool permissions.",
+  parameters: SkillsInputJsonSchema,
   success: SkillsResult,
   failure: SkillsFailure,
 })
diff --git a/packages/mcp/src/contracts/telemetry.ts b/packages/mcp/src/contracts/telemetry.ts
new file mode 100644
index 0000000000..a70734b9ab
--- /dev/null
+++ b/packages/mcp/src/contracts/telemetry.ts
@@ -0,0 +1,14 @@
+/** What the host says about a request for the MCP operation spans to record. */
+import { Context } from "effect";
+
+/**
+ * Opaque IDs naming whom the current MCP request runs for, such as a hosted organization's ID and
+ * the caller's user ID. A host provides them around its request handler, and each MCP operation
+ * span records them from its start, so a failed operation still names them. A program keeps the
+ * ones of the request that started it. Only bounded opaque IDs belong here: never a name, an
+ * email, a slug or anything the caller sent. Hosts with nothing to name provide none.
+ */
+export const McpRequestAttributes = Context.Reference<Readonly<Record<string, string>>>(
+  "@executor-js/mcp/McpRequestAttributes",
+  { defaultValue: () => ({}) },
+);
diff --git a/packages/mcp/src/contracts/tools.ts b/packages/mcp/src/contracts/tools.ts
index 1d89a29bef..5067a3c2f6 100644
--- a/packages/mcp/src/contracts/tools.ts
+++ b/packages/mcp/src/contracts/tools.ts
@@ -15,6 +15,7 @@ import {
   SearchTool,
   type McpLimits,
   type ExecutionRejected,
+  type InteractionRecords,
 } from "./execute.ts";
 import { SkillsTool, type SkillDocument } from "./skills.ts";
 
@@ -72,4 +73,10 @@ export interface McpOptions {
    * one, a restart forgets every session and clients initialize again.
    */
   readonly sessions?: (mode: ElicitationMode) => McpServer.SessionStore;
+  /**
+   * Keeps a record of the requests the host issued beyond its memory, so a resume after a restart
+   * says whether its request expired, was answered or was lost with its program. Without one, a
+   * restart forgets them and a late resume reads as `not-found`.
+   */
+  readonly interactions?: InteractionRecords;
 }
diff --git a/packages/mcp/src/implementation/diagnostics.ts b/packages/mcp/src/implementation/diagnostics.ts
index 04fe27d6a7..b2d6d12b0e 100644
--- a/packages/mcp/src/implementation/diagnostics.ts
+++ b/packages/mcp/src/implementation/diagnostics.ts
@@ -1,11 +1,25 @@
 import { Cause, Effect, ErrorReporter, Option, Schema, SchemaAST } from "effect";
 import { HttpServerResponse } from "effect/http";
 import { McpSchema } from "effect/ai";
-import { CallFailure, callFailurePresentation, ToolCallFailed } from "@executor-js/sdk/core";
+import {
+  AppEvaluationFailed,
+  CallFailure,
+  callFailurePresentation,
+  hostObservedEvaluation,
+  ToolCallFailed,
+  ToolListingTimedOut,
+  ToolSearchStale,
+  ToolSearchUnavailable,
+} from "@executor-js/sdk/core";
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import { maxApiErrorInstructionsLength, maxApiErrorMessageLength } from "apps/contracts";
 import type { CodeMode } from "@opencode-ai/codemode";
-import { McpErrorResponse } from "../contracts/execute.ts";
+import {
+  AppDiscoveryTimedOut,
+  FailureReference,
+  McpErrorResponse,
+  type McpFailurePhase,
+} from "../contracts/execute.ts";
 
 const encodeResponse = Schema.encodeSync(Schema.fromJsonString(McpErrorResponse));
 
@@ -46,6 +60,54 @@ const presentation = (error: Error): Option.Option<McpErrorResponse> => {
     retryable: presented.retryable ?? false,
   });
 };
+/**
+ * Where a failure reached the agent: whether Executor was listing an app's tools or calling one,
+ * and the trace of the request that met it.
+ */
+export interface FailureSite {
+  readonly operation: "discover" | "call";
+  readonly reference: string | undefined;
+}
+/**
+ * The current request's trace ID, the reference of each failure it meets. The host's tracer
+ * creates it or continues the client's, so nothing an app returns can set or change it.
+ */
+export const failureReference: Effect.Effect<string | undefined> = Effect.option(
+  Effect.currentSpan,
+).pipe(
+  Effect.map((span) =>
+    Option.isSome(span) && Schema.is(FailureReference)(span.value.traceId)
+      ? span.value.traceId
+      : undefined,
+  ),
+);
+/**
+ * The phase a failure stopped, from what Executor itself observed: what it was doing when it met
+ * the failure, `evaluate` only when its own code found the app's definition could not load, and
+ * `discover` for its own listing deadlines. The app's code can raise any other failure, including
+ * one that names a phase or says the definition failed, so the phase an app reports stays in
+ * the message as the app's account and never chooses this one.
+ */
+const phaseOf = (error: Error, operation: FailureSite["operation"]): McpFailurePhase => {
+  if (Schema.is(AppEvaluationFailed)(error) && hostObservedEvaluation(error)) return "evaluate";
+  if (
+    Schema.is(ToolListingTimedOut)(error) ||
+    Schema.is(AppDiscoveryTimedOut)(error) ||
+    Schema.is(ToolSearchUnavailable)(error) ||
+    Schema.is(ToolSearchStale)(error)
+  )
+    return "discover";
+  return operation;
+};
+/** A product error's presentation with the phase it stopped and its request's reference. */
+const located = (error: Error, site: FailureSite): Option.Option<McpErrorResponse> =>
+  presentation(error).pipe(
+    Option.map((response) => ({
+      ...response,
+      phase: phaseOf(error, site.operation),
+      ...(site.reference === undefined ? {} : { reference: site.reference }),
+    })),
+  );
 const identifier = (error: Error) => {
   const schema = error.constructor;
   return Schema.isSchema(schema) ? (SchemaAST.resolveIdentifier(schema.ast) ?? "Error") : "Error";
@@ -59,21 +121,33 @@ export const reportFailure = (error: Error): Effect.Effect<void> =>
   ErrorReporter.report(Cause.fail(error));
 /**
  * One line for agents: code, status, message, the declared recovery action and whether repeating
- * the same call unchanged may help. A corrected call is a new call whatever this says.
+ * the same call unchanged may help, then the phase the failure stopped and the reference a user
+ * can share to find it. A corrected call is a new call whatever this says.
  */
-const summary = ({ code, status, message, recovery, retryable }: McpErrorResponse) =>
-  `${code} (HTTP ${status}): ${message}${recovery === undefined ? "" : ` Recovery: ${recovery.action}`} Retryable (unchanged call): ${retryable ? "yes" : "no"}.`;
+const summary = ({
+  code,
+  status,
+  message,
+  recovery,
+  retryable,
+  phase,
+  reference,
+}: McpErrorResponse) =>
+  `${code} (HTTP ${status}): ${message}${recovery === undefined ? "" : ` Recovery: ${recovery.action}`} Retryable (unchanged call): ${retryable ? "yes" : "no"}.${phase === undefined ? "" : ` Phase: ${phase}.`}${reference === undefined ? "" : ` Reference: ${reference}.`}`;
 
 /**
  * Preserve bounded, curated framework recovery as JSON, which a program can read from a caught
  * tool error; unknown errors expose only their schema identifier.
  */
-export const diagnostic = (error: Error): string =>
-  Option.match(presentation(error), { onSome: encodeResponse, onNone: () => identifier(error) });
+export const diagnostic = (error: Error, site: FailureSite): string =>
+  Option.match(located(error, site), {
+    onSome: encodeResponse,
+    onNone: () => identifier(error),
+  });
 
 /** The same presentation as a single readable line, for failures agents read but never parse. */
-export const diagnosticSummary = (error: Error): string =>
-  Option.match(presentation(error), { onSome: summary, onNone: () => identifier(error) });
+export const diagnosticSummary = (error: Error, site: FailureSite): string =>
+  Option.match(located(error, site), { onSome: summary, onNone: () => identifier(error) });
 
 /**
  * Refuse an MCP HTTP request before protocol dispatch. Clients print the response body after
diff --git a/packages/mcp/src/implementation/events.ts b/packages/mcp/src/implementation/events.ts
index ecf29a8feb..b625831ffb 100644
--- a/packages/mcp/src/implementation/events.ts
+++ b/packages/mcp/src/implementation/events.ts
@@ -7,6 +7,7 @@ import { Effect, Match, Predicate, Redacted, Schema } from "effect";
 import { McpSchema, type McpServer } from "effect/ai";
 import { EventArguments, type AppEventDefinition } from "@executor-js/sdk/core";
 import type { McpBackend, McpEventError, McpEventKey } from "../contracts/backend.ts";
+import { withOperationSpan } from "./telemetry.ts";
 
 /** Subscription arguments: the filters, every one optional, nothing else. */
 const inputSchema = (
@@ -129,7 +130,7 @@ export const eventsHandler = (backend: McpBackend<Error>): McpServer.EventsHandl
           { concurrency: 8 },
         );
         return { events: pages.flat() };
-      }).pipe(Effect.mapError(projectError), Effect.withSpan("mcp.events.list")),
+      }).pipe(Effect.mapError(projectError), withOperationSpan("mcp.events.list")),
     subscribe: (params) =>
       Effect.gen(function* () {
         if (params.delivery.mode !== "webhook")
@@ -177,7 +178,7 @@ export const eventsHandler = (backend: McpBackend<Error>): McpServer.EventsHandl
         Effect.mapError((error) =>
           Schema.is(McpSchema.McpErrorBase)(error) ? error : projectError(error),
         ),
-        Effect.withSpan("mcp.events.subscribe"),
+        withOperationSpan("mcp.events.subscribe"),
       ),
     unsubscribe: (params) =>
       Effect.gen(function* () {
@@ -190,7 +191,7 @@ export const eventsHandler = (backend: McpBackend<Error>): McpServer.EventsHandl
         Effect.mapError((error) =>
           Schema.is(McpSchema.McpErrorBase)(error) ? error : projectError(error),
         ),
-        Effect.withSpan("mcp.events.unsubscribe"),
+        withOperationSpan("mcp.events.unsubscribe"),
       ),
   };
 };
diff --git a/packages/mcp/src/implementation/execute.ts b/packages/mcp/src/implementation/execute.ts
index 220fe7a1bc..751951d473 100644
--- a/packages/mcp/src/implementation/execute.ts
+++ b/packages/mcp/src/implementation/execute.ts
@@ -8,6 +8,7 @@ import {
   routerFailure,
   approvalRequired,
   ToolListingTimedOut,
+  ToolSearchStale,
   ToolSearchUnavailable,
   resolveLinkedAccounts,
   AccountChoiceUnsupported,
@@ -31,9 +32,12 @@ import {
   diagnosticSummary,
   executionDiagnostic,
   failureDetail,
+  failureReference,
   reportFailure,
+  type FailureSite,
 } from "./diagnostics.ts";
 import { nearest } from "./suggestions.ts";
+import { withOperationSpan } from "./telemetry.ts";
 import type { McpAppAccounts } from "../contracts/targets.ts";
 import type { McpBackend } from "../contracts/backend.ts";
 import { accountSummary, accountsKey, discoveryAccounts } from "./accounts.ts";
@@ -551,8 +555,8 @@ const rank = <E extends Error>(
 
 /**
  * Add ranked items to a page in rank order until the next would take it past its byte budget, so a
- * page never exceeds the execute output limit; it always holds at least one match. Each item is
- * rendered only when it is reached.
+ * page stays concise; it always holds at least one match. Each item is rendered only when it is
+ * reached.
  */
 const fill = <A, B, E>(
   ranked: ReadonlyArray<A>,
@@ -582,7 +586,6 @@ const searchPage = <E extends Error>(
   searchable: Searchable<E>,
   lost: Lost,
   search: McpBackend<E>["searchTools"],
-  limits: McpLimits,
   input: typeof SearchInput.Type,
 ) =>
   Effect.gen(function* () {
@@ -594,7 +597,7 @@ const searchPage = <E extends Error>(
     });
     const page = yield* fill(
       ranked.items,
-      searchPageBytes(limits),
+      searchPageBytes,
       jsonBytes({ items: [], namespaces: [], remaining: 0, next: { ...input, offset } }),
       (
         { found, first },
@@ -641,7 +644,6 @@ const globalSearchPage = <E extends Error>(
   searchable: Searchable<E>,
   lost: Lost,
   search: McpBackend<E>["searchTools"],
-  limits: McpLimits,
   input: CodeMode.SearchRequest,
   rendered: () => void,
 ) =>
@@ -654,7 +656,7 @@ const globalSearchPage = <E extends Error>(
     });
     const items = yield* fill(
       ranked.items,
-      searchPageBytes(limits),
+      searchPageBytes,
       jsonBytes({ items: [], remaining: 0, next: { offset } }),
       ({ found, first }) =>
         renderSchemas(found.tool).pipe(
@@ -813,6 +815,11 @@ function catalog(
       discoveryIdleMs,
     } = defaultMcpRuntimeLimits;
     const slots = yield* Semaphore.make(concurrency);
+    // Every failure this catalog reports names the trace of the request driving it then.
+    const site = (operation: FailureSite["operation"]): FailureSite => ({
+      operation,
+      reference: progress.reference,
+    });
     // Listings share one app runtime, so how long one takes depends on the others. Discovery
     // gives up on an app only when no listing has completed for a while, not on a per-app clock.
     let progressed = yield* Clock.currentTimeMillis;
@@ -871,10 +878,10 @@ function catalog(
             );
           }),
         );
-      }).pipe(Effect.withSpan(name));
+      }).pipe(withOperationSpan(name));
     const apps = yield* backend
       .listApps({ toolsOnly: true })
-      .pipe(Effect.withSpan("mcp.discovery.apps"));
+      .pipe(withOperationSpan("mcp.discovery.apps"));
     yield* Effect.annotateCurrentSpan({
       "executor.discovery.apps": apps.length,
       "executor.discovery.concurrency": concurrency,
@@ -897,6 +904,8 @@ function catalog(
     const namespaces: Namespaces = new Map();
     /** The version each loaded namespace's tools came from. */
     const loadedFrom = new Map<string, VersionId>();
+    /** The app and accounts each loaded app's tools were listed with. */
+    const loadedWith = new Map<string, { readonly app: AppId; readonly accounts: AppAccounts }>();
     const unavailableOf = (app: AppId) => {
       const seen = new Set<string>();
       return [
@@ -963,8 +972,11 @@ function catalog(
                 input,
               });
               if (result.status !== "completed") return yield* approvalRequired(result);
+              // The tool's result says it failed, as an MCP server's `isError` does. The program
+              // still gets the whole result; the call is reported as a failure.
+              if (result.toolError === true) yield* toolReportedError(progress);
               return result.value;
-            }).pipe(Effect.mapError((error) => toolError(diagnostic(error)))),
+            }).pipe(Effect.mapError((error) => toolError(diagnostic(error, site("call"))))),
           ),
         );
     /** The program's own tool for an entry, built when the program's catalog takes its app. */
@@ -1048,13 +1060,13 @@ function catalog(
                   // timed out. Give up on the app now, as discovery would after waiting.
                   if (Schema.is(ToolListingTimedOut)(error)) yield* stop(app.id);
                   yield* unloaded(error);
-                  return { kind: "failed", error: diagnostic(error) } as const;
+                  return { kind: "failed", error: diagnostic(error, site("discover")) } as const;
                 }),
               ),
             );
           }),
           Effect.catch((error) =>
-            Effect.succeed({ kind: "failed", error: diagnostic(error) } as const),
+            Effect.succeed({ kind: "failed", error: diagnostic(error, site("discover")) } as const),
           ),
         );
       });
@@ -1078,12 +1090,18 @@ function catalog(
           ? []
           : [
               {
-                namespace: `${app.slug}.${toolPath(router.path)}`,
+                // The app's own router failed only for some of its accounts: its tools stay
+                // callable, so the failure is reported without closing the app's namespace.
+                namespace: router.path === "" ? undefined : `${app.slug}.${toolPath(router.path)}`,
                 entry: {
                   app: app.id,
-                  name: `${app.name} ${router.title ?? router.path}`,
+                  name:
+                    router.path === "" ? app.name : `${app.name} ${router.title ?? router.path}`,
                   router: router.path,
-                  reason: diagnostic(routerFailure({ app: app.id, version }, router.error)),
+                  reason: diagnostic(
+                    routerFailure({ app: app.id, version }, router.error),
+                    site("discover"),
+                  ),
                 },
               },
             ],
@@ -1096,7 +1114,7 @@ function catalog(
     const accountRequired = (app: ListedApp) => ({
       app: app.id,
       name: app.name,
-      reason: diagnostic(new AppAccountRequired({ app: app.id })),
+      reason: diagnostic(new AppAccountRequired({ app: app.id }), site("discover")),
     });
 
     const project = (
@@ -1121,11 +1139,13 @@ function catalog(
         const namespace = app.slug;
         namespaces.set(namespace, "available");
         loadedFrom.set(namespace, catalog.version);
+        const accounts = discoveryAccounts(linked);
+        if (accounts !== undefined) loadedWith.set(namespace, { app: app.id, accounts });
         // A router that could not list its tools is reported like an app, at its own namespace,
         // so a call into it explains why instead of reporting an unknown tool.
         for (const { namespace, entry } of routerFailures(app, catalog.version, catalog.routers)) {
           failed.push(entry);
-          namespaces.set(namespace, entry);
+          if (namespace !== undefined) namespaces.set(namespace, entry);
         }
         const described: Target = {
           ...placeOf(app, linked),
@@ -1161,6 +1181,20 @@ function catalog(
           const { linked, value: searchable } = discovered;
           for (const { entry } of routerFailures(app, searchable.version, searchable.routers))
             failed.push(entry);
+          // The app's earlier tools are still searched; this says why they may be out of date.
+          if (searchable.stale !== undefined)
+            failed.push({
+              app: app.id,
+              name: app.name,
+              reason: diagnostic(
+                new ToolSearchStale({
+                  app: app.id,
+                  listedAt: searchable.stale.listedAt,
+                  cause: searchable.stale.failure.description,
+                }),
+                site("discover"),
+              ),
+            });
           found.push({
             ...placeOf(app, linked),
             listing: searchable.listing,
@@ -1327,7 +1361,7 @@ function catalog(
           "executor.discovery.tools": entries.length,
         });
         return entries;
-      }).pipe(Effect.withSpan("mcp.describe.discovery"));
+      }).pipe(withOperationSpan("mcp.describe.discovery"));
     /**
      * Report targets whose listing search no longer keeps, as discovery reports a target it could
      * not load, and leave them out of later searches.
@@ -1349,7 +1383,10 @@ function catalog(
           failed.push({
             app: app.id,
             name: app.name,
-            reason: diagnostic(new ToolSearchUnavailable({ app: app.id, reason: "removed" })),
+            reason: diagnostic(
+              new ToolSearchUnavailable({ app: app.id, reason: "removed" }),
+              site("discover"),
+            ),
           });
         }
         progress.unavailableApps = unavailableApps();
@@ -1372,7 +1409,7 @@ function catalog(
           "executor.discovery.targets": targets.length,
         });
         return targets;
-      }).pipe(Effect.withSpan("mcp.search.discovery"));
+      }).pipe(withOperationSpan("mcp.search.discovery"));
     const reachable = (names: ReadonlySet<string>) =>
       discovered.filter(({ app }) => names.has(app.slug));
     const slugs = new Set(apps.map((app) => app.slug));
@@ -1413,7 +1450,7 @@ function catalog(
             loaded === undefined ? 0 : Object.keys(loaded).length,
           );
           return loaded;
-        }).pipe(Effect.withSpan("mcp.discovery.namespace")),
+        }).pipe(withOperationSpan("mcp.discovery.namespace")),
       ).pipe(Effect.map((open) => ({ app: selected.app, open }))),
     );
     /** Namespaces for the program over every app it does not hold, each loaded on first use. */
@@ -1438,10 +1475,31 @@ function catalog(
       lost,
       unavailableApps,
       unknownTool: (error: CodeMode.Diagnostic) => unknownTool(error, loadedFrom, slugs),
+      /**
+       * Have the app a program named an unknown tool of checked for new tools. Its listing is read
+       * as one that refreshes when it is past its freshness: the refresh runs the app, whose
+       * cached tool list, such as an MCP server's, refreshes in turn once it is stale, and a
+       * changed list makes every process list the app again. Nothing waits for that refresh.
+       */
+      recheck: (error: CodeMode.Diagnostic) => {
+        const loaded = loadedWith.get(unknownPath(error)?.split(".")[0] ?? "");
+        return loaded === undefined
+          ? Effect.void
+          : backend.listTools({ app: loaded.app, accounts: loaded.accounts, limit: 1 }).pipe(
+              // A listing this read evaluates runs on as the host's background work, where
+              // there is one, after the answer stops waiting for it.
+              Effect.timeoutOption(recheckWaitMillis),
+              Effect.ignore,
+              Effect.withSpan("mcp.execute.recheck"),
+            );
+      },
     };
   });
 }
 
+/** How long an execute that named an unknown tool waits for the app's listing it rechecks. */
+const recheckWaitMillis = 2_000;
+
 /** Unavailable namespaces map to their reason; loaded ones are marked available. */
 type Namespaces = Map<string, typeof UnavailableApp.Type | "available">;
 
@@ -1452,6 +1510,8 @@ export type ExecutionProgress = {
     readonly name: string;
     outcome: McpToolCall["outcome"] | "running";
     durationMs?: number;
+    /** The call returned a result that says the tool failed (`toolError`), so it did not succeed. */
+    toolError?: true;
   }>;
   /** The call index each running tool fiber serves, so the driver can mark its approval wait. */
   readonly callFibers: Map<number, number>;
@@ -1463,18 +1523,32 @@ export type ExecutionProgress = {
    * it when they happen reports them, with its own reporter and trace.
    */
   readonly failures: Array<Error>;
+  /**
+   * The trace of the request driving the program, the reference of each failure the program
+   * meets. Its driver sets it before the program runs again, so a failure after a resume names
+   * the resume that reports it, not the request that started the program.
+   */
+  reference: string | undefined;
 };
-export const executionProgress = (): ExecutionProgress => ({
+export const executionProgress = (reference: string | undefined): ExecutionProgress => ({
   calls: [],
   callFibers: new Map(),
   phase: "discovery",
   unavailableApps: [],
   failures: [],
+  reference,
 });
 const recordFailure = (progress: ExecutionProgress, error: Error) =>
   Effect.sync(() => {
     progress.failures.push(error);
   });
+/** Mark the call this fiber makes as one whose result says its tool failed. */
+const toolReportedError = (progress: ExecutionProgress) =>
+  Effect.map(Effect.fiberId, (fiber) => {
+    const index = progress.callFibers.get(fiber);
+    const call = index === undefined ? undefined : progress.calls[index];
+    if (call !== undefined) call.toolError = true;
+  });
 
 /** The canonical path CodeMode's UnknownTool diagnostic names. */
 const unknownPath = (error: CodeMode.Diagnostic) =>
@@ -1502,7 +1576,7 @@ const unknownTool = (
   for (let length = segments.length; length > 0; length--) {
     const version = loadedFrom.get(segments.slice(0, length).join("."));
     if (version !== undefined)
-      return `This execute loaded '${slug}' from version ${version} when it first reached the app. If the app was deployed after that, call its new tools in a new execute. Otherwise use search to find the app's tools.`;
+      return `This execute loaded '${slug}' from version ${version} when it first reached the app. If the app was deployed after that, call its new tools in a new execute. If the tool was added to the service behind the app, Executor is checking the app for new tools now; they appear within a few minutes, so call it again in a new execute. Otherwise use search to find the app's tools.`;
   }
   if (!slugs.has(slug))
     return `No app '${slug}' existed when this execute started. If it was created or deployed during this execute, call it in a new execute. Otherwise use search to find available tools.`;
@@ -1536,7 +1610,8 @@ const unavailableMessage = (unavailable: typeof UnavailableApp.Type) =>
 
 /**
  * A snapshot for a result. A call still running when the execution ends is reported as
- * interrupted. A driver-assembled result lists only calls whose start was recorded.
+ * interrupted, and one whose result says its tool failed as a failure. A driver-assembled result
+ * lists only calls whose start was recorded.
  */
 export const reportedCalls = (progress: ExecutionProgress): Array<McpToolCall> =>
   progress.calls.flatMap((call) =>
@@ -1545,7 +1620,12 @@ export const reportedCalls = (progress: ExecutionProgress): Array<McpToolCall> =
       : [
           {
             name: call.name,
-            outcome: call.outcome === "running" ? "interrupted" : call.outcome,
+            outcome:
+              call.outcome === "running"
+                ? "interrupted"
+                : call.outcome === "success" && call.toolError === true
+                  ? "failure"
+                  : call.outcome,
             ...(call.durationMs === undefined ? {} : { durationMs: call.durationMs }),
           },
         ],
@@ -1649,7 +1729,7 @@ function runProgram(
         });
         return discovered;
       }).pipe(
-        Effect.withSpan("mcp.catalog"),
+        withOperationSpan("mcp.catalog"),
         Effect.map(Option.some),
         Effect.raceFirst(deadline.pipe(Effect.as(Option.none()))),
       );
@@ -1670,7 +1750,7 @@ function runProgram(
         input: SearchInput,
         output: SearchResult,
         execute: (input) =>
-          real(searchPage(prepared.searchable, prepared.lost, tools.searchTools, limits, input)),
+          real(searchPage(prepared.searchable, prepared.lost, tools.searchTools, input)),
       });
       const describe = Tool.make({
         description:
@@ -1693,18 +1773,12 @@ function runProgram(
         // tool's signature.
         search: (input) =>
           real(
-            globalSearchPage(
-              prepared.searchable,
-              prepared.lost,
-              tools.searchTools,
-              limits,
-              input,
-              () => {
-                searchSignatures += 1;
-              },
-            ),
+            globalSearchPage(prepared.searchable, prepared.lost, tools.searchTools, input, () => {
+              searchSignatures += 1;
+            }),
           ),
-        limits,
+        // No output limit: the program's value and logs come back whole.
+        limits: { timeoutMs: limits.timeoutMs, maxToolCalls: limits.maxToolCalls },
         // Both hooks run on the fiber that makes the call.
         onToolCallStart: ({ index, name }) =>
           Effect.map(Effect.fiberId, (fiber) => {
@@ -1740,6 +1814,7 @@ function runProgram(
         yield* Effect.annotateCurrentSpan("executor.unavailable_app.called", true);
       const unknown =
         result.ok || unavailable !== undefined ? undefined : prepared.unknownTool(result.error);
+      if (unknown !== undefined && !result.ok) yield* prepared.recheck(result.error);
       const execution = executionDiagnostic({
         ...result,
         ...(unknown === undefined || result.ok
@@ -1774,7 +1849,12 @@ function runProgram(
     }).pipe(
       Effect.catch((error) =>
         recordFailure(progress, error).pipe(
-          Effect.as(failure("ExecutionFailure", diagnostic(error))),
+          Effect.as(
+            failure(
+              "ExecutionFailure",
+              diagnostic(error, { operation: "discover", reference: progress.reference }),
+            ),
+          ),
         ),
       ),
     );
@@ -1797,8 +1877,7 @@ const callFailure = (
 /**
  * Call tools by exact path without a program. Each call runs the same catalog tool a program
  * would call, through the run's backend, so approvals and tool input pause and resume as they do
- * for execute. Calls run concurrently and fail independently. A result that would take the
- * output past its budget is refused rather than cut: the agent can select fields with execute.
+ * for execute. Calls run concurrently and fail independently, and each result comes back whole.
  */
 export function callTools(input: typeof CallInput.Type): Program {
   return (backend, limits, deadline, progress) =>
@@ -1829,7 +1908,7 @@ export function callTools(input: typeof CallInput.Type): Program {
           const entries = yield* discovered.described(named.filter((path) => path !== ""));
           return { discovered, entries };
         }).pipe(
-          Effect.withSpan("mcp.catalog"),
+          withOperationSpan("mcp.catalog"),
           Effect.map(Option.some),
           Effect.raceFirst(deadline.pipe(Effect.as(Option.none()))),
         );
@@ -1896,22 +1975,6 @@ export function callTools(input: typeof CallInput.Type): Program {
           yield* Effect.annotateCurrentSpan("executor.timeout.phase", "program");
           return failure("TimeoutExceeded", timeoutMessage(limits.timeoutMs, "program"));
         }
-        // Results keep the batch order; once the output budget is spent, later values are refused.
-        let used = 0;
-        const bounded = outcomes.value.map((outcome): CallOutcome => {
-          const bytes = jsonBytes(outcome);
-          if (!outcome.ok || used + bytes <= limits.maxOutputBytes) {
-            used += bytes;
-            return outcome;
-          }
-          const refused = callFailure(
-            outcome.path,
-            "Truncated",
-            `The tool ran, but its ${bytes}-byte result would pass the ${limits.maxOutputBytes}-byte output limit. Call it inside execute and return only the fields you need.`,
-          );
-          used += jsonBytes(refused);
-          return refused;
-        });
         yield* Effect.annotateCurrentSpan({
           "executor.call.count": requests.length,
           "executor.outcome": "completed",
@@ -1919,7 +1982,7 @@ export function callTools(input: typeof CallInput.Type): Program {
         return {
           execution: {
             ok: true as const,
-            value: single ? (bounded[0] ?? null) : bounded,
+            value: single ? (outcomes.value[0] ?? null) : outcomes.value,
             toolCalls: reportedCalls(progress),
           },
           unavailableApps: discovered.unavailableApps(),
@@ -1927,7 +1990,12 @@ export function callTools(input: typeof CallInput.Type): Program {
       }).pipe(
         Effect.catch((error) =>
           recordFailure(progress, error).pipe(
-            Effect.as(failure("ExecutionFailure", diagnostic(error))),
+            Effect.as(
+              failure(
+                "ExecutionFailure",
+                diagnostic(error, { operation: "discover", reference: progress.reference }),
+              ),
+            ),
           ),
         ),
       );
@@ -1943,7 +2011,7 @@ const readCatalog = <A>(
   read: (discovered: Effect.Success<ReturnType<typeof catalog>>) => Effect.Effect<A, Error>,
 ) =>
   Effect.gen(function* () {
-    const progress = executionProgress();
+    const progress = executionProgress(yield* failureReference);
     // No program runs, so no program deadline stops a load.
     return yield* catalog(backend, progress, Effect.never).pipe(
       Effect.flatMap((discovered) =>
@@ -1957,7 +2025,14 @@ const readCatalog = <A>(
       Effect.catch((error) =>
         reportFailure(error).pipe(
           Effect.andThen(
-            Effect.fail(new CatalogUnavailable({ message: diagnosticSummary(error) })),
+            Effect.fail(
+              new CatalogUnavailable({
+                message: diagnosticSummary(error, {
+                  operation: "discover",
+                  reference: progress.reference,
+                }),
+              }),
+            ),
           ),
         ),
       ),
@@ -1965,13 +2040,9 @@ const readCatalog = <A>(
   });
 
 /** The search tool: one ranked page of the caller's catalog, as tools.search returns it. */
-export const searchCatalog = (
-  backend: McpBackend<Error>,
-  limits: McpLimits,
-  input: typeof SearchInput.Type,
-) =>
+export const searchCatalog = (backend: McpBackend<Error>, input: typeof SearchInput.Type) =>
   readCatalog(backend, (discovered) =>
-    searchPage(discovered.searchable, discovered.lost, backend.searchTools, limits, input),
+    searchPage(discovered.searchable, discovered.lost, backend.searchTools, input),
   ).pipe(
     Effect.map(({ value, discovered }) => ({
       ...value,
diff --git a/packages/mcp/src/implementation/executions.ts b/packages/mcp/src/implementation/executions.ts
index 3539ab4f8d..abf8d55010 100644
--- a/packages/mcp/src/implementation/executions.ts
+++ b/packages/mcp/src/implementation/executions.ts
@@ -34,25 +34,27 @@ import {
 } from "effect";
 import type { McpBackend } from "../contracts/backend.ts";
 import {
-  ApprovalTooLarge,
   ApprovalUnavailable,
   defaultMcpRuntimeLimits,
   ElicitationRequestId,
   ElicitationResponseInvalid,
+  issuedInteractionId,
   ResumeInput,
+  type InteractionEnd,
   type InteractionId,
+  type InteractionRecords,
+  type OpenInteraction,
   type InteractionTool,
   type ToolInputPending,
   type ExecuteResult,
   type McpExecutionResult,
   type McpLimits,
-  type PendingInteraction,
   resumeUnavailableMessage,
   type ResumeUnavailableReason,
 } from "../contracts/execute.ts";
 import type { BrowserApprovalView, BrowserApprovalAcknowledgement } from "../contracts/browser.ts";
 import { programScheduler } from "./program-scheduler.ts";
-import { reportFailure } from "./diagnostics.ts";
+import { failureReference, reportFailure } from "./diagnostics.ts";
 import {
   executionProgress,
   reportedCalls,
@@ -70,7 +72,7 @@ class McpExecutionFailed extends Schema.TaggedError<McpExecutionFailed>()(
 ) {}
 
 /** Why a request stopped being pending before or without a resume answering it. */
-type Ended = Exclude<ResumeUnavailableReason, "not-found">;
+type Ended = InteractionEnd;
 /** Ended requests are remembered as long as an answer to them can plausibly still arrive. */
 const endedRetentionMs = 30 * 60 * 1000;
 /** Bounds that memory however many requests a host issues. */
@@ -95,10 +97,9 @@ const interactionTool = (call: {
 });
 
 /**
- * How a run's pending interactions reach a person, which decides what must fit the output budget.
- * Model and browser delivery return the whole interaction as the execute result; browser delivery
- * also adds its review link, a few hundred bytes the budget does not count. Native delivery sends
- * only the prompt, as the client's own elicitation request.
+ * How a run's pending interactions reach a person. Model and browser delivery return the whole
+ * interaction as the execute result; browser delivery also adds its review link. Native delivery
+ * sends only the prompt, as the client's own elicitation request.
  */
 export type PendingTransport = "result" | "prompt";
 /**
@@ -107,9 +108,12 @@ export type PendingTransport = "result" | "prompt";
  */
 export type ApprovalMode = "ask" | "client";
 const jsonBytes = (value: unknown) => new TextEncoder().encode(JSON.stringify(value)).byteLength;
-/** UTF-8 bytes of the JSON a transport sends for this interaction. */
-const sentBytes = (transport: PendingTransport, request: PendingInteraction) =>
-  jsonBytes(transport === "prompt" ? request.elicitation : request);
+/**
+ * The largest approval prompt, in UTF-8 bytes of JSON, a native client is sent with the exact
+ * arguments. Above it the client gets the saved prompt, shortened for a person to read, which says
+ * approving runs the complete arguments. Nothing is refused for its size.
+ */
+const exactPromptBytes = 100_000;
 
 type Operation = { readonly waiting: Set<InteractionId> };
 type Pending = {
@@ -168,6 +172,7 @@ export const runningPrograms = () => live.programs;
 export const makeExecutions = (
   limits: McpLimits,
   beforeExecute: Effect.Effect<void, ExecutionRejected> = Effect.void,
+  records?: InteractionRecords,
 ) =>
   Effect.gen(function* () {
     const clock = yield* Clock.Clock;
@@ -190,18 +195,54 @@ export const makeExecutions = (
       InteractionId,
       { readonly caller: string; readonly reason: Ended; readonly until: number }
     >();
+    /**
+     * Why the caller cannot answer this ID, from Executor's own records only: the ID's form, this
+     * store's memory of ended requests, then the host's record of issued ones. A request the host
+     * recorded for this caller with no end, that memory no longer holds, is `lost`. That is most
+     * often a restart that cleared its program, but a failed write can also leave its end out,
+     * so it never shows that the request went unanswered or expired, whatever its deadline.
+     */
+    const reasonFor = (caller: string, requestId: InteractionId) => {
+      if (!issuedInteractionId.test(requestId)) return "malformed" as const;
+      const known = ended.get(requestId);
+      if (known !== undefined) return known.caller === caller ? known.reason : "not-found";
+      const issued = records?.read(requestId);
+      if (issued === undefined || issued.caller !== caller) return "not-found";
+      return issued.end ?? "lost";
+    };
+    /** The caller's requests that a resume can still answer. */
+    const open = (caller: string, now: number): OpenInteraction[] =>
+      [...requests.values()]
+        .filter((pending) => pending.run.caller === caller && pending.request.expiresAt > now)
+        .map(({ request }) =>
+          request.status === "approval-required"
+            ? {
+                requestId: request.requestId,
+                status: request.status,
+                app: request.invocation.app,
+                tool: request.invocation.tool,
+                expiresAt: request.expiresAt,
+              }
+            : {
+                requestId: request.requestId,
+                status: request.status,
+                app: request.tool.app,
+                tool: request.tool.tool,
+                expiresAt: request.expiresAt,
+              },
+        );
     const unavailable = (
       caller: string,
       requestId: InteractionId,
     ): Extract<McpExecutionResult, { status: "unavailable" }> => {
-      const known = ended.get(requestId);
-      const reason: ResumeUnavailableReason =
-        known === undefined || known.caller !== caller ? "not-found" : known.reason;
+      const now = clock.currentTimeMillisUnsafe();
+      const reason: ResumeUnavailableReason = reasonFor(caller, requestId);
       return {
         status: "unavailable",
         requestId,
         reason,
         message: resumeUnavailableMessage(reason),
+        pending: open(caller, now),
       };
     };
     const failure = (
@@ -242,6 +283,7 @@ export const makeExecutions = (
           if (ended.size <= maxEnded) break;
           ended.delete(oldest);
         }
+        records?.ended(id, reason);
       }
       requests.delete(id);
       pending.run.pending.delete(pending.request.requestId);
@@ -311,6 +353,7 @@ export const makeExecutions = (
           return yield* new ApprovalUnavailable({ reason: "ended" });
         pending.run.pending.set(pending.request.requestId, pending);
         requests.set(pending.request.requestId, pending);
+        records?.issued(pending.request.requestId, pending.run.caller, pending.request.expiresAt);
         yield* wake(pending.run);
       });
 
@@ -329,16 +372,6 @@ export const makeExecutions = (
             elicitation: form.request,
             expiresAt: (yield* Clock.currentTimeMillis) + defaultElicitationLimits.timeoutMs,
           };
-          // The app's question cannot reach anyone, so its request is invalid. The app learns only
-          // that; the span keeps the size, for operators.
-          const bytes = sentBytes(run.transport, request);
-          if (bytes > limits.maxOutputBytes) {
-            yield* Effect.annotateCurrentSpan({
-              "executor.elicitation.bytes": bytes,
-              "executor.elicitation.limit": limits.maxOutputBytes,
-            });
-            return yield* new ElicitationFailed({ reason: "invalid-request" });
-          }
           const pending: Pending = {
             kind: "input",
             browserAnswer: yield* Deferred.make<ElicitationResponse | undefined>(),
@@ -391,12 +424,6 @@ export const makeExecutions = (
         );
       });
 
-    /**
-     * The approval request as `run` sends it. A native client is sent only the prompt, so it shows
-     * the exact arguments whenever that prompt fits the budget, and the saved shortened one
-     * otherwise. A request over the budget is never offered: the saved call is cancelled, so it can
-     * never run, and the call fails with the request's size.
-     */
     /**
      * Accept a policy approval at once, for a run whose MCP client already confirmed the call. The
      * approved call runs as a resumed one does, so its failures reach the caller the same way.
@@ -447,39 +474,22 @@ export const makeExecutions = (
             ),
           ),
         );
-    const offer = (
-      run: Run,
-      backend: McpBackend<Error>,
-      saved: typeof ToolPending.Type,
-    ): Effect.Effect<typeof ToolPending.Type, ApprovalTooLarge> =>
-      Effect.gen(function* () {
-        const exact =
-          run.transport === "prompt"
-            ? exactApprovalElicitation(
-                saved.invocation.tool,
-                saved.invocation.input,
-                limits.maxOutputBytes,
-              )
-            : undefined;
-        const request =
-          exact !== undefined && jsonBytes(exact) <= limits.maxOutputBytes
-            ? { ...saved, elicitation: exact }
-            : saved;
-        const bytes = sentBytes(run.transport, request);
-        if (bytes <= limits.maxOutputBytes) return request;
-        // Its ID never leaves the host, but consuming it means no answer could ever run it.
-        yield* Effect.ignore(backend.resumeInvocation(saved, { action: "cancel" }), {
-          log: "Warn",
-          message: "Cancelling an oversized approval request failed",
-        });
-        return yield* Effect.fail(
-          new ApprovalTooLarge({
-            tool: saved.invocation.tool,
-            bytes,
-            limit: limits.maxOutputBytes,
-          }),
-        );
-      });
+    /**
+     * The approval request as `run` sends it. A native client is sent only the prompt, so it shows
+     * the exact arguments whenever that prompt fits `exactPromptBytes`, and the saved shortened one
+     * otherwise. Model and browser delivery return the whole request, arguments included.
+     */
+    const offer = (run: Run, saved: typeof ToolPending.Type): typeof ToolPending.Type => {
+      if (run.transport !== "prompt") return saved;
+      const exact = exactApprovalElicitation(
+        saved.invocation.tool,
+        saved.invocation.input,
+        exactPromptBytes,
+      );
+      return exact !== undefined && jsonBytes(exact) <= exactPromptBytes
+        ? { ...saved, elicitation: exact }
+        : saved;
+    };
 
     const broker = (run: Run): McpBackend<Error> => {
       const exchange = <A>(
@@ -556,7 +566,7 @@ export const makeExecutions = (
                         : // A tool that requires a person is asked, even when the client confirmed the call.
                           run.approval === "client" && result.human !== true
                           ? approveNow(run, backend, operation, result)
-                          : offer(run, backend, result),
+                          : Effect.succeed(offer(run, result)),
                     ),
                   ),
               (result, response) => {
@@ -602,6 +612,8 @@ export const makeExecutions = (
     ): Effect.Effect<McpExecutionResult> =>
       Effect.gen(function* () {
         run.busy = true;
+        // Failures the program meets from here are this request's to report, so they name its trace.
+        run.progress.reference = yield* failureReference;
         run.scheduling.resume();
         const started = yield* Clock.currentTimeMillis;
         const loop = Effect.gen(function* () {
@@ -685,6 +697,8 @@ export const makeExecutions = (
         return pending;
       });
     return {
+      /** Programs this store holds, running or waiting for an answer. */
+      live: () => runs.size,
       /** Why the caller has no such request to answer. */
       unavailable: (caller: string, id: InteractionId) =>
         Effect.sync(() => unavailable(caller, id)),
@@ -774,7 +788,7 @@ export const makeExecutions = (
             events: yield* Queue.unbounded<Event>(),
             pending: new Map(),
             operations: new Set(),
-            progress: executionProgress(),
+            progress: executionProgress(yield* failureReference),
             expired: yield* Deferred.make<void>(),
             remainingMs: limits.timeoutMs,
             busy: false,
diff --git a/packages/mcp/src/implementation/server.ts b/packages/mcp/src/implementation/server.ts
index 83e3216465..4e7de7e6b5 100644
--- a/packages/mcp/src/implementation/server.ts
+++ b/packages/mcp/src/implementation/server.ts
@@ -32,8 +32,9 @@ import { ElicitationResponseInvalid, InteractionId } from "../contracts/interact
 import { makeExecutions } from "./executions.ts";
 import { executeNative } from "./native-elicitation.ts";
 import { callTools, describeCatalog, executeProgram, searchCatalog } from "./execute.ts";
-import { skills } from "./skills.ts";
+import { decodeSkillsInput, skills } from "./skills.ts";
 import { eventsHandler } from "./events.ts";
+import { withOperationSpan } from "./telemetry.ts";
 
 // Observe the final protocol value after timeout, admission and resume handling.
 const observeExecution =
@@ -95,7 +96,7 @@ const observeExecution =
           }),
         ),
       );
-    }).pipe(Effect.withSpan(name));
+    }).pipe(withOperationSpan(name));
 
 /**
  * MCP revisions every product serves, newest first. An initialize offering an unlisted revision
@@ -161,7 +162,11 @@ const interactionId = (requestId: string) =>
 /** Build protocol state and its browser accessors together. Hosts authorize browser calls separately from MCP. */
 export const makeMcp = (options: McpOptions) =>
   Effect.gen(function* () {
-    const executions = yield* makeExecutions(options.limits, options.beforeExecute);
+    const executions = yield* makeExecutions(
+      options.limits,
+      options.beforeExecute,
+      options.interactions,
+    );
     const handler = (mode: ElicitationMode) =>
       Effect.gen(function* () {
         const delivery = options.browser;
@@ -186,22 +191,26 @@ export const makeMcp = (options: McpOptions) =>
           };
         });
         // Which skills agents read, and in what order, shows whether they follow the entry skill.
-        const skill = (input: Parameters<typeof skills>[0]) =>
-          skills(input, options.backend).pipe(
-            Effect.tap((result) =>
-              "content" in result ? options.annotateSkillRead(result) : Effect.void,
+        const skill = (params: unknown) =>
+          decodeSkillsInput(params).pipe(
+            Effect.flatMap((input) =>
+              skills(input, options.backend).pipe(
+                Effect.tap((result) =>
+                  "content" in result ? options.annotateSkillRead(result) : Effect.void,
+                ),
+                withOperationSpan("mcp.skills", {
+                  attributes: {
+                    "executor.skill.operation": input.name === undefined ? "list" : "read",
+                  },
+                }),
+              ),
             ),
-            Effect.withSpan("mcp.skills", {
-              attributes: {
-                "executor.skill.operation": input.name === undefined ? "list" : "read",
-              },
-            }),
           );
         // Search and describe read the catalog directly; call runs as an execution so it can pause.
-        const search = (input: Parameters<typeof searchCatalog>[2]) =>
-          searchCatalog(options.backend, options.limits, input).pipe(Effect.withSpan("mcp.search"));
+        const search = (input: Parameters<typeof searchCatalog>[1]) =>
+          searchCatalog(options.backend, input).pipe(withOperationSpan("mcp.search"));
         const describe = (input: Parameters<typeof describeCatalog>[1]) =>
-          describeCatalog(options.backend, input).pipe(Effect.withSpan("mcp.describe"));
+          describeCatalog(options.backend, input).pipe(withOperationSpan("mcp.describe"));
         /**
          * In model mode, a request only a person may approve carries the browser page they approve
          * it on. The agent shows it and resumes; the person's answer is used, never the agent's.
@@ -451,7 +460,7 @@ export const makeMcp = (options: McpOptions) =>
           approver,
         ),
     };
-    return { http, approvals };
+    return { http, approvals, programs: executions.live };
   });
 
 /** Mount MCP alone when a host does not need direct browser accessors. */
diff --git a/packages/mcp/src/implementation/skills.ts b/packages/mcp/src/implementation/skills.ts
index dfcc034b35..43b7de9555 100644
--- a/packages/mcp/src/implementation/skills.ts
+++ b/packages/mcp/src/implementation/skills.ts
@@ -14,12 +14,13 @@ import {
   SkillAccountRequired,
   SkillAppNotFound,
   SkillAppSlugAmbiguous,
+  SkillsInput,
+  SkillsInputInvalid,
   type SkillsFailure,
-  type SkillsInput,
   type SkillsResult,
   type SkillSummary,
 } from "../contracts/skills.ts";
-import { diagnosticSummary, reportFailure } from "./diagnostics.ts";
+import { diagnosticSummary, failureReference, reportFailure } from "./diagnostics.ts";
 
 const summaries = (catalog: AppSkillCatalog): readonly (typeof SkillSummary.Type)[] =>
   catalog.skills.map((skill) => ({
@@ -31,11 +32,24 @@ const summaries = (catalog: AppSkillCatalog): readonly (typeof SkillSummary.Type
 /** The agent reads why a read failed; the original failure reports as the same REST read would. */
 const failure = (error: Error) =>
   reportFailure(error).pipe(
-    Effect.andThen(Effect.fail(new SkillAccessFailed({ reason: diagnosticSummary(error) }))),
+    Effect.andThen(failureReference),
+    Effect.flatMap((reference) =>
+      Effect.fail(
+        new SkillAccessFailed({
+          reason: diagnosticSummary(error, { operation: "discover", reference }),
+        }),
+      ),
+    ),
   );
 /** An app the listing could not read, listed beside the others' skills. */
 const unavailable = <A extends object>(error: Error, entry: A) =>
-  reportFailure(error).pipe(Effect.as({ ...entry, reason: diagnosticSummary(error) }));
+  reportFailure(error).pipe(
+    Effect.andThen(failureReference),
+    Effect.map((reference) => ({
+      ...entry,
+      reason: diagnosticSummary(error, { operation: "discover", reference }),
+    })),
+  );
 
 type ListedApp = Pick<App, "id" | "name" | "slug" | "activeVersion">;
 
@@ -59,6 +73,12 @@ const skillAccounts = <E extends Error>(
       ),
     );
 
+/** The tool's input as one of the read shapes its advertised schema allows. */
+export const decodeSkillsInput = (input: unknown) =>
+  Schema.decodeUnknownEffect(SkillsInput)(input, { errors: "all" }).pipe(
+    Effect.mapError((error) => new SkillsInputInvalid({ reason: error.message })),
+  );
+
 /**
  * Resolve a slug only within authorized apps. Reference reads can pin the document's version.
  * A read that names accounts fails with `AccountChoiceUnsupported`, presented with its code and
diff --git a/packages/mcp/src/implementation/telemetry.ts b/packages/mcp/src/implementation/telemetry.ts
new file mode 100644
index 0000000000..14a1d9653b
--- /dev/null
+++ b/packages/mcp/src/implementation/telemetry.ts
@@ -0,0 +1,13 @@
+import { Effect } from "effect";
+import { McpRequestAttributes } from "../contracts/telemetry.ts";
+
+/**
+ * `Effect.withSpan` for an MCP operation: the span records the host's request attributes
+ * (`McpRequestAttributes`) from its start, beside its own.
+ */
+export const withOperationSpan =
+  (name: string, options?: { readonly attributes?: Readonly<Record<string, unknown>> }) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Effect.flatMap(McpRequestAttributes, (request) =>
+      Effect.withSpan(effect, name, { attributes: { ...request, ...options?.attributes } }),
+    );
diff --git a/packages/mcp/src/index.ts b/packages/mcp/src/index.ts
index 651a6fadf7..c9a072451f 100644
--- a/packages/mcp/src/index.ts
+++ b/packages/mcp/src/index.ts
@@ -4,6 +4,7 @@ export * from "./contracts/execute.ts";
 export * from "./contracts/elicitation.ts";
 export * from "./contracts/skills.ts";
 export * from "./contracts/tools.ts";
+export * from "./contracts/telemetry.ts";
 export { mcp, makeMcp } from "./implementation/server.ts";
 export { skills } from "./implementation/skills.ts";
 export { makeExecutions, runningPrograms } from "./implementation/executions.ts";
diff --git a/packages/sdk/src/contracts/account.ts b/packages/sdk/src/contracts/account.ts
index b84a0ffa5f..ea0fd06f31 100644
--- a/packages/sdk/src/contracts/account.ts
+++ b/packages/sdk/src/contracts/account.ts
@@ -1,13 +1,13 @@
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import { ApiError } from "@executor-js/utils/api-error";
 /** Saved reusable accounts. Products decide access; pending setup lives in account-connection.ts. */
-import { type Effect, Schema } from "effect";
+import { type Effect, Schema, SchemaGetter } from "effect";
 import { StorageError, CredentialsError } from "./shared.ts";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
 import { AccountInfo } from "apps/contracts";
 import type { UiAccountProblem } from "apps/ui/contracts";
 import type { App, AppAccounts } from "./apps.ts";
-import { AccountId, AppId, JsonObject, OwnerId, ProviderId } from "./shared.ts";
+import { AccountId, AppId, JsonObject, OwnerId, ProviderId, WebhookId } from "./shared.ts";
 import { AuthMethodInvalid, AuthMethodName, Provider, ProviderNotFound } from "./provider.ts";
 
 /**
@@ -256,12 +256,78 @@ const ownerQuery = { owner: AccountInputs.get.fields.owner };
  * material on the host. Completion derives identity from that attempt, never
  * from callback-supplied owner/provider IDs.
  */
-/** Keep the provider credentials until subscriptions have completed their upstream cleanup. */
+/** A subscription that still uses an account, and how far its lifecycle has got. */
+export const AccountWebhookDependent = Schema.Struct({
+  app: AppId,
+  subscription: WebhookId,
+  status: Schema.Literals(["pending", "setup-required", "active", "stopping", "disabled"]),
+});
+export type AccountWebhookDependent = typeof AccountWebhookDependent.Type;
+/** The most subscriptions a refusal names. */
+const maxNamedWebhookDependents = 10;
+/**
+ * Every subscription that holds the account, oldest ID first. The SDK lists them all as
+ * `visible`; a product that limits who sees apps and subscriptions keeps the ones the caller may
+ * see and counts the rest as `hidden`, so the refusal never names what the caller can't read.
+ */
+const Dependents = Schema.optionalKey(
+  Schema.Struct({
+    visible: Schema.Array(AccountWebhookDependent),
+    hidden: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+  }),
+);
+/**
+ * Declared but not yet sent. Clients and Executor apps that hold an earlier document decode
+ * `AccountWebhooksActive` as a closed object of `account` and `message`, so a new field would
+ * turn this refusal into a generic failure for them. The subscriptions reach them through
+ * `message`; a later release can send this field once cached documents have refreshed.
+ */
+const DependentsField = Dependents.pipe(
+  Schema.decodeTo(Dependents, {
+    decode: SchemaGetter.passthrough(),
+    encode: SchemaGetter.omit(),
+  }),
+);
+const accountWebhooksActive = "Remove this account's webhook subscriptions before deleting it.";
+/**
+ * Keep the provider credentials while a subscription still uses them: its source account, and
+ * while it is live, every account its registration ran with, which removing it needs.
+ */
 export const AccountWebhooksActive = ApiError.define({
   tag: "AccountWebhooksActive",
   status: 409,
-  fields: { account: AccountId },
-  message: "Remove this account's webhook subscriptions before deleting it.",
+  fields: { account: AccountId, dependents: DependentsField },
+  message: ({ dependents }) => {
+    if (dependents === undefined) return accountWebhooksActive;
+    const { visible, hidden } = dependents;
+    const named = visible
+      .slice(0, maxNamedWebhookDependents)
+      .map((item) => `${item.app}/${item.subscription} (${item.status})`)
+      .join(", ");
+    const more = visible.length - maxNamedWebhookDependents;
+    const unseen = `${hidden} webhook ${hidden === 1 ? "subscription" : "subscriptions"} you can't see`;
+    // Removal needs its actor or an app manager, who for a member's subscription must use its source.
+    const removers =
+      hidden === 1
+        ? "Ask the person it runs as, or a manager of its app who can use its source account, to remove it."
+        : "Ask the person each runs as, or a manager of its app who can use its source account, to remove them.";
+    const parts =
+      visible.length === 0
+        ? [
+            `${unseen} ${hidden === 1 ? "uses" : "use"} this account, so it can't be deleted.`,
+            removers,
+          ]
+        : [
+            `Webhook subscriptions still use this account, so it can't be deleted: ${named}${more > 0 ? ` and ${more} more` : ""}.`,
+            "A subscription uses its source account and every account its registration ran with, so its source may be another account.",
+            "Remove each live one with webhooks.remove, or unlink its source account from the app. For a disabled one, remove its webhook at the provider, then confirm with webhooks.confirmRemoval.",
+            ...(hidden === 0
+              ? []
+              : [`${unseen} also ${hidden === 1 ? "uses" : "use"} it.`, removers]),
+          ];
+    return [...parts, "Then delete the account again."].join(" ");
+  },
+  recorded: () => accountWebhooksActive,
 });
 export type AccountWebhooksActive = typeof AccountWebhooksActive.Type;
 
diff --git a/packages/sdk/src/contracts/apps.ts b/packages/sdk/src/contracts/apps.ts
index 0ff6dbf3ae..f7567bd91e 100644
--- a/packages/sdk/src/contracts/apps.ts
+++ b/packages/sdk/src/contracts/apps.ts
@@ -158,11 +158,32 @@ export const sameAccounts = (left: AppAccounts, right: AppAccounts) => {
 /** AppAccounts in a GET query: JSON text, so an empty requirement survives as []. */
 export const AppAccountsQuery = Schema.optional(Schema.fromJsonString(AppAccounts));
 
-/** Display names are nonblank and bounded; they do not replace stable app identities. */
+// The API document publishes the pattern; Effect publishes only `u`-flag patterns, which JSON
+// Schema reads with Unicode semantics. It uses code-unit ranges rather than `\p{…}` classes, so it
+// also means the same without the flag and in engines, such as Python's, that reject `\p{…}`.
+/** Control characters and line or paragraph separators. */
+const breaks = "\\u0000-\\u001F\\u007F-\\u009F\\u2028\\u2029";
+/** Spaces that are not line breaks. */
+const blanks = " \\u00A0\\u1680\\u2000-\\u200A\\u202F\\u205F\\u3000";
+/** Format characters, which render as nothing, such as zero-width spaces and joiners. */
+const invisible =
+  "\\u00AD\\u0600-\\u0605\\u061C\\u06DD\\u070F\\u0890\\u0891\\u08E2\\u180E\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u206F\\uFEFF\\uFFF9-\\uFFFB";
+/** Blanks and invisible characters, then a visible one, then anything on the same line. */
+const oneVisibleLine = new RegExp(
+  `^[${blanks}${invisible}]*[^${breaks}${blanks}${invisible}][^${breaks}]*$`,
+  "u",
+);
+
+/**
+ * Display names are one bounded line with a visible character; they do not replace stable app
+ * identities. Control characters are refused because storage cannot hold NUL, and names made only
+ * of invisible characters would list as blank. Names already stored are read with `NonEmptyString`,
+ * so this only narrows what new writes accept.
+ */
 export const AppName = Schema.String.check(
   Schema.isMinLength(1),
   Schema.isMaxLength(120),
-  Schema.isPattern(/\S/u),
+  Schema.isPattern(oneVisibleLine),
 );
 
 /** Informational origin captured when a copy is made. It never grants access or drives updates. */
@@ -703,7 +724,7 @@ export const AppsGroup = HttpApiGroup.make("apps")
       ],
     }).annotate(
       OpenApi.Description,
-      "Activate a retained version in the same code lineage. Managed webhooks re-register for it; calls validate their accounts against the active requirements. expectedVersion rejects a concurrent activation. The former field names `deployment` and `expectedDeployment` are still accepted.",
+      "Activate a retained version in the same code lineage. Managed webhooks re-register for it, except that a manual one whose setup the version still serves keeps its callback URL and secret; calls validate their accounts against the active requirements. expectedVersion rejects a concurrent activation. The former field names `deployment` and `expectedDeployment` are still accepted.",
     ),
   )
   .add(
diff --git a/packages/sdk/src/contracts/declarations.ts b/packages/sdk/src/contracts/declarations.ts
index 7e70223c8a..80cf241e51 100644
--- a/packages/sdk/src/contracts/declarations.ts
+++ b/packages/sdk/src/contracts/declarations.ts
@@ -19,10 +19,11 @@ export const declarationFreshness = {
  * The app cache's `freshFor`/`staleFor` already bound how old a remote catalog behind a listing
  * can be, and a new version, account set or stored credential is a
  * different listing, so this window only bounds re-evaluation and inputs nothing else tracks,
- * such as a factory that fetches without the app cache. `maxStaleMillis` defaults to 24 hours, so
- * a listing read at least once a day is served from memory while it refreshes in the background.
+ * such as a factory that fetches without the app cache. `maxStaleMillis` defaults to 7 days, so a
+ * listing read at least once a week is served at once while it refreshes in the background.
  * `freshMillis` defaults to 30 s, so a busy catalog is re-evaluated in the background at most twice
- * a minute.
+ * a minute. Search rows, which their readers never refresh, are renewed in the background once
+ * they are older than `renewMillis`, a day by default.
  *
  * `loadMillis` bounds an evaluation only while no request waits for it: a background refresh, or
  * a first listing every reader stopped waiting for. It is stopped once it has run that long with
@@ -38,18 +39,23 @@ export const declarationFreshness = {
  * wait bound in that window, such as MCP discovery, report it at once while one background
  * evaluation retries; a success replaces it. Reads without a wait bound, such as the dashboard,
  * evaluate again, so a recovered upstream shows on their next read however slowly the remembered
- * failure arrived. A faster failure costs a read no more than reporting a remembered one, so it is
- * never remembered.
+ * failure arrived. A faster failure costs a read no more than reporting a remembered one, so reads
+ * never remember it. Search does, for kept rows whose background renewal failed in the app or its
+ * upstream: later searches still serve those rows, and report the failure beside them until a
+ * renewal succeeds. A renewal the host stopped, or one past `loadMillis`, is not such a failure: it
+ * is tried again after `renewMillis`.
  */
 export interface ToolListingPolicy {
   readonly freshMillis: number;
+  readonly renewMillis: number;
   readonly maxStaleMillis: number;
   readonly loadMillis: number;
   readonly slowFailureMillis: number;
 }
 export const defaultToolListingPolicy: ToolListingPolicy = {
   freshMillis: 30_000,
-  maxStaleMillis: 24 * 60 * 60_000,
+  renewMillis: 24 * 60 * 60_000,
+  maxStaleMillis: 7 * 24 * 60 * 60_000,
   loadMillis: 45_000,
   slowFailureMillis: 1_000,
 };
@@ -64,7 +70,10 @@ export interface CatalogReadOptions {
    * Defaults to true. A read across every app, such as MCP search or the skills index, passes
    * false: refreshing every aged result would load every app's Worker, so it serves a kept result
    * of any age below its `maxStaleMillis` as it is, and waits for the whole durable read rather
-   * than evaluating beside a slow one. A result is still evaluated when none is kept,
+   * than evaluating beside a slow one. MCP search serves its kept rows the same way, and renews
+   * rows older than `renewMillis` in the background, a few at a time, instead of evaluating every
+   * app before it answers.
+   * A result is still evaluated when none is kept,
    * and a version, account selection, stored credential or app cache
    * invalidation is another result or forgets the kept one, so only inputs nothing tracks, such as
    * a factory that fetches without the app cache, can be older than they would be otherwise.
@@ -82,11 +91,18 @@ export interface DeclarationLimits {
   readonly entries: number;
   readonly bytes: number;
   readonly entryBytes: number;
+  /**
+   * Background renewals of search rows that run at once in the process or isolate. Each holds an
+   * app's whole listing while it writes its rows, and nobody waits for it, so one past the limit
+   * is not started: a later search tries it again.
+   */
+  readonly renewals: number;
 }
 export const declarationLimits: DeclarationLimits = {
   entries: 2_000,
   bytes: 16 * 1024 * 1024,
   entryBytes: 2 * 1024 * 1024,
+  renewals: 2,
 };
 /**
  * Local and self-host servers. A 7,000-tool catalog with 46 MB of JSON Schema counts 92 MB, and
@@ -96,6 +112,7 @@ export const processDeclarationLimits: DeclarationLimits = {
   entries: 2_000,
   bytes: 256 * 1024 * 1024,
   entryBytes: 64 * 1024 * 1024,
+  renewals: 4,
 };
 
 /**
@@ -159,10 +176,33 @@ export interface DeclarationCache {
   readonly changed: (app: string, at: number) => void;
   /** Whether a result of the app evaluated from `at` predates an invalidation seen here. */
   readonly outdated: (app: string, at: number) => boolean;
+  /**
+   * When this process last started reading the app's durable change marker
+   * (`DurableDeclarations.changed`). Readers start another once it is `changeCheckMillis` old.
+   */
+  readonly checked: (app: string) => number | undefined;
+  readonly check: (app: string, started: number) => void;
   /** What the store holds now, measured as its limits are. */
   readonly usage: () => { readonly entries: number; readonly bytes: number };
+  /**
+   * Admit one background renewal of search rows, or refuse at once when `renewals` already run
+   * here. Nothing waits for a slot, so readers of different requests never wait on each other.
+   * Every admitted renewal ends with `renewed`.
+   */
+  readonly renewing: () => boolean;
+  readonly renewed: () => void;
 }
 
+/**
+ * How long a process serves an app's results without asking the app's durable store whether its
+ * cached data changed since. Data changes in work no reader here sees, such as an app's
+ * background refresh of an MCP tool list after a call replied, or a call in another isolate, so
+ * a result kept in memory is served at most this long after such a change, and by the reads that
+ * overlap the supervisor round trip that learns of it. A read past it starts that round trip
+ * beside itself, at most once per app per process in this window, and does not wait for it.
+ */
+export const changeCheckMillis = 10_000;
+
 /**
  * How long a read that missed this process's store waits for the durable copy before it also
  * starts evaluating, unless it passes `refreshStale: false`. A warm durable store answers well inside it, so a hit never evaluates; a slow
@@ -187,6 +227,11 @@ export interface DurableEntry {
  */
 export interface DurableDeclarations {
   readonly get: (app: string, key: string) => Effect.Effect<DurableEntry | undefined>;
+  /**
+   * When the app's cached data last changed, on the store's clock: results evaluated no later than
+   * then are outdated. Undefined when it never changed or the store could not say.
+   */
+  readonly changed: (app: string) => Effect.Effect<number | undefined>;
   readonly set: (
     app: string,
     key: string,
diff --git a/packages/sdk/src/contracts/executor.ts b/packages/sdk/src/contracts/executor.ts
index 4c5e6c6709..5824f9043f 100644
--- a/packages/sdk/src/contracts/executor.ts
+++ b/packages/sdk/src/contracts/executor.ts
@@ -255,6 +255,22 @@ export interface ExecutorCache {
   readonly toolListings?: Partial<import("./declarations.ts").ToolListingPolicy>;
 }
 
+/**
+ * The API this host serves to apps that sign in to it, such as the built-in Executor app. Those
+ * apps read the API through their own cache, keyed by their build, so an API change their build
+ * cannot see would leave them listing the previous API's tools. The revision is an input of their
+ * app cache and of their kept tool listings: a change starts both afresh. The runner fills such a
+ * cache only with a document of this revision; see `HostApiCheck`.
+ */
+export interface HostApi {
+  /** The SHA-256, in lowercase hex, of the exact document body served at `documents`. */
+  readonly revision: string;
+  /** The URLs this host serves its API document at, one for each origin apps call it at. */
+  readonly documents: ReadonlyArray<string>;
+  /** Whether a version with these requirements signs in to this host, and so reads its API. */
+  readonly reads: (requirements: import("./apps.ts").AppRequirements) => boolean;
+}
+
 /** Caller-owned database, blobs, Git and execution; constructors do not migrate or close them. */
 export interface ExecutorInputs {
   /** Executor tables, app data and the catalog live here. Migrated by the host before use. */
@@ -277,6 +293,8 @@ export interface ExecutorInputs {
   readonly hooks?: ResourceLifecycle;
   readonly workflows?: WorkflowRuntime;
   readonly cache?: ExecutorCache;
+  /** This host's own API, when apps call it; see `HostApi`. */
+  readonly hostApi?: HostApi;
   /** Outbound delivery and authorization for app events. Without it, subscribing is unavailable. */
   readonly events?: import("./events.ts").EventOptions;
   /**
diff --git a/packages/sdk/src/contracts/host-api.ts b/packages/sdk/src/contracts/host-api.ts
new file mode 100644
index 0000000000..843914591b
--- /dev/null
+++ b/packages/sdk/src/contracts/host-api.ts
@@ -0,0 +1,20 @@
+/** How an invocation of an app that reads this host's API is bound to one revision of it. */
+import type { HostApiCheck } from "@executor-js/app-data/host-api";
+
+/** See `HostApi`: the data supervisor binds a facet's network with the same check. */
+export { HostApiCheck } from "@executor-js/app-data/host-api";
+
+/**
+ * Where an invocation's app cache lives: its build, or its build and the host API revision its
+ * code reads. Kept tool listings are keyed by the same value.
+ */
+export const appCacheNamespace = (build: string, hostApi: HostApiCheck | undefined) =>
+  hostApi === undefined ? build : `${build}:${hostApi.revision}`;
+
+/**
+ * The `code` of the rejection an app's `fetch` gets when Executor's network refuses it the host
+ * API's document of another revision, as it does while a deploy changes the API. The rejection
+ * crosses back from the app's isolate as the app's own failure, so its presentation says that the
+ * app reported it.
+ */
+export const hostApiChangingCode = "EXECUTOR_API_CHANGING";
diff --git a/packages/sdk/src/contracts/http.ts b/packages/sdk/src/contracts/http.ts
index 8e1b5d5bb8..45723dc6db 100644
--- a/packages/sdk/src/contracts/http.ts
+++ b/packages/sdk/src/contracts/http.ts
@@ -12,8 +12,9 @@ import { SchedulesGroup } from "./schedules.ts";
 import { ToolsGroup } from "./tools.ts";
 import { AppSkillsGroup } from "./skills.ts";
 import { PublicationsGroup, RegistryGroup } from "./publications.ts";
+import { RequestRejection } from "./shared.ts";
 
-/** The one contract artifact; everything else projects from it. */
+/** The one contract artifact; everything else projects from it. Every endpoint declares request rejections. */
 export const ExecutorApi = HttpApi.make("executor")
   .add(AccountsGroup)
   .add(AccountConnectionsGroup)
@@ -28,6 +29,7 @@ export const ExecutorApi = HttpApi.make("executor")
   .add(AppWorkflowsGroup)
   .add(AppWorkflowRunsGroup)
   .add(PublicationsGroup)
-  .add(RegistryGroup);
+  .add(RegistryGroup)
+  .middleware(RequestRejection);
 
 export type ExecutorApi = typeof ExecutorApi;
diff --git a/packages/sdk/src/contracts/index.ts b/packages/sdk/src/contracts/index.ts
index 63307d0110..15a7a5ac81 100644
--- a/packages/sdk/src/contracts/index.ts
+++ b/packages/sdk/src/contracts/index.ts
@@ -27,4 +27,5 @@ export * from "./scheduler.ts";
 export * from "./source.ts";
 export * from "./public-files.ts";
 export * from "./registry.ts";
+export * from "./wire-revision.ts";
 export * from "./publications.ts";
diff --git a/packages/sdk/src/contracts/oauth.ts b/packages/sdk/src/contracts/oauth.ts
index a30e0d6478..6874082869 100644
--- a/packages/sdk/src/contracts/oauth.ts
+++ b/packages/sdk/src/contracts/oauth.ts
@@ -2,9 +2,14 @@ import { UserFacingError, type ErrorPresentation } from "@executor-js/utils/user
 import { ApiError } from "@executor-js/utils/api-error";
 /** Host-owned OAuth configuration and encrypted protocol records. */
 import type { UrlPolicy } from "@executor-js/utils/url-policy";
-import { AuthMethodName, type AuthMethodInvalid, type ProviderNotFound } from "./provider.ts";
+import {
+  AuthMethodName,
+  type AuthMethodInvalid,
+  type ProviderDefinition,
+  type ProviderNotFound,
+} from "./provider.ts";
 import { AccountConnectionId, type CredentialsError, type StorageError } from "./shared.ts";
-import { Schema, type Effect, type Redacted } from "effect";
+import { Match, Schema, type Effect, type Redacted } from "effect";
 import {
   CredentialHost,
   OAuthAuthorizationParams,
@@ -14,7 +19,7 @@ import {
   OAuthTokenResponse,
   PlacementHeaderName,
 } from "apps/contracts";
-import { Account } from "./account.ts";
+import { Account, type AccountFieldsInvalid } from "./account.ts";
 export { OAuthClientAuth } from "apps/contracts";
 import type { HttpClient } from "effect/http";
 import { AccountId, HttpUrl, JsonObject, OwnerId, ProviderId } from "./shared.ts";
@@ -46,12 +51,51 @@ export const OAuthStartResult = Schema.Union([
 ]);
 export type OAuthStartResult = typeof OAuthStartResult.Type;
 
+/**
+ * Where a sign-in's RFC 8707 resource indicator came from, or why it sends none:
+ * - `declared`: the provider's own `resource`; `resource: null` declares none.
+ * - `metadata`: the protected-resource metadata of the URL the provider discovers from.
+ * - `operator`: this instance's own OAuth client for the service, which may set none. A provider's
+ *   `resource` does not apply to it.
+ * - `inferred_scope_audience`: none, because Executor inferred from the authorization server's own
+ *   metadata (a `/v2.0` issuer with `cloud_instance_name`, as Microsoft identity platform publishes)
+ *   that it takes the token's audience from the scopes, so it did not send the resource the
+ *   protected-resource metadata names. Executor does not verify that inference; a declared
+ *   `resource` is always sent.
+ * - `none`: none, because the provider declares no `resource` and no metadata names one.
+ */
+export const OAuthResourceSource = Schema.Literals([
+  "declared",
+  "metadata",
+  "operator",
+  "inferred_scope_audience",
+  "none",
+]);
+export type OAuthResourceSource = typeof OAuthResourceSource.Type;
+/**
+ * The resource indicator a sign-in sends on its authorization request, exchange and renewals, and
+ * where it came from. `value` is null when it sends none, and `source` then says why.
+ */
+export const OAuthResourceIndicator = Schema.Union([
+  Schema.Struct({
+    value: HttpUrl,
+    source: Schema.Literals(["declared", "metadata", "operator"]),
+  }),
+  Schema.Struct({
+    value: Schema.Null,
+    source: Schema.Literals(["declared", "operator", "inferred_scope_audience", "none"]),
+  }),
+]);
+export type OAuthResourceIndicator = typeof OAuthResourceIndicator.Type;
+
 const clientSetup = {
   /** `automatic`: a client metadata document or dynamic registration can supply a client. */
   mode: Schema.Literals(["automatic", "client-required"]),
   scopes: Schema.Array(Schema.String),
   /** Signing in uses the instance's own OAuth client, named here; see `FirstPartyOAuthClient`. */
   firstParty: Schema.optionalKey(Schema.Struct({ label: Schema.NonEmptyString })),
+  /** The resource indicator sign-in sends, or why it sends none. */
+  resource: OAuthResourceIndicator,
 };
 /** Safe form metadata resolved from provider code and discovery. Never contains client IDs or secrets. */
 export const OAuthClientSetup = Schema.Union([
@@ -349,7 +393,10 @@ export const FirstPartyOAuthServer = Schema.Struct({
    * reports `repo,gist` whatever separator the request used. Defaults to whitespace only.
    */
   grantedScopeSeparator: Schema.optionalKey(Schema.NonEmptyString),
-  /** Extra authorization request parameters, such as `{ access_type: "offline" }`. */
+  /**
+   * Extra authorization request parameters. Google's `access_type=offline` and `prompt=consent`
+   * are always sent to Google, so they need not be listed.
+   */
   authorizationParams: Schema.optionalKey(OAuthAuthorizationParams),
   tokenRequestFormat: Schema.optionalKey(OAuthTokenRequestFormat),
   tokenResponse: Schema.optionalKey(OAuthTokenResponse),
@@ -707,6 +754,8 @@ export const OAuthCompletionReason = Schema.Literals([
   "registered_client_rejected",
   "registered_client_incompatible",
   "exchange_failed",
+  // The service refused the RFC 8707 resource indicator, at authorization or the exchange.
+  "resource_rejected",
   "destination_blocked",
   "service_unavailable",
   "rate_limited",
@@ -727,6 +776,96 @@ const restart = (
   agentFixable: false,
 });
 
+/**
+ * The service answered RFC 8707's `invalid_target` to a sign-in, which refuses a missing, unknown
+ * or unaccepted resource indicator. The recovery goes to whoever can change what the sign-in sends:
+ * the app's OAuth settings for a provider's declaration, its discovered metadata or its absence,
+ * and the instance administrator for the operator's client, which a provider's `resource` does
+ * not change. A refusal whose indicator Executor did not record names no one.
+ */
+const resourceRejected = (resource: OAuthResourceIndicator | undefined): ErrorPresentation => {
+  const declare =
+    "Declare the provider's `resource` as the identifier the service documents, or `resource: null` if it takes no resource indicator, then start a fresh sign-in.";
+  const declareOne =
+    "If the service documents a resource identifier, declare it as the provider's `resource`, then start a fresh sign-in.";
+  const administrator = {
+    action: "Ask the instance administrator to check the OAuth client’s resource.",
+    instructions: (sent: string) =>
+      `${sent} This instance's own OAuth client for the service sets it, and a provider's \`resource\` does not apply to that client, so changing the app does not change this request. The instance administrator can compare the client's resource with the identifier the service documents.`,
+  };
+  const app = "Set the resource the service documents in the app’s OAuth settings.";
+  const recovery =
+    resource === undefined
+      ? {
+          recovery: {
+            action: "Start a fresh sign-in.",
+            instructions:
+              "Executor did not record which resource indicator this sign-in sent. Start a fresh sign-in; if the service refuses it too, the new failure names the indicator and who can change it.",
+          },
+          agentFixable: false,
+        }
+      : resource.source === "operator"
+        ? {
+            recovery: {
+              action: administrator.action,
+              instructions: administrator.instructions(
+                resource.value === null
+                  ? "Executor sent no RFC 8707 resource indicator."
+                  : `Executor sent the RFC 8707 resource indicator ${resource.value}.`,
+              ),
+            },
+            agentFixable: false,
+          }
+        : {
+            recovery: {
+              action: app,
+              instructions:
+                resource.value === null
+                  ? Match.value(resource.source).pipe(
+                      Match.when(
+                        "declared",
+                        () =>
+                          `Executor sent no RFC 8707 resource indicator, because the provider declares \`resource: null\`. ${declareOne}`,
+                      ),
+                      Match.when(
+                        "inferred_scope_audience",
+                        () =>
+                          `Executor sent no RFC 8707 resource indicator. The authorization server's metadata has a \`/v2.0\` issuer and a \`cloud_instance_name\`, as Microsoft identity platform's does, so Executor inferred that the server takes the token's audience from the requested scopes and did not send the resource its protected-resource metadata names. Executor did not verify this, and the service refused the sign-in, so it may need a resource. A declared \`resource\` is always sent: declare the identifier the service documents as the provider's \`resource\`, then start a fresh sign-in.`,
+                      ),
+                      Match.when(
+                        "none",
+                        () =>
+                          `Executor sent no RFC 8707 resource indicator: the provider declares no \`resource\`, and no protected-resource metadata it discovers from names one. ${declareOne}`,
+                      ),
+                      Match.exhaustive,
+                    )
+                  : Match.value(resource.source).pipe(
+                      Match.when(
+                        "metadata",
+                        () =>
+                          `Executor sent the RFC 8707 resource indicator ${resource.value}, which the service's protected-resource metadata names. The provider declares no \`resource\`, so declaring that same value sends the same request. A service's API and its MCP server can have different identifiers. ${declare}`,
+                      ),
+                      Match.when(
+                        "declared",
+                        () =>
+                          `Executor sent the RFC 8707 resource indicator ${resource.value}, which the provider declares as its \`resource\`. Compare it with the identifier the service documents, including any path and trailing slash. ${declare}`,
+                      ),
+                      Match.exhaustive,
+                    ),
+            },
+          };
+  return {
+    title: "Service refused the requested resource",
+    description:
+      resource === undefined
+        ? "The service reported a missing or unknown resource indicator, so it issued no token."
+        : resource.value === null
+          ? "The service reported a missing or unknown resource indicator. This sign-in sent none, so it got no token."
+          : "The service refused the resource indicator this sign-in sent, so it issued no token.",
+    ...recovery,
+  };
+};
+
 /** Sign-in completion failed. Saved account credentials are not changed. */
 export const OAuthCompletionFailed = UserFacingError.define({
   tag: "OAuthCompletionFailed",
@@ -737,9 +876,11 @@ export const OAuthCompletionFailed = UserFacingError.define({
     cause: Schema.optional(OAuthFailureCause),
     serviceError: Schema.optional(OAuthServiceError),
     retryAfter: RetryAfter,
+    /** With `resource_rejected`, the indicator the sign-in sent, or why it sent none. */
+    resource: Schema.optional(OAuthResourceIndicator),
   },
   recorded: ({ reason, cause }) => oauthRecorded("Sign-in completion failed", reason, cause),
-  presentation: ({ reason, cause, serviceError, retryAfter }) =>
+  presentation: ({ reason, cause, serviceError, retryAfter, resource }) =>
     withCause(
       (
         {
@@ -886,6 +1027,7 @@ export const OAuthCompletionFailed = UserFacingError.define({
                 "Inspect the app’s OAuth token endpoint, client authentication method, callback configuration, and requested scopes. Fix verified configuration errors and start a fresh sign-in; never replay a consumed code.",
             },
           },
+          resource_rejected: resourceRejected(resource),
           destination_blocked: {
             title: "OAuth address blocked",
             description:
@@ -984,6 +1126,7 @@ export const oauthCompletionRecovery = {
   registered_client_rejected: "restart",
   registered_client_incompatible: "configuration",
   exchange_failed: "configuration",
+  resource_rejected: "configuration",
   destination_blocked: "configuration",
   service_unavailable: "restart",
   rate_limited: "restart",
@@ -1325,6 +1468,8 @@ export const OAuthAttempt = Schema.Struct({
   /** An entered client registered under the attempt's owner once it completes. */
   saveClient: Schema.optionalKey(Schema.Literal(true)),
   resource: Schema.optional(HttpUrl),
+  /** Where `resource` came from, so a refusal can say. Attempts started before it was kept lack it. */
+  resourceSource: Schema.optional(OAuthResourceSource),
   /** Token request encoding and nested grant location, as the provider declared them. */
   tokenRequestFormat: Schema.optional(OAuthTokenRequestFormat),
   tokenResponse: Schema.optional(OAuthTokenResponse),
@@ -1376,6 +1521,12 @@ export const OAuthGrant = Schema.Union([
     /** The stored client signed in with. The grant keeps its own copy for renewal. */
     oauthClient: Schema.optionalKey(OAuthClientId),
     refreshToken: Schema.optional(Schema.NonEmptyString),
+    /**
+     * The callback the sign-in sent, sent again on each refresh for servers that require it.
+     * Imported grants renew as the product that issued them did, and grants saved before it was
+     * retained renew as they did, so both omit it.
+     */
+    redirectUri: Schema.optional(HttpUrl),
     /**
      * Scopes each refresh asks for again, space-separated. Only imported grants carry them, as the
      * product that issued the grant sent them; other refreshes ask for none, keeping what was
@@ -1409,6 +1560,8 @@ export const OAuthGrant = Schema.Union([
     expiresAt: Schema.optional(Schema.Number),
     fields: JsonObject,
     refreshToken: Schema.optional(Schema.NonEmptyString),
+    /** The callback the sign-in sent, kept across host callback changes; see the grant above. */
+    redirectUri: Schema.optional(HttpUrl),
     /**
      * Scopes each refresh asks for again. Only imported grants carry them, as the product that
      * issued the grant sent them; see the other authorization code grant's `scopes`.
@@ -1516,6 +1669,24 @@ export interface OAuthGrantImport {
     | OAuthSetupFailed
     | OAuthGrantNotImportable
   >;
+  /**
+   * Check the grant as `importOAuthGrant` would, against `definition`, the provider an app that is
+   * not deployed declares, and save nothing: the v1 import's dry run refuses exactly the grants an
+   * import would. Runs the provider's discovery, but no token request.
+   */
+  readonly checkOAuthGrant: (
+    input: ImportOAuthGrant & { readonly definition: ProviderDefinition },
+  ) => Effect.Effect<void, AuthMethodInvalid | OAuthSetupFailed | OAuthGrantNotImportable>;
+  /**
+   * Check an account's fields as `managedAccounts.add` would, against `definition`, the provider an
+   * app that is not deployed declares, and save nothing.
+   */
+  readonly checkAccountFields: (input: {
+    readonly provider: ProviderId;
+    readonly definition: ProviderDefinition;
+    readonly method: string;
+    readonly fields: Redacted.Redacted<JsonObject>;
+  }) => Effect.Effect<void, AuthMethodInvalid | AccountFieldsInvalid>;
   /** The operator's client `id` when it is offered here, which its credentials being set decides. */
   readonly firstPartyClient: (id: string) => FirstPartyOAuthClientDescription | undefined;
   /**
@@ -1524,4 +1695,38 @@ export interface OAuthGrantImport {
    * verifies its accounts with it.
    */
   readonly credentialsReadable: (account: AccountId) => Effect.Effect<boolean, StorageError>;
+  /**
+   * Move an imported account to another provider, under `method`, when that method's definition is
+   * the one the account was saved for, so its credentials fit unchanged. An importer that
+   * generates an app again uses it for the accounts an earlier run saved: the app's provider
+   * changes with any method it gains or loses, or a new name. Returns whether it moved.
+   */
+  readonly moveImportedAccount: (input: {
+    readonly account: AccountId;
+    readonly provider: ProviderId;
+    readonly method: string;
+  }) => Effect.Effect<boolean, StorageError>;
+  /**
+   * Replace an imported account's tokens with those the issuing product holds now, when the
+   * product holds another refresh token and the grant needs reconnecting or the product renewed
+   * the grant after this account did: a service that rotates refresh tokens keeps only the last
+   * renewal's. Keeps the grant's client and renewal settings, and keeps a grant reconnected since
+   * the import. A grant being renewed is decided once its renewal saved the result. Makes no token
+   * request.
+   */
+  readonly refreshImportedGrant: (
+    account: AccountId,
+    tokens: ImportedGrantTokens,
+  ) => Effect.Effect<"kept" | "replaced", StorageError | CredentialsError>;
+  /**
+   * Remove an account an import saved, as `accounts.remove` does, without revoking its grant at
+   * the provider: the issuing product holds the same grant and keeps using it once the import is
+   * rolled back.
+   */
+  readonly removeImportedAccount: import("./executor.ts").Executor["accounts"]["remove"];
 }
+/** An imported grant's tokens as the issuing product holds them (`refreshImportedGrant`). */
+export type ImportedGrantTokens = Pick<
+  ImportOAuthGrant,
+  "accessToken" | "refreshToken" | "expiresAt"
+>;
diff --git a/packages/sdk/src/contracts/registry.ts b/packages/sdk/src/contracts/registry.ts
index 07cec7d148..7ffb1cdbd1 100644
--- a/packages/sdk/src/contracts/registry.ts
+++ b/packages/sdk/src/contracts/registry.ts
@@ -23,6 +23,8 @@ export type PackageName = typeof PackageName.Type;
 export const packageScope = (name: PackageName) => name.slice(1, name.indexOf("/"));
 /** The label of a package name: what stays when its owner's scope changes. */
 export const packageLabel = (name: PackageName) => name.slice(name.indexOf("/") + 1);
+/** Public packages are published under `<slug>.executor.community`, an organization's scope. */
+export const publishingDomain = "executor.community";
 /** Standard npm metadata remains source; only name and description identify a public listing. */
 export const PackageManifest = Schema.Struct({
   name: PackageName,
diff --git a/packages/sdk/src/contracts/runtime.ts b/packages/sdk/src/contracts/runtime.ts
index a94795a505..944884a003 100644
--- a/packages/sdk/src/contracts/runtime.ts
+++ b/packages/sdk/src/contracts/runtime.ts
@@ -22,6 +22,7 @@ import { BuildStage, SourceLocation, type BuildMemoryExceeded } from "./version.
 import type { CodeFiles } from "./source.ts";
 import { BuildId, Json } from "./shared.ts";
 import type { BlobKey, BlobRange } from "./blobs.ts";
+import type { HostApiCheck } from "./host-api.ts";
 
 /**
  * Runtimes report that an invocation invalidated or explicitly refreshed the app's cached
@@ -145,6 +146,25 @@ export const RuntimeCallTimings = Context.Reference<
   ((timing: RuntimeCallTiming) => void) | undefined
 >("executor/RuntimeCallTimings", { defaultValue: () => undefined });
 
+/**
+ * What a failed call names as its cause, recorded as `executor.failure.source`. `app`: the app's
+ * code or declarations. `upstream`: a service the app calls. `runtime`: Executor's app runtime or
+ * host, which got no usable answer from the app's code, such as a lost reply or a Worker limit.
+ * `storage`: the app's data or cache, or Executor's own storage. `approval`: an approval or the
+ * tool's approval policy. `other`: anything else, such as an account the call cannot use. The
+ * app's code chooses or can cause every kind, so this says what the call failed with, not who is at
+ * fault.
+ */
+export type CallFailureSource = "app" | "upstream" | "runtime" | "storage" | "approval" | "other";
+
+/**
+ * Receives the source of each runtime failure within one tool call, before the failure becomes
+ * the caller's error, whose kind can no longer tell them apart. Telemetry only.
+ */
+export const CallFailureSources = Context.Reference<
+  ((source: CallFailureSource) => void) | undefined
+>("executor/CallFailureSources", { defaultValue: () => undefined });
+
 /**
  * Told when the host hands an invocation to the app's runner. From then on the app's code may have
  * run, its factory included, and may have made external changes, whatever the invocation later
@@ -370,6 +390,7 @@ export type RuntimeLoadError =
   | RuntimeProtocolUnsupported;
 
 /** Framework-facing operations, independent of Node or Cloudflare bindings. */
+
 export interface Runtime<Requirements = never> {
   /** Optional cross-process invalidation feed. The initial event follows registration.
    * A revision identifies all writes before that event; unversioned hosts emit void.
@@ -412,6 +433,8 @@ export interface Runtime<Requirements = never> {
       readonly build: BuildId;
       /** The build declares `sharedRuntime`: its runtime is named by build alone; see `appWorker`. */
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly sources?: boolean;
     } & HostContext,
   ) => Effect.Effect<SkillCatalog, RuntimeLoadError | typeof HostInspectError.Type, Requirements>;
@@ -421,6 +444,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly tools?: readonly string[];
       /** Describe only declared operations with schedules. Send only to scheduledTools builds. */
       readonly scheduled?: true;
@@ -438,6 +463,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
     } & HostContext,
   ) => Effect.Effect<
     HostedCatalogSummary,
@@ -449,6 +476,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly database: boolean;
       /** Report the storage revision read by this successful query, never an authored result. */
       readonly observeRevision?: (revision: number) => void;
@@ -461,6 +490,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly database: boolean;
       readonly name: string;
       readonly input: Json;
@@ -472,6 +503,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly database: boolean;
       readonly command: WebhookCommand;
     } & HostContext,
@@ -482,6 +515,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly command: WorkflowCommand;
     } & HostContext,
   ) => Effect.Effect<Json, RuntimeLoadError | typeof HostCallError.Type, Requirements>;
@@ -490,6 +525,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly database: boolean;
       readonly tool: string;
       /** Decides the storage mode before the app runs; the host verifies it. */
@@ -506,6 +543,8 @@ export interface Runtime<Requirements = never> {
       readonly app: string;
       readonly build: BuildId;
       readonly sharedRuntime: boolean;
+      /** Set for an app that reads the host API; see `HostApiCheck`. */
+      readonly hostApi: HostApiCheck | undefined;
       readonly requirement: string;
     } & HostContext,
   ) => Effect.Effect<
diff --git a/packages/sdk/src/contracts/shared.ts b/packages/sdk/src/contracts/shared.ts
index e099f01a8a..97097e373a 100644
--- a/packages/sdk/src/contracts/shared.ts
+++ b/packages/sdk/src/contracts/shared.ts
@@ -1,8 +1,8 @@
-import { ApiError } from "@executor-js/utils/api-error";
 import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import { callPresentation, MayHaveWritten } from "./call-presentation.ts";
 /** Shared contract primitives: IDs, ownership, JSON, pagination and write-only secrets. */
 import { Schema } from "effect";
+import { HttpApiMiddleware } from "effect/http-api";
 export { AccountId, HttpUrl } from "apps/contracts";
 
 /**
@@ -38,8 +38,13 @@ export type ProviderId = typeof ProviderId.Type;
 export const WebhookId = Id("whk");
 export type WebhookId = typeof WebhookId.Type;
 
-/** Id of an App (see `apps.ts`), prefix `app_`. */
-export const AppId = Id("app");
+/**
+ * Id of an App (see `apps.ts`), prefix `app_`. Tool signatures show schema descriptions, so the
+ * description tells agents which value to pass.
+ */
+export const AppId = Id("app").annotate({
+  description: "App ID, such as app_…, from the app's `id`. An app's slug or name is not accepted.",
+});
 
 export type AppId = typeof AppId.Type;
 
@@ -149,15 +154,62 @@ export const CredentialsError = UserFacingError.define({
 /** Parsed CredentialsError failure. */
 export type CredentialsError = typeof CredentialsError.Type;
 
-/** Invalid SDK input; submitted fields are never included in the error. */
-export const RequestInvalid = ApiError.define({
+/** The part of an HTTP request an operation's schema rejected. */
+export const RequestPart = Schema.Literals(["path", "headers", "query", "body"]);
+export type RequestPart = typeof RequestPart.Type;
+
+/**
+ * One place a request did not match its operation's schema: a JSON path into the rejected part,
+ * such as `$.files`, and what the schema expects there. Executor's schemas state the expectation;
+ * the submitted value is not repeated.
+ */
+export const RequestIssue = Schema.Struct({ path: Schema.String, expected: Schema.String });
+export type RequestIssue = typeof RequestIssue.Type;
+
+const requestInvalidDescription =
+  "Executor could not accept this request's input. Check it against the operation's schema; submitted values are not repeated here.";
+
+/**
+ * Invalid SDK input; submitted fields are never included in the error. A request its operation's
+ * schema rejected names the part and each place that did not match.
+ */
+export const RequestInvalid = UserFacingError.define({
   tag: "RequestInvalid",
   status: 400,
-  message:
-    "Executor could not accept this request's input. Check it against the operation's schema; submitted values are not repeated here.",
+  fields: {
+    part: Schema.optionalKey(RequestPart),
+    issues: Schema.optionalKey(Schema.Array(RequestIssue)),
+  },
+  recorded: ({ part }) =>
+    part === undefined
+      ? requestInvalidDescription
+      : `Executor rejected this request's ${part} because it does not match the operation's schema.`,
+  presentation: ({ part, issues }) => ({
+    title: "Request input not accepted",
+    description:
+      part === undefined || issues === undefined || issues.length === 0
+        ? requestInvalidDescription
+        : `Executor rejected this request's ${part} because it does not match the operation's schema: ${issues
+            .map((issue) => `${issue.path}: ${issue.expected}`)
+            .join("; ")}.`,
+    recovery: {
+      action: "Correct the input and send the request again.",
+      instructions:
+        "Read each listed path and what the operation's schema expects there, correct those values, and send the corrected request. Read the operation's input schema for the full shape. Sending the same input again fails the same way.",
+    },
+  }),
 });
 export type RequestInvalid = typeof RequestInvalid.Type;
 
+/**
+ * Answers a request its endpoint's schema rejects with `RequestInvalid`. Every product API applies
+ * it to every endpoint, so each operation's published errors include that response.
+ */
+export class RequestRejection extends HttpApiMiddleware.Service<RequestRejection>()(
+  "executor/RequestRejection",
+  { error: RequestInvalid },
+) {}
+
 /** Opaque pending account setup identity; hosts enforce access separately. */
 export const AccountConnectionId = Id("con");
 export type AccountConnectionId = typeof AccountConnectionId.Type;
diff --git a/packages/sdk/src/contracts/tools.ts b/packages/sdk/src/contracts/tools.ts
index 547a69a305..e90ef8fb0f 100644
--- a/packages/sdk/src/contracts/tools.ts
+++ b/packages/sdk/src/contracts/tools.ts
@@ -24,7 +24,10 @@ import {
   ApprovalElicitation,
   ApprovalResponse,
   ElicitationFailed,
+  HostAccountsInvalid,
+  HostDeclarationInvalid,
   HostEvaluationFailed,
+  HostRequestInvalid,
   HostedRouter,
   type HostRouterError,
   HostedTool,
@@ -32,6 +35,14 @@ import {
   type ElicitationHandler,
 } from "apps/contracts";
 import { StorageError, CredentialsError, RequestInvalid } from "./shared.ts";
+import { hostApiChangingCode } from "./host-api.ts";
+import {
+  RuntimeBuildUnavailable,
+  RuntimeFailure,
+  runtimeFailures,
+  RuntimeProtocolFailed,
+  RuntimeProtocolUnsupported,
+} from "./runtime.ts";
 import type { CatalogReadOptions } from "./declarations.ts";
 import type { Executor } from "./executor.ts";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
@@ -431,6 +442,14 @@ export interface SearchableTools {
   readonly accounts: AppAccounts;
   /** The listing's routers that could not list their tools. */
   readonly routers: ReadonlyArray<ToolRouter>;
+  /**
+   * The rows are an earlier listing's, evaluated at `listedAt`, kept because renewing them failed
+   * in the app or its upstream with `failure`.
+   */
+  readonly stale?: {
+    readonly listedAt: number;
+    readonly failure: AppEvaluationFailed | AppProviderFailed;
+  };
 }
 
 /**
@@ -560,6 +579,28 @@ export const appFailureText = ({ source, errorName, code, message, fields }: App
       ? `The app's API call failed: ${message}`
       : `The app threw ${errorName}${code === undefined ? "" : ` (${code})`}: ${message}${fieldsText(fields)}`;
 
+/**
+ * The app reported that Executor refused it Executor's own API document because the document is
+ * of another revision than the one its tools are kept for, as Executor's network does while a
+ * deploy changes the API (`hostApiChangingCode`, on a rejected `fetch` or on the `HttpClientError`
+ * `ctx.fetch` wraps it in). The report crosses from the app's isolate, so the copy says the app
+ * reported it. It clears when the deploy finishes.
+ */
+const hostApiChanging = (failure: AppFailure) =>
+  failure.source === "app" && failure.code === hostApiChangingCode
+    ? {
+        title: "Executor’s API is changing",
+        description:
+          "The app reported that Executor’s API is changing (a deploy is in progress), so it could not load its tools.",
+        recovery: {
+          action: "Retry shortly.",
+          instructions:
+            "The app reads Executor's own API. Executor refuses it a version of that API other than the one its tools are kept for, which happens for a few seconds while a deploy changes the API. Retry in a few seconds, at most a few times. If it continues for minutes, report it to whoever operates this Executor.",
+        },
+        retryable: true,
+      }
+    : undefined;
+
 /** The error a service stated, with its own message quoted after Executor's explanation. */
 const upstreamText = (upstream: UpstreamError | undefined, stated: string) =>
   upstream === undefined
@@ -845,6 +886,213 @@ export const mcpFailurePresentation = ({
   }
 };
 
+/** The errors an app's framework answers with when it cannot evaluate the app without details. */
+const FrameworkError = Schema.Literals([
+  "HostRequestInvalid",
+  "HostAccountsInvalid",
+  "HostDeclarationInvalid",
+  "HostEvaluationFailed",
+]);
+
+/**
+ * What failed when the app's definition could not be evaluated and neither the app's code nor a
+ * service it called stated an error: the app's Worker, the build Executor keeps for it, the host
+ * protocol the build speaks, or the app's framework, which answered without details.
+ */
+export const EvaluationRuntime = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("worker"),
+    /** The failure the runtime's error matched, absent when the runtime reported none. */
+    failure: Schema.optional(RuntimeFailure),
+  }),
+  Schema.Struct({ kind: Schema.Literal("build") }),
+  Schema.Struct({
+    kind: Schema.Literal("protocol"),
+    protocol: Schema.Int,
+    supported: Schema.Array(Schema.Int),
+  }),
+  Schema.Struct({ kind: Schema.Literal("framework"), error: FrameworkError }),
+]);
+export type EvaluationRuntime = typeof EvaluationRuntime.Type;
+
+/**
+ * The runtime failures only the host's own code sets: its read of the build, its protocol check,
+ * and its account handling. Every other kind is matched from the text a failed call rejected with,
+ * which the app's isolate can produce, the runtime's own messages included.
+ */
+const hostRuntimeFailures: ReadonlySet<RuntimeFailure> = new Set([
+  "build",
+  "unsupported",
+  "managed",
+]);
+const loadingInstructions =
+  "This happened while Executor loaded the app's definition, before any tool ran. Do not change the app's accounts to work around it.";
+const rebuild = {
+  action: "Rebuild the app on this host’s apps version and deploy it again.",
+  instructions: `${loadingInstructions} Read framework.release for the apps version this host runs, pin it in the app's package.json, deploy the app again, and verify that its tools load.`,
+};
+const retryOnce = (then: string, instructions: string) => ({
+  action: `Try again once. If it fails the same way, ${then}`,
+  instructions: `${loadingInstructions} Retry the unchanged request at most once. ${instructions} Verify that the app's tools load after the repair.`,
+});
+const reportReference =
+  "If it fails again, report the failure with the reference shown beside this error, if any, and check what the app's recent changes run while it lists its tools.";
+
+/** What the app's Worker failure says and what to do about it. */
+const workerPresentation = (failure: RuntimeFailure | undefined) => {
+  const stopped = "The app’s Worker stopped without an answer from the app’s code";
+  const description =
+    failure === undefined
+      ? `${stopped}, and the runtime did not report why.`
+      : failure === "unrecognized"
+        ? `${stopped}, for a reason the runtime did not recognize.`
+        : hostRuntimeFailures.has(failure)
+          ? `${runtimeFailures[failure]}.`
+          : `${stopped}. Its error matches this cause, which Executor has not confirmed: ${runtimeFailures[failure]}.`;
+  switch (failure) {
+    case "memory":
+    case "cpu":
+    case "timeout":
+    case "too-large":
+      return {
+        description,
+        recovery: retryOnce(
+          "reduce the work the app does to list its tools.",
+          "A resource limit matches this failure. Find what the app's factory and tool loaders do while listing, such as fetching or parsing a large API definition or building many tools, and reduce it: expose fewer tools, or keep a large definition in the app's cache.",
+        ),
+        retryable: true,
+      };
+    case "cold-start":
+      return {
+        description,
+        recovery: retryOnce(
+          "check that the app’s modules load without throwing.",
+          "A Worker that could not be loaded matches this failure, such as a module whose top-level code throws or an import that cannot be resolved. Check the app's modules and imports, then deploy it again.",
+        ),
+        retryable: true,
+      };
+    case "hung":
+      return {
+        description,
+        recovery: retryOnce(
+          "check that the app’s factory does not wait on something that never finishes.",
+          "A Worker that can never answer matches this failure, such as code that awaits a promise nothing settles.",
+        ),
+        retryable: true,
+      };
+    case "invalid-reply":
+      return {
+        description,
+        recovery: retryOnce(
+          "rebuild the app on this host’s apps version.",
+          "An answer that does not match the host protocol matches this failure, such as one from an app built on another apps version. Read framework.release for the apps version this host runs, pin it in the app's package.json and deploy the app again.",
+        ),
+        retryable: true,
+      };
+    case "build":
+      return {
+        description,
+        recovery: retryOnce(
+          "deploy the app again.",
+          "Executor could not read the build it keeps for the app's current deployment. Deploying the app's source again creates a new build.",
+        ),
+        retryable: true,
+      };
+    case "unsupported":
+    case "managed":
+      return { description, recovery: rebuild, retryable: false };
+    default:
+      return {
+        description,
+        recovery: retryOnce(
+          "report the failure with its reference.",
+          `This does not show whether the app's code or Executor's runtime caused it. ${reportReference}`,
+        ),
+        retryable: true,
+      };
+  }
+};
+
+/** What the framework's answer without details reports. */
+const frameworkFailures: Record<typeof FrameworkError.Type, string> = {
+  HostRequestInvalid: "it could not read Executor’s request",
+  HostAccountsInvalid: "the accounts Executor sent do not match the ones the app declares",
+  HostDeclarationInvalid: "the app’s tools or skills are declared in a way it cannot host",
+  HostEvaluationFailed:
+    "evaluating the app failed; builds on older apps versions report no further detail",
+};
+
+/** Present a failure of the app's runtime, build or framework while loading its definition. */
+const runtimePresentation = (runtime: EvaluationRuntime): CausePresentation => {
+  const loaded = (description: string) =>
+    `Executor could not load this app’s tool definitions. ${description}`;
+  switch (runtime.kind) {
+    case "worker":
+    case "build": {
+      const { description, ...rest } = workerPresentation(
+        runtime.kind === "build" ? "build" : runtime.failure,
+      );
+      return { title: "Tools could not be loaded", description: loaded(description), ...rest };
+    }
+    case "protocol":
+      return {
+        title: "App build is not supported",
+        description: loaded(
+          `This app’s apps framework uses host protocol ${runtime.protocol}; this host runs protocol ${runtime.supported.join(", ")}.`,
+        ),
+        recovery: rebuild,
+        retryable: false,
+      };
+    case "framework":
+      return {
+        title: "Tools could not be loaded",
+        description: loaded(
+          `The app’s framework answered ${runtime.error} without details: it reported that ${frameworkFailures[runtime.error]}.`,
+        ),
+        recovery: retryOnce(
+          "rebuild the app on this host’s apps version.",
+          `The app's framework reported this, so Executor has not confirmed its cause. An app built on an apps version far from this host's is a common one.${runtime.error === "HostDeclarationInvalid" ? " Check the app's tool and skill declarations too, such as duplicate tool names or invalid schemas." : ""} Read framework.release for the apps version this host runs, pin it in the app's package.json and deploy the app again.`,
+        ),
+        retryable: true,
+      };
+  }
+};
+
+/** What traces record for a runtime failure: closed literals only. */
+const recordedRuntime = (runtime: EvaluationRuntime) => {
+  switch (runtime.kind) {
+    case "worker":
+      return `the app's Worker failed (${runtime.failure ?? "unreported"})`;
+    case "build":
+      return "the app's build could not be read";
+    case "protocol":
+      return "the app's build uses a host protocol this host does not run";
+    case "framework":
+      return `the app's framework answered ${runtime.error}`;
+  }
+};
+
+/** The runtime failure an evaluation's error reports, if it is one. */
+const evaluationRuntime = (error: unknown): EvaluationRuntime | undefined => {
+  if (Schema.is(RuntimeProtocolFailed)(error))
+    return {
+      kind: "worker",
+      ...(error.reason === undefined ? {} : { failure: error.reason }),
+    };
+  if (Schema.is(RuntimeBuildUnavailable)(error)) return { kind: "build" };
+  if (Schema.is(RuntimeProtocolUnsupported)(error))
+    return { kind: "protocol", protocol: error.protocol, supported: error.supported };
+  if (Schema.is(HostRequestInvalid)(error))
+    return { kind: "framework", error: "HostRequestInvalid" };
+  if (Schema.is(HostAccountsInvalid)(error))
+    return { kind: "framework", error: "HostAccountsInvalid" };
+  if (Schema.is(HostDeclarationInvalid)(error))
+    return { kind: "framework", error: "HostDeclarationInvalid" };
+  if (Schema.is(HostEvaluationFailed)(error))
+    return { kind: "framework", error: "HostEvaluationFailed" };
+  return undefined;
+};
+
 /**
  * Evaluating the app's live definition failed before any tool ran. With `mayHaveWritten`, it
  * failed during a call that may write, after the host handed the call to the app's code, which
@@ -873,9 +1121,14 @@ export const AppEvaluationFailed = UserFacingError.define({
      * including the session a tool call opens, or while listing its tools.
      */
     mcp: Schema.optional(McpFailure),
+    /**
+     * Present when the app's Worker, its build or its framework failed without an error of the
+     * app's own: the runtime failure Executor observed or matched.
+     */
+    runtime: Schema.optional(EvaluationRuntime),
     mayHaveWritten: MayHaveWritten,
   },
-  recorded: ({ skills, mcp, failure }) =>
+  recorded: ({ skills, mcp, failure, runtime }) =>
     `Tools could not be loaded: ${
       mcp !== undefined
         ? recordedMcp(mcp)
@@ -883,36 +1136,53 @@ export const AppEvaluationFailed = UserFacingError.define({
           ? recordedApp(failure)
           : skills !== undefined
             ? `the app's skill source failed (${skills.reason})${recordedStatus(skills.status)}`
-            : "the app's definition could not be evaluated"
+            : runtime !== undefined
+              ? recordedRuntime(runtime)
+              : "the app's definition could not be evaluated"
     }`,
-  presentation: callPresentation(({ skills, mcp, failure }) =>
+  presentation: callPresentation(({ skills, mcp, failure, runtime }) =>
     mcp !== undefined
       ? mcpFailurePresentation(mcp)
-      : failure !== undefined
-        ? {
-            title: "Tools could not be loaded",
-            description: `Executor could not load this app’s tool definitions. ${appFailureText(failure)}`,
-            recovery: {
-              action: "Try again. If this continues, investigate this error and fix its cause.",
-              instructions: `The app's factory or dynamic tool loader failed with this error. It does not show whether the cause is the app's code, a service the app calls, or Executor, such as its storage or network. A transient cause, such as an unavailable upstream, may clear on retry. Otherwise find where the error is raised and what caused it, fix the cause, and verify that the app's tools load. Error: ${appFailureText(failure)}`,
-            },
-            retryable: true,
-          }
-        : skills === undefined
-          ? {
+      : runtime !== undefined && failure === undefined
+        ? runtimePresentation(runtime)
+        : failure !== undefined
+          ? (hostApiChanging(failure) ?? {
               title: "Tools could not be loaded",
-              description: "Executor could not load this app’s tool definitions.",
+              description: `Executor could not load this app’s tool definitions. ${appFailureText(failure)}`,
               recovery: {
-                action: "Try again. If this continues, copy the fix prompt to investigate the app.",
-                instructions: evaluationInstructions,
+                action: "Try again. If this continues, investigate this error and fix its cause.",
+                instructions: `The app's factory or dynamic tool loader failed with this error. It does not show whether the cause is the app's code, a service the app calls, or Executor, such as its storage or network. A transient cause, such as an unavailable upstream, may clear on retry. Otherwise find where the error is raised and what caused it, fix the cause, and verify that the app's tools load. Error: ${appFailureText(failure)}`,
               },
               retryable: true,
-            }
-          : skillPresentation(skills),
+            })
+          : skills === undefined
+            ? {
+                title: "Tools could not be loaded",
+                description: "Executor could not load this app’s tool definitions.",
+                recovery: {
+                  action:
+                    "Try again. If this continues, copy the fix prompt to investigate the app.",
+                  instructions: evaluationInstructions,
+                },
+                retryable: true,
+              }
+            : skillPresentation(skills),
   ),
 });
 /** Parsed evaluation failure; raw runtime diagnostics never enter its presentation. */
 export type AppEvaluationFailed = typeof AppEvaluationFailed.Type;
+/**
+ * Whether Executor's own code found that the app's definition could not load: it could not read
+ * the app's build, the build speaks a host protocol this host does not run, or the build cannot
+ * receive the accounts the host handles. Every other evaluation failure reaches the host through
+ * code the app controls, which can raise it while its tools are listed or called.
+ */
+export const hostObservedEvaluation = ({ runtime }: AppEvaluationFailed) =>
+  runtime?.kind === "build" ||
+  runtime?.kind === "protocol" ||
+  (runtime?.kind === "worker" &&
+    runtime.failure !== undefined &&
+    hostRuntimeFailures.has(runtime.failure));
 
 /**
  * A tool listing ran longer than a caller waits, or than its bound with nobody waiting, or was
@@ -988,6 +1258,34 @@ export const ToolSearchUnavailable = UserFacingError.define({
 });
 export type ToolSearchUnavailable = typeof ToolSearchUnavailable.Type;
 
+/**
+ * Search found an app's tools in rows kept from an earlier listing, because listing the app again
+ * failed in its code or its upstream. The tools are still searched; this says they may be out of
+ * date and why. `cause` is the failure's own curated description.
+ */
+export const ToolSearchStale = UserFacingError.define({
+  tag: "ToolSearchStale",
+  status: 503,
+  fields: {
+    app: AppId,
+    listedAt: Schema.Number,
+    cause: Schema.String,
+  },
+  recorded: () => "Search served an app's earlier tool listing because listing it again failed",
+  presentation: ({ listedAt, cause }) => ({
+    title: "App tools may be out of date",
+    description: `Search shows this app's tools as they were listed at ${new Date(listedAt).toISOString()}, because listing them again failed: ${cause}`,
+    retryable: true,
+    recovery: {
+      action:
+        "Use the tools shown. If a call fails, check that the app's upstream server responds.",
+      instructions:
+        "Tell the user this app's tools come from an earlier listing because listing them again failed. Its tools can still be called; a call may fail for the same reason. Other apps are current.",
+    },
+  }),
+});
+export type ToolSearchStale = typeof ToolSearchStale.Type;
+
 /** Why renewing an account's refused credentials failed, as resolving them reports it. */
 export const RenewalFailure = Schema.Union([
   OAuthReconnectRequired,
@@ -1184,15 +1482,21 @@ export const appFailure = ({
       });
 
 /**
- * Keep a skill loader's or MCP server's safe fields, and the error the app's own factory or loader
- * raised; other evaluation failures stay generic.
+ * Keep a skill loader's or MCP server's safe fields, the error the app's own factory or loader
+ * raised, or the runtime failure that stopped the app's Worker, build or framework. Only an error
+ * none of them describes stays generic.
  */
 export const evaluationFailure = (
   identity: { app: AppId; version: VersionId },
   error: unknown,
   reason = "App evaluation failed",
-) =>
-  new AppEvaluationFailed({
+) => {
+  const failure =
+    Schema.is(HostEvaluationFailed)(error) || Schema.is(HostDeclarationInvalid)(error)
+      ? appFailure(error)
+      : Option.none<AppFailure>();
+  const runtime = Option.isNone(failure) ? evaluationRuntime(error) : undefined;
+  return new AppEvaluationFailed({
     app: identity.app,
     version: identity.version,
     reason,
@@ -1206,11 +1510,11 @@ export const evaluationFailure = (
           },
         }
       : {}),
-    ...(Schema.is(HostEvaluationFailed)(error)
-      ? Option.match(appFailure(error), { onNone: () => ({}), onSome: (failure) => ({ failure }) })
-      : {}),
+    ...Option.match(failure, { onNone: () => ({}), onSome: (failure) => ({ failure }) }),
+    ...(runtime === undefined ? {} : { runtime }),
     ...(Schema.is(McpError)(error) ? { mcp: mcpFailure(error) } : {}),
   });
+};
 
 /**
  * What a router that could not list its tools reports to a caller of the listing, such as MCP
@@ -1358,10 +1662,19 @@ const temporaryStorage = ({ errorName, code }: AppFailure) =>
   errorName === "CacheError" &&
   (code === "timeout" || code === "storage" || code === "unavailable");
 
+/**
+ * How to read a GraphQL failure's message: the errors the server stated are its own words, which
+ * Executor quotes but does not check.
+ */
+const graphqlServiceDetail =
+  " The message quotes the errors the GraphQL server stated in its response, with the response path and extensions, such as a code, it gave for each. They are the server's words, which Executor does not check. When they name an argument, a field or a limit, correct the input or selection they name.";
+
 /** The error name and code a failure reported, for copy. */
 const failureName = ({ errorName, code }: AppFailure) =>
   `${errorName}${code === undefined ? "" : `, ${code}`}`;
 
+/** The runtime's limit on one value crossing Workers RPC, on Cloudflare and in workerd alike. */
+const workersRpcLimit = "32 MiB";
 /**
  * A tool call failed once it reached the app, or its result was lost; its external effects may
  * already have occurred. Without `mayHaveWritten`, the call was a query, which only reads.
@@ -1384,18 +1697,39 @@ export const ToolCallFailed = UserFacingError.define({
     failure: Schema.optional(AppFailure),
     /** The app's MCP server refused or failed the tool call, such as with a JSON-RPC error. */
     mcp: Schema.optional(McpFailure),
+    /**
+     * The failure's text matched the runtime's message for its limit on one value crossing Workers
+     * RPC between the app's Worker and Executor. The text reaches the host through the app's
+     * Worker, which can produce it, so the match is a likely cause, never a confirmed one.
+     */
+    rpcLimitMatched: Schema.optional(Schema.Literal(true)),
     mayHaveWritten: MayHaveWritten,
   },
-  recorded: ({ failure, mcp, response }) =>
-    mcp !== undefined
-      ? `The tool failed: ${recordedMcp(mcp)}`
-      : failure !== undefined
-        ? `The tool failed: ${recordedApp(failure)}`
-        : response !== undefined
-          ? "The tool failed after starting"
-          : "The tool failed without further detail",
-  presentation: callPresentation(({ reason, response, failure, mcp }) => {
+  recorded: ({ failure, mcp, response, rpcLimitMatched }) =>
+    rpcLimitMatched === true
+      ? "The tool's failure matched the Workers RPC size limit's message"
+      : mcp !== undefined
+        ? `The tool failed: ${recordedMcp(mcp)}`
+        : failure !== undefined
+          ? `The tool failed: ${recordedApp(failure)}`
+          : response !== undefined
+            ? "The tool failed after starting"
+            : "The tool failed without further detail",
+  presentation: callPresentation(({ reason, response, failure, mcp, rpcLimitMatched }) => {
     if (mcp !== undefined) return mcpFailurePresentation(mcp);
+    // App code can produce the runtime's text, so the match names a likely cause and keeps a read's
+    // bounded retry. Executor sets no size limit of its own on a result.
+    if (rpcLimitMatched === true)
+      return {
+        title: "Tool result may have been too large to transfer",
+        description: `${reason} The failure looks like the runtime’s ${workersRpcLimit} limit on one value carried between the app’s Worker and Executor, which the tool’s result or arguments may have exceeded. The error reached Executor through the app’s Worker, so this is not confirmed.`,
+        recovery: {
+          action:
+            "If the result could be that large, ask the tool for less, such as one page, fewer fields or a filter. Otherwise try once more.",
+          instructions: `The failure matched the runtime’s message for its ${workersRpcLimit} limit on one value crossing Workers RPC; Executor sets no result limit of its own. App code can produce the same message, so the match is not confirmed. If the result or the arguments could exceed ${workersRpcLimit}, request a smaller result, for example by paging or selecting fields if the tool supports that, or split large arguments into several calls. Otherwise, for a read, one further attempt may help; if it fails the same way, ask for less.`,
+        },
+        retryable: true,
+      };
     // The API's own recovery, when it stated one, is shown as the API wrote it.
     if (response !== undefined)
       return {
@@ -1430,7 +1764,7 @@ export const ToolCallFailed = UserFacingError.define({
           description: reason,
           recovery: {
             action: "Read the reported error and check the corresponding request or configuration.",
-            instructions: `The app’s service integration failed (${failureName(failure)}). The reported details do not establish whether the cause is the request, the service or Executor.${failure.errorName !== "OpenapiError" ? "" : failure.code === "invalid_definition" ? " The API's OpenAPI document describes this operation in a way Executor cannot use. Check the operation's definition in that document." : " The message names the API operation when it is known and, when a response arrived, its status, media type and length; the response body is not shown. Check the operation's parameters, the API's status, and whether its OpenAPI document declares this error."}`,
+            instructions: `The app’s service integration failed (${failureName(failure)}). The reported details do not establish whether the cause is the request, the service or Executor.${failure.errorName !== "OpenapiError" ? "" : failure.code === "invalid_definition" ? " The API's OpenAPI document describes this operation in a way Executor cannot use. Check the operation's definition in that document." : " The message names the API operation when it is known and, when a response arrived, its status, media type and length; the response body is not shown. Check the operation's parameters, the API's status, and whether its OpenAPI document declares this error."}${failure.errorName === "GraphqlError" ? graphqlServiceDetail : ""}`,
           },
           retryable: false,
         };
diff --git a/packages/sdk/src/contracts/webhooks.ts b/packages/sdk/src/contracts/webhooks.ts
index 29ed57b66d..32f3b2a103 100644
--- a/packages/sdk/src/contracts/webhooks.ts
+++ b/packages/sdk/src/contracts/webhooks.ts
@@ -2,7 +2,7 @@ import { withLegacyKeys } from "@executor-js/utils/legacy-keys";
 import { ApiError } from "@executor-js/utils/api-error";
 import { AppProviderFailed } from "./tools.ts";
 /** Durable, account-bound webhook subscriptions. Products authorize management; callbacks authenticate in app code. */
-import { Schema, type Effect } from "effect";
+import { Schema, SchemaGetter, type Effect } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/http-api";
 import { HostedWebhook, WebhookRequestData, WebhookResponseData } from "apps/contracts";
 import {
@@ -102,15 +102,46 @@ const webhookFailures = {
   delivery: "The webhook delivery could not be accepted.",
   inactive: "The webhook subscription is stopped or disabled.",
 } as const;
+/** Which part of an `input` failure did not match the declaration. */
+const webhookMismatches = {
+  "app-account":
+    "This webhook's source is an app account, so a caller cannot create its subscription: Executor creates it when an account is linked to the app for that requirement. List the app's webhooks to find it; one that is setup-required has a setup link.",
+  source:
+    "The source account is not linked to this app for the webhook's account requirement. Link it to the app, or name an account that is linked.",
+  config:
+    "The webhook configuration does not match the definition's configuration schema. Read the app's webhook definitions for the schema.",
+} as const;
+const WebhookMismatch = Schema.optionalKey(Schema.Literals(["app-account", "source", "config"]));
+/**
+ * Declared but not yet sent. Clients and Executor apps that hold an earlier document decode
+ * `WebhookFailed` against a closed object with the five original reasons, so a new reason value or
+ * field would turn this response into a generic failure for them. The specific cause reaches them
+ * through `message` under the existing `input` reason; a later release can send this field once
+ * cached documents have refreshed.
+ */
+const WebhookMismatchField = WebhookMismatch.pipe(
+  Schema.decodeTo(WebhookMismatch, {
+    decode: SchemaGetter.passthrough(),
+    encode: SchemaGetter.omit(),
+  }),
+);
+const webhookFailure = (failure: {
+  readonly reason: keyof typeof webhookFailures;
+  readonly mismatch?: keyof typeof webhookMismatches;
+}) =>
+  failure.reason === "input" && failure.mismatch !== undefined
+    ? webhookMismatches[failure.mismatch]
+    : webhookFailures[failure.reason];
 /** The host cannot run this webhook. Internal provider failures and payloads remain private. */
 export const WebhookFailed = ApiError.define({
   tag: "WebhookFailed",
   status: 422,
   fields: {
     reason: Schema.Literals(["unavailable", "definition", "input", "delivery", "inactive"]),
+    mismatch: WebhookMismatchField,
   },
-  message: ({ reason }) => webhookFailures[reason],
-  recorded: ({ reason }) => webhookFailures[reason],
+  message: webhookFailure,
+  recorded: webhookFailure,
 });
 export type WebhookFailed = typeof WebhookFailed.Type;
 /** Shared operation failures, retained as concrete schema variants at HTTP boundaries. */
@@ -162,7 +193,9 @@ export const WebhookSourceConfig = Schema.Record(Schema.NonEmptyString, Schema.J
 /**
  * One account linked to an app as a webhook source. Executor keeps one managed subscription per
  * definition of the source's scope that the account's provider can serve, on the app's active
- * version, and replaces them when the app activates another version. Several users linking
+ * version. When the app activates another version it registers them again, except that a manual
+ * subscription whose setup the new version still serves moves to it with its callback URL and
+ * secret. Several users linking
  * the same account share it. A source without an actor is an app link: it serves app-account
  * webhooks, whose deliveries run without a caller. An account linked in both scopes is one source,
  * serving as its app link.
diff --git a/packages/sdk/src/contracts/wire-revision.ts b/packages/sdk/src/contracts/wire-revision.ts
new file mode 100644
index 0000000000..fa0fbe4d13
--- /dev/null
+++ b/packages/sdk/src/contracts/wire-revision.ts
@@ -0,0 +1,24 @@
+/**
+ * Clients from earlier releases keep calling a host after it changes: an installed CLI, desktop app
+ * or local server, and readers of the public registry. A client states the newest wire revision it
+ * reads in {@link wireRevisionHeader}; a request without one comes from a client released before
+ * revisions, which reads revision 0; every release through 2.0.0-beta.29 sends none. A host writes
+ * each response in its client's revision, so a format that released clients decode is widened by
+ * adding a revision, never by changing one.
+ */
+
+/** The request header that states the client's wire revision. */
+export const wireRevisionHeader = "executor-wire-revision";
+
+/**
+ * The newest revision, which this release's clients state.
+ * - 0: package names have no dot in their scope, as clients up to 2.0.0-beta.15 decode them.
+ * - 1: package names are under publisher scopes, such as `@acme.executor.community/notes`.
+ */
+export const wireRevision = 1;
+
+/** The revision a request's client reads: the one it states, at most {@link wireRevision}, else 0. */
+export const requestWireRevision = (headers: Readonly<Record<string, string | undefined>>) => {
+  const stated = Number(headers[wireRevisionHeader]);
+  return Number.isSafeInteger(stated) && stated > 0 ? Math.min(stated, wireRevision) : 0;
+};
diff --git a/packages/sdk/src/contracts/workerd-host.ts b/packages/sdk/src/contracts/workerd-host.ts
index 7c58cd680e..64ac0750fc 100644
--- a/packages/sdk/src/contracts/workerd-host.ts
+++ b/packages/sdk/src/contracts/workerd-host.ts
@@ -13,6 +13,7 @@ import {
   WorkflowValue,
 } from "apps/contracts";
 import { WorkflowSeed } from "./workflow-runtime.ts";
+import { HostApiCheck } from "./host-api.ts";
 import { RetainedWorkerBuild, WorkerBundle, WorkerFramework } from "./worker-build.ts";
 import { CodeFiles } from "./source.ts";
 import {
@@ -29,6 +30,8 @@ import type { RpcTarget } from "capnweb";
 export const WorkerInvocation = Schema.Struct({
   app: Schema.NonEmptyString,
   build: Schema.NonEmptyString,
+  /** The host API revision the app's cache belongs to, for an app that reads it; see `HostApiCheck`. */
+  hostApi: Schema.optionalKey(HostApiCheck),
   database: Schema.Boolean,
   /** Sent only for builds that declare `sharedRuntime`; see `appWorker`. */
   sharedRuntime: Schema.optionalKey(Schema.Literal(true)),
diff --git a/packages/sdk/src/contracts/workflow-runtime.ts b/packages/sdk/src/contracts/workflow-runtime.ts
index fd83b6858e..871c175d2b 100644
--- a/packages/sdk/src/contracts/workflow-runtime.ts
+++ b/packages/sdk/src/contracts/workflow-runtime.ts
@@ -11,6 +11,7 @@ import {
   type WorkflowRunFailure,
 } from "apps/contracts";
 import { AppId, BuildId, VersionId } from "./shared.ts";
+import { HostApiCheck } from "./host-api.ts";
 
 /** Backend inspection is parsed before it affects a retained run. */
 export const WorkflowBackendState = Schema.Union([
@@ -40,6 +41,8 @@ const WorkflowSeedFields = Schema.Struct({
   runId: WorkflowRunId,
   app: AppId,
   build: BuildId,
+  /** The host API revision the app's cache belongs to, for an app that reads it; see `HostApiCheck`. */
+  hostApi: Schema.optionalKey(HostApiCheck),
   version: VersionId,
   name: Schema.NonEmptyString,
   input: WorkflowValue,
@@ -53,10 +56,12 @@ export interface WorkflowHost {
   /** Read retained state without reopening accounts or consulting the backend. */
   readonly get: (run: WorkflowRunId) => Effect.Effect<WorkflowRun, WorkflowFailure>;
   readonly seed: (run: WorkflowRunId) => Effect.Effect<WorkflowSeed, WorkflowFailure>;
-  readonly context: (
-    run: WorkflowRunId,
-  ) => Effect.Effect<
-    HostContext & { readonly database: boolean; readonly sharedRuntime: boolean },
+  readonly context: (run: WorkflowRunId) => Effect.Effect<
+    HostContext & {
+      readonly hostApi: HostApiCheck | undefined;
+      readonly database: boolean;
+      readonly sharedRuntime: boolean;
+    },
     WorkflowFailure
   >;
   readonly invoke: (
diff --git a/packages/sdk/src/core.ts b/packages/sdk/src/core.ts
index df2ddcec52..849f4bab6d 100644
--- a/packages/sdk/src/core.ts
+++ b/packages/sdk/src/core.ts
@@ -6,6 +6,7 @@ export { makeDeclarationCache } from "./implementation/declarations.ts";
 export { declarationConfig } from "./implementation/declaration-config.ts";
 export { evaluatedDeclarations } from "./implementation/evaluated-declarations.ts";
 export { executorHandlers } from "./implementation/handlers.ts";
+export { rejectRequest, requestRejections } from "./implementation/request-rejection.ts";
 export { probeOAuthChallenge } from "./implementation/oauth-probe.ts";
 export { withExecutorUserAgent } from "./implementation/user-agent.ts";
 export { discoverResourceOAuth } from "./implementation/oauth-protocol.ts";
@@ -29,12 +30,22 @@ export {
   type ResolvedAppRuntime,
 } from "./implementation/runtime.ts";
 export { executorDatabase } from "./implementation/storage-migrations.ts";
+export { StorageMigrationFailed } from "./implementation/storage-migration-error.ts";
 export { makeExecutorStorage, type ExecutorDatabase } from "./implementation/storage.ts";
 
 /** Optional Web Crypto adapter; callers retain signing-key custody. */
 export { aesGcmCredentials } from "./implementation/credentials.ts";
 /** Read another host's public catalog over HTTPS. */
 export { remoteRegistry } from "./implementation/remote-registry.ts";
+/** Registry results for clients that read an earlier wire revision. */
+export {
+  packageNameFromRevision,
+  publicationForRevision,
+  publicationsForRevision,
+  readinessForRevision,
+  registryForRevision,
+  scopedNameFor,
+} from "./implementation/wire-revision.ts";
 export { webhookCallback } from "./implementation/webhook-http.ts";
 
 export * from "./contracts/workflows.ts";
diff --git a/packages/sdk/src/implementation/account-health.ts b/packages/sdk/src/implementation/account-health.ts
index 3bd0b32756..06d5dd0606 100644
--- a/packages/sdk/src/implementation/account-health.ts
+++ b/packages/sdk/src/implementation/account-health.ts
@@ -4,6 +4,8 @@
  * per account and app.
  */
 import { Clock, Effect, Match, Option, Redacted, Result, Schema } from "effect";
+import type { HostApi } from "../contracts/executor.ts";
+import { versionHostApi } from "./declarations.ts";
 import {
   AccountInfo,
   HostOperationFailed,
@@ -27,7 +29,7 @@ import { AppNotFound, sharesRuntime } from "../contracts/apps.ts";
 import { type AccountCredential, invocationAccount, validateFields } from "./provider.ts";
 import { StoredVersion, type StoredAccount } from "../contracts/storage.ts";
 import { storedAccount } from "./accounts.ts";
-import { query, type Query } from "./database.ts";
+import { inOrder, query, type Query } from "./database.ts";
 import type { makeOAuth } from "./oauth.ts";
 import type { FirstPartyOAuthClient } from "../contracts/oauth.ts";
 
@@ -124,6 +126,7 @@ export const makeAccountHealth = (
   oauth: OAuth,
   clients: ReadonlyMap<string, FirstPartyOAuthClient>,
   listApps: ListApps,
+  hostApi: HostApi | undefined,
 ) => {
   /** One account's health from the apps that use it and its recorded checks. */
   const project = (account: HealthAccount, apps: readonly App[], rows: readonly CheckRow[]) =>
@@ -159,15 +162,23 @@ export const makeAccountHealth = (
       } satisfies AccountHealth;
     });
 
-  const report = (account: StoredAccount, ids: readonly AppId[]) =>
+  /** The account's health, read beside `account`'s own read, which fails first. */
+  const report = <E>(
+    account: Effect.Effect<StoredAccount, E>,
+    id: AccountId,
+    ids: readonly AppId[],
+  ) =>
     Effect.gen(function* () {
-      // The product names the apps; their owner can differ from the account's, as in local, where
-      // apps belong to the host and accounts to its user.
-      const apps = ids.length === 0 ? [] : yield* listApps({ ids });
-      const rows = yield* query(() =>
-        db.findMany("accountChecks", { where: (b) => b("account", "=", account.id) }),
+      const [stored, [apps, rows]] = yield* inOrder(
+        account,
+        inOrder(
+          // The product names the apps; their owner can differ from the account's, as in local,
+          // where apps belong to the host and accounts to its user.
+          ids.length === 0 ? Effect.succeed<readonly App[]>([]) : listApps({ ids }),
+          query(() => db.findMany("accountChecks", { where: (b) => b("account", "=", id) })),
+        ),
       );
-      return yield* project(account, apps, rows);
+      return yield* project(stored, apps, rows);
     });
 
   /**
@@ -186,11 +197,11 @@ export const makeAccountHealth = (
       );
       if (accounts.length === 0) return [];
       const ids = accounts.map((account) => account.id);
-      const rows = yield* query(() =>
-        db.findMany("accountChecks", { where: (b) => b("account", "in", ids) }),
-      );
       const linked = [...new Set(input.links.map((link) => link.app))];
-      const apps = linked.length === 0 ? [] : yield* listApps({ ids: linked });
+      const [rows, apps] = yield* inOrder(
+        query(() => db.findMany("accountChecks", { where: (b) => b("account", "in", ids) })),
+        linked.length === 0 ? Effect.succeed<readonly App[]>([]) : listApps({ ids: linked }),
+      );
       return yield* Effect.forEach(accounts, (account) =>
         project(
           account,
@@ -225,6 +236,7 @@ export const makeAccountHealth = (
           app: app.id,
           build: version.build,
           sharedRuntime: sharesRuntime(version.requirements),
+          hostApi: versionHostApi(hostApi, version),
           requirement: target.slot,
           deadline,
           accounts: Redacted.make(
@@ -325,6 +337,7 @@ export const makeAccountHealth = (
           app: app.id,
           build: version.build,
           sharedRuntime: sharesRuntime(version.requirements),
+          hostApi: versionHostApi(hostApi, version),
           requirement: target.slot,
           deadline,
           accounts: Redacted.make(
@@ -355,19 +368,22 @@ export const makeAccountHealth = (
     checkCredentials,
     listHealth,
     health: (input: Parameters<Executor["accounts"]["health"]>[0]) =>
-      storedAccount(db, input.account, input.owner).pipe(
-        Effect.flatMap((account) => report(account, input.apps)),
+      report(storedAccount(db, input.account, input.owner), input.account, input.apps).pipe(
         Effect.withSpan("sdk.accounts.health"),
       ),
     check: (input: Parameters<Executor["accounts"]["check"]>[0]) =>
       Effect.gen(function* () {
-        const account = yield* storedAccount(db, input.account, input.owner);
-        const apps = input.apps.length === 0 ? [] : yield* listApps({ ids: input.apps });
+        const [account, apps] = yield* inOrder(
+          storedAccount(db, input.account, input.owner),
+          input.apps.length === 0
+            ? Effect.succeed<readonly App[]>([])
+            : listApps({ ids: input.apps }),
+        );
         yield* Effect.forEach(apps, (app) => checkApp(app, account), {
           concurrency: 4,
           discard: true,
         });
-        return yield* report(account, input.apps);
+        return yield* report(Effect.succeed(account), account.id, input.apps);
       }).pipe(Effect.withSpan("sdk.accounts.check")),
   };
 };
diff --git a/packages/sdk/src/implementation/accounts.ts b/packages/sdk/src/implementation/accounts.ts
index 41571b399f..89da349c35 100644
--- a/packages/sdk/src/implementation/accounts.ts
+++ b/packages/sdk/src/implementation/accounts.ts
@@ -1,5 +1,5 @@
 import { AccountWorkflowsActive } from "../contracts/account.ts";
-import { AccountWebhooksActive } from "../contracts/account.ts";
+import { AccountWebhookDependent, AccountWebhooksActive } from "../contracts/account.ts";
 /** Reusable account operations. Owners remain lookup predicates, not authorization. */
 import { Clock, type Crypto, Effect, Option, Redacted, Schema } from "effect";
 import {
@@ -11,10 +11,16 @@ import {
 import { OAuthGrant } from "../contracts/oauth.ts";
 import type { Executor, ResourceLifecycle } from "../contracts/executor.ts";
 import { Provider, ProviderNotFound } from "../contracts/provider.ts";
-import { AccountId, StorageError, type OwnerId, type ProviderId } from "../contracts/shared.ts";
+import {
+  AccountId,
+  JsonObject,
+  StorageError,
+  type OwnerId,
+  type ProviderId,
+} from "../contracts/shared.ts";
 import { StoredAccount, type Credentials } from "../contracts/storage.ts";
 import { query, transaction, type Query } from "./database.ts";
-import { validateFields } from "./provider.ts";
+import { canonical, validateFields } from "./provider.ts";
 
 /** A stable digest of stored ciphertext; any credential write changes it. */
 const fingerprint = (bytes: Uint8Array) =>
@@ -45,6 +51,60 @@ export const storedAccount = (db: Query, account: AccountId, owner?: OwnerId) =>
     );
   });
 
+/**
+ * New credentials for an account end the wait of the webhook sources that failed on it: each
+ * checks its accounts again at the next tick, without waiting out its retry delay. A source whose
+ * attempt is in progress keeps its lease. A source waiting on another of its accounts keeps
+ * waiting until that account's own change or its next delay. Run in the credential write's
+ * transaction.
+ */
+export const resumeWaitingSources = (tx: Query, account: AccountId) =>
+  query(() =>
+    tx.updateMany("webhookSources", {
+      where: (b) =>
+        b.and(b("account", "=", account), b("failure", "=", "accounts"), b("lease", "is", null)),
+      set: { leaseUntil: new Date(0), retries: 0 },
+    }),
+  );
+
+/**
+ * The subscriptions that still use an account, oldest ID first. A live one uses its source and
+ * every account its registration ran with, which removing it at the provider needs. A disabled
+ * one waits for a person to remove it at the provider, which runs no app code, so it keeps only its
+ * source: confirming the removal in the dashboard needs access to that account. A stopped one uses
+ * none, and neither does a dependency row whose subscription has gone.
+ */
+const webhookDependents = (tx: Query, account: AccountId) =>
+  Effect.gen(function* () {
+    const links = yield* query(() =>
+      tx.findMany("webhookAccounts", {
+        select: ["subscription"],
+        where: (b) => b("account", "=", account),
+      }),
+    );
+    if (links.length === 0) return [];
+    const rows = yield* query(() =>
+      tx.findMany("webhooks", {
+        select: ["id", "app", "status", "sourceAccount"],
+        where: (b) =>
+          b.and(
+            b(
+              "id",
+              "in",
+              links.map((link) => link.subscription),
+            ),
+            b("status", "!=", "stopped"),
+          ),
+        orderBy: ["id", "asc"],
+      }),
+    );
+    return yield* Schema.decodeUnknownEffect(Schema.Array(AccountWebhookDependent))(
+      rows
+        .filter((row) => row.status !== "disabled" || row.sourceAccount === account)
+        .map((row) => ({ app: row.app, subscription: row.id, status: row.status })),
+    ).pipe(Effect.mapError(() => new StorageError()));
+  });
+
 /**
  * An account created without a name starts with the owner's first free "Default" label for its
  * provider, so it can be named once its identity is known. Read inside the creating transaction.
@@ -180,6 +240,7 @@ export const makeAccounts = (
             set: { encryptedCredentials, credentialGeneration: account.credentialGeneration + 1 },
           }),
         );
+        yield* resumeWaitingSources(tx, account.id);
         return yield* Schema.decodeUnknownEffect(Account)(account).pipe(
           Effect.mapError(() => new StorageError()),
         );
@@ -205,10 +266,13 @@ export const makeAccounts = (
                 set: { createdAt: row.createdAt },
               }),
             );
-            const linked = yield* query(() =>
-              tx.findFirst("webhookAccounts", { where: (b) => b("account", "=", row.id) }),
-            );
-            if (linked !== null) return yield* new AccountWebhooksActive({ account: row.id });
+            // Every holder refuses the deletion; products narrow only which ones the refusal names.
+            const dependents = yield* webhookDependents(tx, row.id);
+            if (dependents.length > 0)
+              return yield* new AccountWebhooksActive({
+                account: row.id,
+                dependents: { visible: dependents, hidden: 0 },
+              });
             const workflow = yield* query(() =>
               tx.findFirst("workflowAccounts", { where: (b) => b("account", "=", row.id) }),
             );
@@ -219,10 +283,14 @@ export const makeAccounts = (
               );
               yield* lifecycle.accountRemoving(account);
             }
-            // A source whose subscriptions have all stopped goes with its account.
+            // A source whose subscriptions have all stopped goes with its account, as do the
+            // dependency rows of subscriptions that no longer use it.
             yield* query(() =>
               tx.deleteMany("webhookSources", { where: (b) => b("account", "=", input.account) }),
             );
+            yield* query(() =>
+              tx.deleteMany("webhookAccounts", { where: (b) => b("account", "=", input.account) }),
+            );
             const grant = yield* query(() =>
               tx.findFirst("oauthGrants", { where: (b) => b("id", "=", input.account) }),
             );
@@ -369,3 +437,59 @@ export const credentialsReadable = (db: Query, credentials: Credentials) => (acc
     );
     return Option.isSome(decoded);
   }).pipe(Effect.withSpan("sdk.accounts.credentialsReadable"));
+
+/**
+ * Move an imported account to another provider, under `method`, when that method's definition is
+ * the one the account's method has in its own provider, so its credentials fit it unchanged. A
+ * provider is one definition of all its methods, so an app generated again with a method more or
+ * less, or another name, declares a new provider that its accounts no longer fit. Returns whether
+ * the account moved; one changed meanwhile is left as it is.
+ */
+export const moveImportedAccount =
+  (db: Query) =>
+  (input: {
+    readonly account: AccountId;
+    readonly provider: ProviderId;
+    readonly method: string;
+  }) =>
+    Effect.gen(function* () {
+      const stored = yield* storedAccount(db, input.account).pipe(
+        Effect.map(Option.some),
+        Effect.catchTag("AccountNotFound", () => Effect.succeed(Option.none<StoredAccount>())),
+      );
+      if (Option.isNone(stored) || stored.value.provider === input.provider) return false;
+      const account = stored.value;
+      const methodOf = (provider: ProviderId, method: string) =>
+        Effect.gen(function* () {
+          const row = yield* query(() =>
+            db.findFirst("providers", { where: (b) => b("id", "=", provider) }),
+          );
+          if (row === null) return undefined;
+          const { definition } = yield* Schema.decodeUnknownEffect(Provider)(row).pipe(
+            Effect.mapError(() => new StorageError()),
+          );
+          if (!Object.hasOwn(definition.auth, method)) return undefined;
+          const json = yield* Schema.decodeUnknownEffect(JsonObject)(definition.auth[method]).pipe(
+            Effect.mapError(() => new StorageError()),
+          );
+          return canonical(json);
+        });
+      const from = yield* methodOf(account.provider, account.method);
+      const to = yield* methodOf(input.provider, input.method);
+      if (from === undefined || from !== to) return false;
+      yield* query(() =>
+        db.updateMany("accounts", {
+          where: (b) =>
+            b.and(
+              b("id", "=", input.account),
+              b("provider", "=", account.provider),
+              b("method", "=", account.method),
+            ),
+          set: { provider: input.provider, method: input.method },
+        }),
+      );
+      return yield* storedAccount(db, input.account).pipe(
+        Effect.map((moved) => moved.provider === input.provider && moved.method === input.method),
+        Effect.catchTag("AccountNotFound", () => Effect.succeed(false)),
+      );
+    }).pipe(Effect.withSpan("sdk.accounts.moveImportedAccount"));
diff --git a/packages/sdk/src/implementation/app-network.ts b/packages/sdk/src/implementation/app-network.ts
index 0ecfd78fbb..d967f8d2f7 100644
--- a/packages/sdk/src/implementation/app-network.ts
+++ b/packages/sdk/src/implementation/app-network.ts
@@ -13,6 +13,7 @@
  */
 import { Schema } from "effect";
 import { RecordedMessage } from "@executor-js/utils/recorded-message";
+import { hostApiChangingCode } from "../contracts/host-api.ts";
 
 /**
  * Executor's app network failed before the service answered an app's request. The request may have
@@ -59,12 +60,32 @@ export const networkUnreachableResponse = (unreachable: NetworkUnreachable) =>
     headers: { [networkUnreachableHeader]: encodeURIComponent(unreachable.message) },
   });
 
+/**
+ * The mark of a response Executor's app network returned instead of the host API's document,
+ * because the document's revision is not the one the app's cache belongs to; see `HostApiCheck`.
+ * The app's `fetch` rejects with `hostApiChangingCode` and this message, so the app keeps nothing
+ * and its caller is told to retry. Only that network sets it, as for `networkUnreachableHeader`.
+ */
+export const hostApiChangingStatus = 503;
+export const hostApiChangingHeader = "x-executor-api-changing";
+export const hostApiChangingMessage =
+  "Executor's API is changing (a deploy is in progress). Retry shortly.";
+
+/** The marked response the app isolate turns into a rejected `fetch` with `hostApiChangingCode`. */
+export const hostApiChangingResponse = () =>
+  new Response(null, {
+    status: hostApiChangingStatus,
+    statusText: "API changing",
+    headers: { [hostApiChangingHeader]: "1", "retry-after": "1" },
+  });
+
 /**
  * The first module of every app isolate. Before app code loads, it replaces the platform's `fetch`
  * wherever the global scope holds it (workerd defines it on the scope's prototype), so a marked
  * response rejects with a `TypeError`, as the platform's `fetch` does when its network fails. Every
  * other response is returned unchanged. The platform's `fetch` and the built-ins that read the mark
  * are captured here, so app code can neither reach the unwrapped `fetch` nor hide the mark. A
+ * refused host API document rejects the same way, with `hostApiChangingCode` as its `code`. A
  * rejection for the subrequest limit is replaced by `SubrequestLimitReached`, which says what the
  * limit means for the call and keeps the platform's error as its cause.
  */
@@ -101,11 +122,16 @@ async function fetch(input, init) {
     if (error instanceof PlatformError && apply(test, limited, [error.message])) throw new SubrequestLimitReached(error);
     throw error;
   }
-  const message = apply(status, response, []) === ${networkUnreachableStatus} ? apply(header, apply(headers, response, []), [${JSON.stringify(networkUnreachableHeader)}]) : null;
-  if (message === null) return response;
+  const code = apply(status, response, []);
+  const message = code === ${networkUnreachableStatus} ? apply(header, apply(headers, response, []), [${JSON.stringify(networkUnreachableHeader)}]) : null;
+  const changing = code === ${hostApiChangingStatus} && apply(header, apply(headers, response, []), [${JSON.stringify(hostApiChangingHeader)}]) !== null;
+  if (message === null && !changing) return response;
   const stream = apply(body, response, []);
   if (stream !== null) await apply(cancel, stream, []);
-  throw new Rejection(decode(message));
+  if (message !== null) throw new Rejection(decode(message));
+  const rejection = new Rejection(${JSON.stringify(hostApiChangingMessage)});
+  defineProperty(rejection, "code", { value: ${JSON.stringify(hostApiChangingCode)}, enumerable: true, writable: true, configurable: true });
+  throw rejection;
 }
 for (let scope = globalThis; scope !== null; scope = getPrototypeOf(scope)) {
   const own = getOwnPropertyDescriptor(scope, "fetch");
diff --git a/packages/sdk/src/implementation/app-runner.ts b/packages/sdk/src/implementation/app-runner.ts
index 31b84b4869..3f511f9348 100644
--- a/packages/sdk/src/implementation/app-runner.ts
+++ b/packages/sdk/src/implementation/app-runner.ts
@@ -51,6 +51,7 @@ import {
 } from "../contracts/runtime.ts";
 import type { LoadedWorkerBuild, WorkerBundle } from "../contracts/worker-build.ts";
 import type { StartedPart } from "../contracts/runtime.ts";
+import { appCacheNamespace, type HostApiCheck } from "../contracts/host-api.ts";
 import { appProtocol, type AppProtocol } from "./app-protocols.ts";
 import { appFacetBridge, appNetworkModuleName, appRpcBridge } from "./worker-bridge.ts";
 import { appNetworkModule } from "./app-network.ts";
@@ -92,9 +93,10 @@ export interface AppRunnerHost {
   readonly loader: Pick<WorkerLoader, "get">;
   /**
    * The network an app's isolates use for global `fetch`, bound to that app. It opens the
-   * credential handles the runner seals with `credentialKey`; see credential-handles.ts.
+   * credential handles the runner seals with `credentialKey`; see credential-handles.ts. Bound to
+   * a host API revision, it refuses that API's document unless it has the revision.
    */
-  readonly outbound: (app: string) => Fetcher;
+  readonly outbound: (app: string, hostApi: HostApiCheck | undefined) => Fetcher;
   /** Seals the secret fields of providers that declare hosts. App code never holds it. */
   readonly credentialKey: Effect.Effect<CryptoKey>;
   /**
@@ -128,6 +130,11 @@ export interface AppRunnerHost {
 export interface AppInvocation {
   readonly app: string;
   readonly build: string;
+  /**
+   * The host API revision the app's cache belongs to, for an app that reads this host's API. Its
+   * Worker's network refuses that API's document unless it has this revision; see `HostApiCheck`.
+   */
+  readonly hostApi?: HostApiCheck;
   readonly database: boolean;
   /**
    * The build declares `sharedRuntime`: its runtime is named by build alone, so every caller's
@@ -383,7 +390,7 @@ class ColdStartFailed extends Schema.TaggedError<ColdStartFailed>()("ColdStartFa
 export const appWorker = (
   invocation: Pick<
     AppInvocation,
-    "app" | "build" | "database" | "sharedRuntime" | "command" | "accounts"
+    "app" | "build" | "database" | "sharedRuntime" | "command" | "accounts" | "hostApi"
   >,
 ) =>
   // Requirement names are unique across scopes, so one record names the account set.
@@ -391,11 +398,19 @@ export const appWorker = (
     invocation.build,
     invocation.sharedRuntime === true ? {} : Object.fromEntries(scopedSlots(invocation.accounts)),
   ).pipe(
-    Effect.map((identity) => ({
-      identity,
-      mode: runsInFacet(invocation) ? ("facet" as const) : ("worker" as const),
-      name: `${invocation.app}:${identity}`,
-    })),
+    Effect.map((selection) => {
+      // A Worker's network is bound when it loads, so each host API revision has its own app
+      // Worker and its own facet Worker. The facet's database is the supervisor's, whichever loads.
+      const identity =
+        invocation.hostApi === undefined
+          ? selection
+          : `${selection}:${invocation.hostApi.revision}`;
+      return {
+        identity,
+        mode: runsInFacet(invocation) ? ("facet" as const) : ("worker" as const),
+        name: `${invocation.app}:${identity}`,
+      };
+    }),
   );
 
 /** Whether a call runs in the app's data facet, under its data supervisor, rather than its Worker. */
@@ -594,7 +609,7 @@ export const makeAppRunner = (host: AppRunnerHost) => {
             mainModule: "__executor_rpc.js",
             modules: read.success.modules,
             compatibilityDate,
-            compatibilityFlags: ["nodejs_compat"],
+            compatibilityFlags: ["nodejs_compat", "no_brotli_content_encoding"],
             globalOutbound: options.globalOutbound,
           };
         };
@@ -740,7 +755,8 @@ export const makeAppRunner = (host: AppRunnerHost) => {
             id,
             app: invocation.app,
             identity,
-            cacheNamespace: invocation.build,
+            cacheNamespace: appCacheNamespace(invocation.build, invocation.hostApi),
+            ...(invocation.hostApi === undefined ? {} : { hostApi: invocation.hostApi }),
             body,
             headers: invocation.headers,
             write:
@@ -901,7 +917,9 @@ export const makeAppRunner = (host: AppRunnerHost) => {
           (lanes: Semaphore.Semaphore): CacheTransport =>
           (command) =>
             lanes
-              .withPermits(1)(data.cache(invocation.build, command))
+              .withPermits(1)(
+                data.cache(appCacheNamespace(invocation.build, invocation.hostApi), command),
+              )
               .pipe(
                 Effect.flatMap(Schema.decodeUnknownEffect(CacheReply)),
                 Effect.mapError(() => new CacheError({ reason: "storage" })),
@@ -940,7 +958,7 @@ export const makeAppRunner = (host: AppRunnerHost) => {
         const reply = yield* start(name, load, {
           body,
           headers: invocation.headers,
-          globalOutbound: host.outbound(invocation.app),
+          globalOutbound: host.outbound(invocation.app, invocation.hostApi),
           elicit: capabilities.elicit,
           controls: capabilities.controls,
           ...(capabilities.workflow === undefined
diff --git a/packages/sdk/src/implementation/app-runtime.ts b/packages/sdk/src/implementation/app-runtime.ts
index 538be4a7f7..99a7e6bc52 100644
--- a/packages/sdk/src/implementation/app-runtime.ts
+++ b/packages/sdk/src/implementation/app-runtime.ts
@@ -28,6 +28,7 @@ import {
   ToolResultObservation,
   type HostContext,
   type HostRequest,
+  type WebhookCommand,
   scopedSlots,
 } from "apps/contracts";
 import {
@@ -44,6 +45,7 @@ import {
   type Runtime,
   type RuntimeBuildUnavailable,
 } from "../contracts/runtime.ts";
+import type { HostApiCheck } from "../contracts/host-api.ts";
 import { Json, type BuildId } from "../contracts/shared.ts";
 import type { LoadedWorkerBuild } from "../contracts/worker-build.ts";
 import type { BlobStore } from "../contracts/blobs.ts";
@@ -56,6 +58,16 @@ import { runtimeCallParts } from "./tool-call-overhead.ts";
 /** What telemetry records for an error an app's reply carried, beside the error's name. */
 const appErrorRecorded = "The app returned this error; its text is not recorded";
 
+/** The part of a webhook's life each command runs, as its span records it. */
+const webhookOperations = {
+  webhooks: "definitions",
+  "webhook-validate": "validate",
+  "webhook-complete": "complete",
+  "webhook-register": "register",
+  "webhook-unregister": "unregister",
+  "webhook-handle": "handle",
+} as const satisfies Record<WebhookCommand["operation"], string>;
+
 /** The span recorded each time a host reads a build, to learn its protocol or cold-start it. */
 export const buildLoadSpan = "runtime.app.build.load";
 
@@ -126,6 +138,11 @@ export const invocationBuildLoader = <R>(
 export interface AppRuntimeHost {
   /** Span prefix for this host's runtime operations. */
   readonly name: string;
+  /**
+   * Opaque ids of whom the current operation runs for, such as its organization, read from its
+   * context without I/O. Each runtime operation's span records them.
+   */
+  readonly actor?: Effect.Effect<Readonly<Record<string, string>>>;
   /** Read one retained build, with the protocol its framework speaks, from this host's store. */
   readonly loadBuild: (
     build: BuildId,
@@ -148,6 +165,7 @@ export const appRuntime = (host: AppRuntimeHost) =>
       input: {
         readonly app: string;
         readonly build: BuildId;
+        readonly hostApi: HostApiCheck | undefined;
         readonly database: boolean;
         readonly sharedRuntime: boolean;
         readonly observeRevision?: (revision: number) => void;
@@ -176,6 +194,7 @@ export const appRuntime = (host: AppRuntimeHost) =>
             accounts: Redacted.value(input.accounts),
             // Workers RPC structured-clones its arguments; Effect headers carry a prototype it rejects.
             headers: Object.fromEntries(Object.entries(yield* traceHeaders)),
+            ...(input.hostApi === undefined ? {} : { hostApi: input.hostApi }),
             ...(input.approval === undefined ? {} : { approval: input.approval }),
             ...(input.caller === undefined ? {} : { caller: input.caller }),
             ...(input.approvedBy === undefined ? {} : { approvedBy: input.approvedBy }),
@@ -337,9 +356,22 @@ export const appRuntime = (host: AppRuntimeHost) =>
         ),
       );
     };
-    const span = (operation: string) => `${host.name}.${operation}`;
+    const actor: Effect.Effect<Readonly<Record<string, string>>> = host.actor ?? Effect.succeed({});
+    /**
+     * One runtime operation's span. It records the app the operation runs and whom the host says
+     * it runs for, so one app's or organization's failures can be told from the runtime's own.
+     */
+    const traced =
+      (operation: string, attributes: Readonly<Record<string, string>> = {}) =>
+      <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+        Effect.flatMap(actor, (ids) =>
+          Effect.withSpan(effect, `${host.name}.${operation}`, {
+            attributes: { ...ids, ...attributes },
+          }),
+        );
+    const app = (input: { readonly app: string }) => ({ "executor.app.id": input.app });
     return {
-      build: (input) => host.build(input).pipe(Effect.withSpan(span("build"))),
+      build: (input) => host.build(input).pipe(traced("build")),
       asset: host.asset,
       changes: host.changes,
       skills: ({ sources, ...input }) =>
@@ -348,7 +380,7 @@ export const appRuntime = (host: AppRuntimeHost) =>
           skillsCommand(sources === true),
           SkillCatalogResponse,
           HostInspectError,
-        ).pipe(Effect.map(skillCatalog), Effect.withSpan(span("skills"))),
+        ).pipe(Effect.map(skillCatalog), traced("skills", app(input))),
       inspect: ({ tools, scheduled, definitions, ...input }) =>
         (definitions === "shared"
           ? dispatch(
@@ -370,28 +402,28 @@ export const appRuntime = (host: AppRuntimeHost) =>
               HostedCatalog,
               HostInspectError,
             )
-        ).pipe(Effect.map(selectTools(tools)), Effect.withSpan(span("inspect"))),
+        ).pipe(Effect.map(selectTools(tools)), traced("inspect", app(input))),
       index: (input) =>
         dispatch(
           { ...input, database: false },
           indexCommand,
           HostedCatalogSummary,
           HostInspectError,
-        ).pipe(Effect.withSpan(span("index"))),
+        ).pipe(traced("index", app(input))),
       query: (input) =>
         dispatch(
           input,
           { operation: "query", name: input.name, input: input.input },
           Json,
           HostDataError,
-        ).pipe(Effect.withSpan(span("query"))),
+        ).pipe(traced("query", app(input))),
       mutate: (input) =>
         dispatch(
           input,
           { operation: "mutate", name: input.name, input: input.input },
           Json,
           HostDataError,
-        ).pipe(Effect.withSpan(span("mutate"))),
+        ).pipe(traced("mutate", app(input))),
       call: (input) =>
         dispatch(
           input,
@@ -403,32 +435,42 @@ export const appRuntime = (host: AppRuntimeHost) =>
           },
           Json,
           HostCallError,
-        ).pipe(Effect.withSpan(span("call"))),
+        ).pipe(traced("call", app(input))),
       webhook: (input) =>
-        dispatch(input, input.command, Json, HostCallError).pipe(Effect.withSpan(span("webhook"))),
+        dispatch(input, input.command, Json, HostCallError).pipe(
+          traced("webhook", {
+            ...app(input),
+            "executor.webhook.operation": webhookOperations[input.command.operation],
+          }),
+        ),
       checkAccount: ({ requirement, ...input }) =>
         dispatch(
           { ...input, database: false },
           { operation: "account-check", requirement },
           AccountCheckResult,
           HostAccountCheckError,
-        ).pipe(Effect.withSpan(span("checkAccount"))),
+        ).pipe(traced("checkAccount", app(input))),
       migrate: (input) =>
         dispatch(
-          // Named by build alone either way: a migration runs without accounts.
-          { ...input, database: true, sharedRuntime: false, accounts: Redacted.make({ app: {} }) },
+          // Migrations run the build's SQL files only, so they read no cache or API. Named by build
+          // alone either way: a migration runs without accounts.
+          {
+            ...input,
+            hostApi: undefined,
+            database: true,
+            sharedRuntime: false,
+            accounts: Redacted.make({ app: {} }),
+          },
           { operation: "migrate" },
           MigrateResult,
           HostCallError,
-        ).pipe(Effect.withSpan(span("migrate"))),
+        ).pipe(traced("migrate", app(input))),
       workflow: (input) =>
         dispatch({ ...input, database: false }, input.command, Json, HostCallError).pipe(
-          Effect.withSpan(span("workflow"), {
-            attributes: {
-              "executor.app.id": input.app,
-              "executor.build.id": input.build,
-              ...(input.workflow === undefined ? {} : { "executor.run.id": input.workflow.runId }),
-            },
+          traced("workflow", {
+            ...app(input),
+            "executor.build.id": input.build,
+            ...(input.workflow === undefined ? {} : { "executor.run.id": input.workflow.runId }),
           }),
         ),
     } satisfies Runtime<BlobStore>;
diff --git a/packages/sdk/src/implementation/app-storage.ts b/packages/sdk/src/implementation/app-storage.ts
index 800ad4220d..004baba2c0 100644
--- a/packages/sdk/src/implementation/app-storage.ts
+++ b/packages/sdk/src/implementation/app-storage.ts
@@ -16,6 +16,8 @@ import { database } from "./database.ts";
 import { callerContext, resolve, snapshot, type InvocationSnapshot } from "./tools.ts";
 import type { makeOAuth } from "./oauth.ts";
 import { ownsDatabase, sharesRuntime } from "../contracts/apps.ts";
+import type { HostApi } from "../contracts/executor.ts";
+import { versionHostApi } from "./declarations.ts";
 import { refreshAtMostEvery } from "./live-refresh.ts";
 
 /**
@@ -42,6 +44,7 @@ export const makeAppData = (
   storage: ExecutorDatabase,
   resolveAccount: ReturnType<typeof makeOAuth>["resolveSelected"],
   runtime: Runtime,
+  hostApi: HostApi | undefined,
   workflows?: (state: InvocationSnapshot) => WorkflowHostControls,
 ) => {
   const db = database(storage);
@@ -56,6 +59,7 @@ export const makeAppData = (
       const accounts = yield* resolve(state, resolveAccount);
       return yield* runtime[kind]({
         build: state.version.build,
+        hostApi: versionHostApi(hostApi, state.version),
         database: ownsDatabase(state.version.requirements),
         sharedRuntime: sharesRuntime(state.version.requirements),
         ...accounts,
diff --git a/packages/sdk/src/implementation/apps.ts b/packages/sdk/src/implementation/apps.ts
index cbdeeb1c1e..565f7dcb99 100644
--- a/packages/sdk/src/implementation/apps.ts
+++ b/packages/sdk/src/implementation/apps.ts
@@ -231,12 +231,15 @@ const appWriteFailure = (app: Pick<StoredApp, "owner" | "name" | "slug">) => (er
   return new StorageError();
 };
 /** Insert app identity while preserving name and derived-slug uniqueness errors. */
-/** A new active version re-registers the app's managed webhooks; removed sources keep removing. */
+/**
+ * A new active version re-registers the app's managed webhooks; removed sources keep removing. It is
+ * new intent, so each source runs again with no failures counted.
+ */
 const webhookSourcesPending = (db: Query, app: AppId) =>
   query(() =>
     db.updateMany("webhookSources", {
       where: (b) => b.and(b("app", "=", app), b("status", "!=", "removing")),
-      set: { status: "pending", failure: null },
+      set: { status: "pending", failure: null, retries: 0 },
     }),
   );
 
diff --git a/packages/sdk/src/implementation/create.ts b/packages/sdk/src/implementation/create.ts
index 6d6d705468..c0cd6235a8 100644
--- a/packages/sdk/src/implementation/create.ts
+++ b/packages/sdk/src/implementation/create.ts
@@ -21,7 +21,12 @@ import { AppId, CredentialsError, NotImplemented, StorageError } from "../contra
 import { makeWebhooks } from "./webhooks.ts";
 import { makeAppData } from "./app-storage.ts";
 import { makeAccountConnections } from "./account-connections.ts";
-import { credentialsReadable, makeAccounts, storedAccount } from "./accounts.ts";
+import {
+  credentialsReadable,
+  makeAccounts,
+  moveImportedAccount,
+  storedAccount,
+} from "./accounts.ts";
 import { makeSavedOAuthClients } from "./saved-oauth-clients.ts";
 import { makeOwnerMoves } from "./owner-moves.ts";
 import { SavedOAuthClientsHost } from "../contracts/oauth-clients.ts";
@@ -33,6 +38,7 @@ import { makeSchedules } from "./schedules.ts";
 import { makeTools } from "./tools.ts";
 import { makeSkills } from "./skills.ts";
 import { toEffectRuntime } from "./runtime.ts";
+import { validateFields } from "./provider.ts";
 import { database } from "./database.ts";
 import { makeOAuth } from "./oauth.ts";
 import { makeDeclarationCache, makeDeclarations } from "./declarations.ts";
@@ -101,9 +107,10 @@ export const createExecutor = (
       durable: options.cache?.durable,
       background: options.background,
       resolveAccount: oauth.resolveSelected,
-      accountUsable: oauth.usable,
+      accountsUsable: oauth.usableAll,
       crypto,
       lifecycle: options.hooks,
+      hostApi: options.hostApi,
     });
     const workflows = makeWorkflowRuns(
       options.database,
@@ -172,6 +179,7 @@ export const createExecutor = (
       oauth,
       firstPartyClients,
       apps.list,
+      options.hostApi,
     );
     const schedules = makeSchedules(
       options.database,
@@ -186,6 +194,7 @@ export const createExecutor = (
       liveDefinitions: webhooks.liveDefinitions,
       retarget: webhooks.retarget,
       createManaged: webhooks.createManaged,
+      removeManaged: webhooks.removeManaged,
       accountNeedingReconnect: tools.accountNeedingReconnect,
     });
     // App source defines schedules. Each activation removes saved settings for schedules the new
@@ -222,8 +231,17 @@ export const createExecutor = (
       },
       [OAuthGrantImport]: {
         importOAuthGrant: oauth.importGrant,
+        checkOAuthGrant: oauth.checkGrant,
+        checkAccountFields: (input) =>
+          validateFields(input.provider, input.definition, input.method, input.fields).pipe(
+            Effect.asVoid,
+          ),
         firstPartyClient: oauth.firstPartyClient,
         credentialsReadable: credentialsReadable(db, credentials),
+        moveImportedAccount: moveImportedAccount(db),
+        refreshImportedGrant: oauth.refreshImportedGrant,
+        // The same removal without the provider-side revocation `accountOperations` makes.
+        removeImportedAccount: makeAccounts(db, credentials, crypto, options.hooks).remove,
       },
       [StorageHost]: {
         transaction: (effect) =>
@@ -288,7 +306,13 @@ export const createExecutor = (
         unlink: webhookSources.unlink,
       },
       webhookSetup: webhooks.webhookSetup,
-      appData: makeAppData(options.database, oauth.resolveSelected, runtime, workflows.controls),
+      appData: makeAppData(
+        options.database,
+        oauth.resolveSelected,
+        runtime,
+        options.hostApi,
+        workflows.controls,
+      ),
       tools: { ...tools, search: search.page },
     };
   });
diff --git a/packages/sdk/src/implementation/credential-handles.ts b/packages/sdk/src/implementation/credential-handles.ts
index c379bad45d..c2602f2352 100644
--- a/packages/sdk/src/implementation/credential-handles.ts
+++ b/packages/sdk/src/implementation/credential-handles.ts
@@ -57,7 +57,11 @@ import {
   type ResolvedAccounts,
 } from "apps/contracts";
 import { isLoopbackHostname, isPrivateHostname } from "@executor-js/utils/url-policy";
+import type { HostApiCheck } from "../contracts/host-api.ts";
 import {
+  hostApiChangingHeader,
+  hostApiChangingResponse,
+  hostApiChangingStatus,
   NetworkUnreachable,
   networkUnreachableHeader,
   networkUnreachableResponse,
@@ -699,6 +703,8 @@ export interface CredentialOutbound {
   readonly egress: AppEgress;
   /** Send the rewritten request on the host's network. It rejects when that network fails. */
   readonly send: (request: Request) => Promise<Response>;
+  /** The host API revision the invocation's cache belongs to; see `hostApiDocument`. */
+  readonly hostApi?: HostApiCheck;
 }
 
 /**
@@ -710,10 +716,47 @@ export interface CredentialOutbound {
  * send. Any other failure is Executor's own and rejects.
  */
 export const credentialFetch = (request: Request, outbound: CredentialOutbound) =>
-  forward(request, outbound).catch((error: unknown) => {
-    if (Schema.is(NetworkUnreachable)(error)) return networkUnreachableResponse(error);
-    throw error;
-  });
+  forward(request, outbound)
+    .then((response) => hostApiDocument(request, response, outbound.hostApi))
+    .catch((error: unknown) => {
+      if (Schema.is(NetworkUnreachable)(error)) return networkUnreachableResponse(error);
+      throw error;
+    });
+
+/**
+ * The host's API document, when its SHA-256 is the revision the invocation's cache belongs to. A
+ * host that deploys its API apart from the Workers that call apps serves the previous API to a
+ * caller of the next one, or the next API to a caller of the previous one, while either rolls
+ * out. That document must not fill a cache named for the other revision. The app's `fetch`
+ * rejects with `hostApiChangingCode` (see `hostApiChangingResponse`), so the app keeps nothing, its
+ * caller is told to retry shortly, and a later read fetches the document again.
+ */
+const hostApiDocument = async (
+  request: Request,
+  response: Response,
+  hostApi: HostApiCheck | undefined,
+) => {
+  const url = new URL(request.url);
+  if (
+    hostApi === undefined ||
+    request.method !== "GET" ||
+    !response.ok ||
+    !hostApi.documents.some((document) => {
+      const served = new URL(document);
+      return served.origin === url.origin && served.pathname === url.pathname;
+    })
+  )
+    return response;
+  const body = await response.arrayBuffer();
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", body));
+  if (Hex.encode(digest) === hostApi.revision)
+    return new Response(body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers,
+    });
+  return hostApiChangingResponse();
+};
 
 /**
  * The host's network failed to send. The app's own cancellation keeps its error, so the app's
@@ -877,6 +920,7 @@ const forward = async (request: Request, outbound: CredentialOutbound): Promise<
 const marks = [
   [networkRefusalStatus, networkRefusalHeader],
   [networkUnreachableStatus, networkUnreachableHeader],
+  [hostApiChangingStatus, hostApiChangingHeader],
 ] as const;
 const forged = (response: Response) =>
   marks.find(([status, header]) => response.status === status && response.headers.has(header))?.[1];
diff --git a/packages/sdk/src/implementation/database.ts b/packages/sdk/src/implementation/database.ts
index 9379bce807..ff21cce610 100644
--- a/packages/sdk/src/implementation/database.ts
+++ b/packages/sdk/src/implementation/database.ts
@@ -1,21 +1,50 @@
 /** Native Effect database operations; SQL failures are projected to safe domain errors. */
-import { Effect } from "effect";
+import { Effect, Result } from "effect";
+import { SqlError } from "effect/sql";
+import { failureAttributes, withFailureAttributes } from "@executor-js/telemetry/failed-span";
 import { StorageError } from "../contracts/shared.ts";
 import type { ExecutorDatabase } from "./storage.ts";
 
 /** Bound query handle sharing the host connection and reactive transaction context. */
 export type Query = ReturnType<typeof database>;
 /** Select the latest migrated storage schema. */
-export const database = (storage: ExecutorDatabase) => storage.orm("4.0.15");
+export const database = (storage: ExecutorDatabase) => storage.orm("4.0.16");
 /**
  * Run a lazy native query without leaking SQL or driver details. The query's own
- * FumaDB span covers the same interval, so this boundary adds no span of its own.
+ * `sql.execute` spans cover the same interval, so this boundary adds no span of its own.
  */
 export const query = <A, E, R>(work: () => Effect.Effect<A, E, R>) =>
-  Effect.suspend(work).pipe(Effect.mapError(() => new StorageError()));
+  Effect.suspend(work).pipe(
+    // A span that records the failure still names the statement and the database's kind of failure.
+    Effect.mapError((error) => withFailureAttributes(new StorageError(), failureAttributes(error))),
+  );
 /** Preserve native Effect failures and cancellation through the SQL transaction. */
 export const transaction = <A, E, R>(db: Query, work: (tx: Query) => Effect.Effect<A, E, R>) =>
   db.transaction(Effect.suspend(() => work(db))).pipe(
     Effect.withSpan("storage.transaction"),
-    Effect.catchTag("SqlError", () => new StorageError()),
+    Effect.catchTag("SqlError", (error) =>
+      // A statement inside it that failed outside `query` names itself; otherwise the transaction does.
+      withFailureAttributes(new StorageError(), {
+        "executor.storage.operation": "transaction",
+        ...(SqlError.isSqlError(error) && { "executor.storage.reason": error.reason._tag }),
+        ...failureAttributes(error),
+      }),
+    ),
+  );
+/**
+ * Run two effects at once but report the first one's failure first, as if they ran in order. Read
+ * ahead of a check this way only: the second's result is released only once the first succeeded.
+ */
+export const inOrder = <A, B, E1, E2, R1, R2>(
+  first: Effect.Effect<A, E1, R1>,
+  second: Effect.Effect<B, E2, R2>,
+) =>
+  Effect.all([Effect.result(first), Effect.result(second)], { concurrency: "unbounded" }).pipe(
+    Effect.flatMap(([a, b]) =>
+      Result.isFailure(a)
+        ? Effect.fail<E1 | E2>(a.failure)
+        : Result.isFailure(b)
+          ? Effect.fail<E1 | E2>(b.failure)
+          : Effect.succeed([a.success, b.success] as const),
+    ),
   );
diff --git a/packages/sdk/src/implementation/declaration-config.ts b/packages/sdk/src/implementation/declaration-config.ts
index ed2091a8c5..2eb1fe1fcb 100644
--- a/packages/sdk/src/implementation/declaration-config.ts
+++ b/packages/sdk/src/implementation/declaration-config.ts
@@ -13,8 +13,10 @@ const FiniteNonNegative = Schema.FiniteFromString.check(Schema.isGreaterThanOrEq
 
 /**
  * `EXECUTOR_TOOL_LISTING_FRESH_SECONDS` (default 30) and `EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS`
- * (default 86400) set how long an evaluated tool listing is reused; a maximum age of 0 evaluates
+ * (default 604800) set how long an evaluated tool listing is reused; a maximum age of 0 evaluates
  * every listing, and a fresh period longer than the maximum age is capped at it.
+ * `EXECUTOR_TOOL_LISTING_RENEW_SECONDS` (default 86400) is the age past which search renews the
+ * rows it serves in the background; it is capped at the maximum age too.
  * `EXECUTOR_TOOL_LISTING_LOAD_SECONDS` (default 45) stops a listing that has run that long with no
  * request waiting for it; it is capped at the maximum age, past which a listing is never served.
  * `EXECUTOR_EVALUATION_MEMORY_MB` (default 256) bounds the memory of every result this process
@@ -28,6 +30,10 @@ export const declarationConfig: Config.Config<{
     "EXECUTOR_TOOL_LISTING_FRESH_SECONDS",
     defaultToolListingPolicy.freshMillis / 1_000,
   ),
+  renew: nonNegative(
+    "EXECUTOR_TOOL_LISTING_RENEW_SECONDS",
+    defaultToolListingPolicy.renewMillis / 1_000,
+  ),
   maxAge: nonNegative(
     "EXECUTOR_TOOL_LISTING_MAX_AGE_SECONDS",
     defaultToolListingPolicy.maxStaleMillis / 1_000,
@@ -38,17 +44,19 @@ export const declarationConfig: Config.Config<{
   ),
   memory: nonNegative("EXECUTOR_EVALUATION_MEMORY_MB", processDeclarationLimits.bytes / 2 ** 20),
 }).pipe(
-  Config.map(({ fresh, maxAge, load, memory }) => {
+  Config.map(({ fresh, renew, maxAge, load, memory }) => {
     const bytes = Math.round(memory * 2 ** 20);
     return {
       limits: {
         entries: processDeclarationLimits.entries,
         bytes,
         entryBytes: Math.min(processDeclarationLimits.entryBytes, bytes),
+        renewals: processDeclarationLimits.renewals,
       },
       toolListings: {
         ...defaultToolListingPolicy,
         freshMillis: Math.round(Math.min(fresh, maxAge) * 1_000),
+        renewMillis: Math.round(Math.min(renew, maxAge) * 1_000),
         maxStaleMillis: Math.round(maxAge * 1_000),
         loadMillis: Math.round(Math.min(load, maxAge) * 1_000),
       },
diff --git a/packages/sdk/src/implementation/declarations.ts b/packages/sdk/src/implementation/declarations.ts
index 1e7122a721..25d263acd3 100644
--- a/packages/sdk/src/implementation/declarations.ts
+++ b/packages/sdk/src/implementation/declarations.ts
@@ -2,6 +2,7 @@
 import { Clock, Deferred, Effect, Exit, Fiber, Option, Result, Schema, type Crypto } from "effect";
 import { Hex } from "effect/encoding";
 import {
+  changeCheckMillis,
   declarationFreshness,
   declarationLimits,
   durableHeadStartMillis,
@@ -13,7 +14,9 @@ import {
   type KeptEntry,
   type PendingLoad,
 } from "../contracts/declarations.ts";
-import type { ResourceLifecycle } from "../contracts/executor.ts";
+import type { HostApi, ResourceLifecycle } from "../contracts/executor.ts";
+import type { AppRequirements } from "../contracts/apps.ts";
+import { appCacheNamespace, type HostApiCheck } from "../contracts/host-api.ts";
 import { type AccountId, StorageError } from "../contracts/shared.ts";
 import type { makeOAuth } from "./oauth.ts";
 import { makeHandoff } from "./handoff.ts";
@@ -28,7 +31,10 @@ export const makeDeclarationCache = (
   const loads = new Map<string, PendingLoad>();
   /** When each app's cached upstream data last changed. */
   const changes = new Map<string, number>();
+  /** When each app's latest read of its durable change marker started. */
+  const checks = new Map<string, number>();
   let bytes = 0;
+  let renewals = 0;
   const size = (entry: KeptEntry) => (entry.kind === "json" ? entry.json.length * 2 : entry.bytes);
   const remove = (key: string) => {
     const entry = entries.get(key);
@@ -66,18 +72,45 @@ export const makeDeclarationCache = (
       if (loads.get(key) === load) loads.delete(key);
     },
     changed: (app, at) => {
-      changes.set(app, Math.max(at, changes.get(app) ?? at));
+      if (at <= (changes.get(app) ?? -Infinity)) return;
+      changes.set(app, at);
       for (const [key, entry] of entries) if (entry.app === app && entry.at <= at) remove(key);
     },
     outdated: (app, at) => at <= (changes.get(app) ?? -Infinity),
+    checked: (app) => checks.get(app),
+    check: (app, started) => {
+      checks.set(app, started);
+    },
     usage: () => ({ entries: entries.size, bytes }),
+    renewing: () => {
+      if (renewals >= limits.renewals) return false;
+      renewals += 1;
+      return true;
+    },
+    renewed: () => {
+      renewals = Math.max(0, renewals - 1);
+    },
   };
 };
 
+/**
+ * The host API revision a version's invocations are bound to, when its code reads this host's API.
+ * Their app cache and its kept tool listings are keyed by it, so an API change starts both afresh
+ * rather than serving tools of the previous API. A version that owns a database is bound too: its
+ * data calls run in a facet Worker loaded for the revision, whose network checks the document.
+ */
+export const versionHostApi = (
+  hostApi: HostApi | undefined,
+  version: { readonly requirements: AppRequirements },
+): HostApiCheck | undefined =>
+  hostApi !== undefined && hostApi.reads(version.requirements)
+    ? { revision: hostApi.revision, documents: hostApi.documents }
+    : undefined;
+
 const JsonText = Schema.fromJsonString(Schema.Unknown);
 
 /**
- * Evaluated declarations depend on the build, the invocation scope, the account set and its credential generations. Token renewal keeps a result; reconnecting replaces it. Every read reruns the invocation snapshot; a kept result is served
+ * Evaluated declarations depend on the build (and the host API revision for apps that read it), the invocation scope, the account set and its credential generations. Token renewal keeps a result; reconnecting replaces it. Every read reruns the invocation snapshot; a kept result is served
  * only after the same lifecycle checks that precede credential release in an evaluation.
  */
 export const makeDeclarations = (options: {
@@ -85,9 +118,10 @@ export const makeDeclarations = (options: {
   readonly durable: DurableDeclarations | undefined;
   readonly background: BackgroundWork | undefined;
   readonly resolveAccount: ReturnType<typeof makeOAuth>["resolveSelected"];
-  readonly accountUsable: ReturnType<typeof makeOAuth>["usable"];
+  readonly accountsUsable: ReturnType<typeof makeOAuth>["usableAll"];
   readonly crypto: Crypto.Crypto;
   readonly lifecycle: ResourceLifecycle | undefined;
+  readonly hostApi: HostApi | undefined;
 }) => {
   const digest = (bytes: Uint8Array) =>
     options.crypto.digest("SHA-256", bytes).pipe(
@@ -112,7 +146,7 @@ export const makeDeclarations = (options: {
             state.app.owner,
             state.app.id,
             state.version.id,
-            state.version.build,
+            appCacheNamespace(state.version.build, versionHostApi(options.hostApi, state.version)),
             // A caller's evaluation and actorless work see different contexts: only one has `user`.
             state.scope,
             selections,
@@ -140,11 +174,7 @@ export const makeDeclarations = (options: {
         accounts.every((account) => allowed.has(account.id))
           ? Effect.void
           : Effect.fail(new StorageError()),
-      usable: Effect.forEach(
-        selected,
-        ({ account, provider }) => options.accountUsable(account, provider),
-        { concurrency: "unbounded", discard: true },
-      ),
+      usable: options.accountsUsable(selected),
     };
   };
   const authorize = (state: InvocationSnapshot) =>
@@ -240,8 +270,38 @@ export const makeDeclarations = (options: {
       ? write
       : options.background(write).pipe(Effect.asVoid);
   };
+  /**
+   * Forget what this process keeps of the app from before its cached data last changed, as the
+   * app's durable store recorded it, unless this process started reading that within
+   * `changeCheckMillis`. The read runs as background work, so the caller and the readers beside it
+   * serve what is kept now, and later readers serve what it leaves. Without background work, or
+   * once the host refuses it, the caller waits for the read.
+   */
+  const followChanges = (app: string): Effect.Effect<void> =>
+    Effect.gen(function* () {
+      const durable = options.durable;
+      if (durable === undefined) return;
+      const now = yield* Clock.currentTimeMillis;
+      const last = options.cache.checked(app);
+      if (last !== undefined && now - last < changeCheckMillis) return;
+      options.cache.check(app, now);
+      const read = durable.changed(app).pipe(
+        Effect.tap((at) =>
+          Effect.sync(() => {
+            if (at !== undefined) options.cache.changed(app, at);
+          }),
+        ),
+        Effect.asVoid,
+      );
+      const accepted = options.background === undefined ? false : yield* options.background(read);
+      if (!accepted) yield* read;
+    });
   return {
     key,
+    followChanges,
+    /** The host API revision an invocation of this version is bound to; see `versionHostApi`. */
+    hostApi: (version: Parameters<typeof versionHostApi>[1]) =>
+      versionHostApi(options.hostApi, version),
     authorize,
     authorizeEach,
     recall,
@@ -306,7 +366,7 @@ export const makeDeclarations = (options: {
             kept === undefined ? Effect.void : persist(state.app.id, id, Effect.succeed(kept)),
           ),
         );
-        const current = (entry: KeptEntry | undefined, now: number) =>
+        const fresh = (entry: KeptEntry | undefined, now: number) =>
           entry?.kind === "json" && now - entry.at < declarationFreshness.maxStaleMillis
             ? entry
             : undefined;
@@ -452,7 +512,8 @@ export const makeDeclarations = (options: {
             );
           }),
         );
-        const kept = current(yield* options.cache.get(id), yield* Clock.currentTimeMillis);
+        yield* followChanges(state.app.id);
+        const kept = fresh(yield* options.cache.get(id), yield* Clock.currentTimeMillis);
         if (kept?.kind === "json") return yield* serve(kept);
         if (options.durable === undefined) return yield* miss;
         // Another isolate's result, unless an invalidation seen here replaced it. It is kept here
@@ -465,7 +526,7 @@ export const makeDeclarations = (options: {
                   return undefined;
                 const entry = { kind: "json" as const, app: state.app.id, ...found };
                 yield* options.cache.set(id, entry);
-                return current(entry, yield* Clock.currentTimeMillis);
+                return fresh(entry, yield* Clock.currentTimeMillis);
               }),
             ),
           ),
diff --git a/packages/sdk/src/implementation/evaluated-declarations.ts b/packages/sdk/src/implementation/evaluated-declarations.ts
index 7c6d0c286b..7014631631 100644
--- a/packages/sdk/src/implementation/evaluated-declarations.ts
+++ b/packages/sdk/src/implementation/evaluated-declarations.ts
@@ -5,6 +5,7 @@
  */
 import { Clock, Effect, Schema } from "effect";
 import {
+  EvaluatedChanged,
   EvaluatedEntry,
   EvaluatedWritten,
   evaluatedLimits,
@@ -79,6 +80,23 @@ export const evaluatedDeclarations = <E>(
       ),
       Effect.withSpan("storage.evaluated.read", { attributes: { "executor.app.id": app } }),
     ),
+  changed: (app) =>
+    Effect.gen(function* () {
+      const reply = yield* timed("storage.evaluated.rpc_ms", send(app, { operation: "changed" }));
+      // A supervisor from before `changed` answers it as a miss: nothing is known.
+      const found = Schema.decodeUnknownOption(EvaluatedChanged)(reply);
+      if (found._tag === "None") return undefined;
+      yield* annotateSupervisor(found.value.supervisor);
+      yield* Effect.annotateCurrentSpan("storage.evaluated.changed", found.value.changed ?? 0);
+      return found.value.changed ?? undefined;
+    }).pipe(
+      Effect.timeout(readMillis),
+      // Unknown, as when it never changed; the next check asks again.
+      Effect.catch((error) =>
+        Effect.logWarning("App cache change read failed", error).pipe(Effect.as(undefined)),
+      ),
+      Effect.withSpan("storage.evaluated.changed", { attributes: { "executor.app.id": app } }),
+    ),
   set: (app, key, entry) =>
     Effect.gen(function* () {
       const body = new Uint8Array(yield* transform(entry.json, new CompressionStream("gzip")));
diff --git a/packages/sdk/src/implementation/event-worker.ts b/packages/sdk/src/implementation/event-worker.ts
index 12fb1d95a0..bacb57b66c 100644
--- a/packages/sdk/src/implementation/event-worker.ts
+++ b/packages/sdk/src/implementation/event-worker.ts
@@ -1,5 +1,6 @@
 /** A Node host delivers due events in its own scope, waking every few seconds. */
 import { Effect, Schedule } from "effect";
+import { traceFailure } from "@executor-js/telemetry/failed-span";
 import type { Executor } from "../contracts/executor.ts";
 import { ScheduleHostReady } from "../contracts/schedule-worker.ts";
 
@@ -12,7 +13,10 @@ export const deliverEvents = (executor: Executor) =>
     yield* Effect.flatten(ScheduleHostReady);
     yield* executor.events.deliver({ maxDeliveries: batch }).pipe(
       Effect.repeat({ while: (more) => more }),
-      Effect.withSpan("events.dispatch"),
+      // A pass runs every two seconds; one that finds nothing to deliver records nothing. One
+      // that fails is still a trace of its own.
+      Effect.withTracerEnabled(false),
+      traceFailure("events.dispatch"),
       Effect.catch(() => Effect.logError("Event delivery failed")),
       Effect.repeat(Schedule.spaced("2 seconds")),
     );
diff --git a/packages/sdk/src/implementation/events.ts b/packages/sdk/src/implementation/events.ts
index a97c2f9936..e61a412267 100644
--- a/packages/sdk/src/implementation/events.ts
+++ b/packages/sdk/src/implementation/events.ts
@@ -5,6 +5,7 @@
  */
 import { Clock, Data, Effect, Option, Redacted, Schema } from "effect";
 import { Base64 } from "effect/encoding";
+import { traceFailure } from "@executor-js/telemetry/failed-span";
 import { DeclaredEvents } from "apps/contracts";
 import {
   AppEventDefinition,
@@ -784,7 +785,11 @@ export const makeEvents = (input: {
           limit: 100,
         }),
       );
-      for (const row of lapsed) yield* stopWith(EventSubscriptionId.make(row.id), "expired");
+      // A host may poll without tracing; the work a pass finds is traced all the same.
+      for (const row of lapsed)
+        yield* stopWith(EventSubscriptionId.make(row.id), "expired").pipe(
+          Effect.withTracerEnabled(true),
+        );
       const due = yield* query(() =>
         db.findMany("eventDeliveries", {
           where: (b) =>
@@ -801,13 +806,19 @@ export const makeEvents = (input: {
         due,
         (row) =>
           claim(row.id).pipe(
-            Effect.flatMap((claimed) => (claimed === null ? Effect.void : attempt(claimed))),
+            traceFailure("sdk.events.claim"),
+            Effect.flatMap((claimed) =>
+              claimed === null
+                ? Effect.void
+                : attempt(claimed).pipe(Effect.withTracerEnabled(true)),
+            ),
             Effect.catch(() => Effect.logWarning("Event delivery attempt failed")),
           ),
         { concurrency: 8, discard: true },
       );
-      // Retention never blocks delivery: it runs after, and its own failure is only logged.
+      // Retention never blocks delivery: it runs after, and its own failure is recorded, not raised.
       yield* cleanup(time).pipe(
+        traceFailure("sdk.events.retention"),
         Effect.catch(() => Effect.logWarning("Event retention cleanup failed")),
       );
       return due.length === maxDeliveries;
diff --git a/packages/sdk/src/implementation/handoff.ts b/packages/sdk/src/implementation/handoff.ts
index ee19199662..e29814f3ee 100644
--- a/packages/sdk/src/implementation/handoff.ts
+++ b/packages/sdk/src/implementation/handoff.ts
@@ -15,6 +15,8 @@ export interface Handoff<A> {
   readonly await: Effect.Effect<A>;
   /** Settles the handoff once. Returns false when it was already settled. */
   readonly settle: (value: A) => Effect.Effect<boolean>;
+  /** Whether it has settled, so a new waiter would have the value at once. */
+  readonly isSettled: () => boolean;
 }
 
 export const makeHandoff = <A>(): Handoff<A> => {
@@ -32,5 +34,6 @@ export const makeHandoff = <A>(): Handoff<A> => {
         resolve(value);
         return true;
       }),
+    isSettled: () => settled,
   };
 };
diff --git a/packages/sdk/src/implementation/listings.ts b/packages/sdk/src/implementation/listings.ts
index 61fa2f3faf..5ab3faaa5e 100644
--- a/packages/sdk/src/implementation/listings.ts
+++ b/packages/sdk/src/implementation/listings.ts
@@ -70,6 +70,25 @@ interface ListingRead extends ToolListOptions {
   readonly resolved?: Effect.Success<ReturnType<typeof resolve>>;
   /** Do not retain a decoded listing after a cold search fill writes its rows. */
   readonly retain?: boolean;
+  /**
+   * The read itself runs as the host's background work, such as a renewal of aged search rows.
+   * An evaluation it runs in its own fiber, because the host refused it as separate background
+   * work once the request was closing, is then still the host's: the host ending it is
+   * remembered as a timeout, as it is for one the host accepted.
+   */
+  readonly hosted?: boolean;
+  /**
+   * Whether the read checks that what this process keeps of the app is from after its cached data
+   * last changed (`followChanges`), as it does by default. A call's own read of the tool's kind
+   * passes false: it runs before the call hands its work to the app, which resolves the tool
+   * against its live catalog, so it sends the supervisor nothing ahead of that.
+   */
+  readonly followChanges?: boolean;
+  /**
+   * Serve no kept listing evaluated at or before this time, such as the one a renewal of search
+   * rows evaluated then replaces: the read evaluates the app unless a newer listing is kept.
+   */
+  readonly newerThan?: number;
 }
 
 /** A kept listing. */
@@ -105,6 +124,19 @@ class Failed {
     this.at = at;
   }
 }
+/**
+ * A background renewal of search rows, kept beside the listing under its own key from when it
+ * started. Rows evaluated before it are not renewed again until `renewalRetryMillis` after it,
+ * whether it finished, failed or the host stopped it. One that failed in the app or its upstream
+ * keeps that failure, which searches report beside the rows they still serve, however fast it
+ * failed. It is kept in this process or isolate only.
+ */
+class Renewal {
+  readonly failure: AppEvaluationFailed | AppProviderFailed | undefined;
+  constructor(failure?: AppEvaluationFailed | AppProviderFailed) {
+    this.failure = failure;
+  }
+}
 class Unkept {
   readonly error: ResolveError;
   constructor(error: ResolveError) {
@@ -120,6 +152,15 @@ class Stopped {
 }
 type Outcome = Evaluated | Failed | Unkept | Stopped;
 
+/**
+ * Whether the app's own router failed for some of its accounts, such as one account whose MCP
+ * server refused to list its tools, while the others' tools were listed. Such a listing is served
+ * to the readers of its evaluation but never kept, like a failure, so the next read evaluates the
+ * app again and finds a recovered account.
+ */
+const partial = (routers: ReadonlyArray<ToolRouter>) =>
+  routers.some((router) => router.path === "" && router.error !== undefined);
+
 /**
  * Keep each evaluated listing in the shared declaration store under the declaration key, so a
  * new version, account set or stored credential is another listing,
@@ -151,9 +192,16 @@ export const makeListings = (options: {
 }) => {
   const policy = options.policy ?? defaultToolListingPolicy;
   const { cache, background, search } = options;
-  /** Cold search fills evaluate through one small isolate-wide gate. */
+  /** Cold search fills of one executor share a small gate. */
   const searchFillLimit = 2;
   const searchFillGate = Semaphore.makeUnsafe(searchFillLimit);
+  /**
+   * How long after a renewal of search rows starts that rows evaluated before it are renewed
+   * again: a host that ends background work soon after a request may stop a slow app's renewal
+   * every time, and other apps' rows still need theirs.
+   */
+  const renewalRetryMillis = Math.min(10 * 60_000, policy.renewMillis);
+  const renewalKey = (id: string) => `${id}:renewal`;
   /**
    * Keep an evaluated listing as search rows. A failure is logged: `searchable` finds the rows
    * missing or older than the listing and writes them again before naming them.
@@ -162,7 +210,30 @@ export const makeListings = (options: {
     search
       .write(state, ToolSearchListing.make(id), listing, at)
       .pipe(Effect.catchCause(() => Effect.logWarning("Tool search rows were not saved")));
-  const readAt = (state: InvocationSnapshot, evaluate: Evaluate, read: ListingRead = {}) =>
+  /** Keep a renewal of `id`'s rows, stamped with its start, so an app cache change since forgets it. */
+  const renewal = (
+    id: string,
+    state: InvocationSnapshot,
+    started: number,
+    failure?: AppEvaluationFailed | AppProviderFailed,
+  ) =>
+    cache.set(renewalKey(id), {
+      kind: "value",
+      app: state.app.id,
+      at: started,
+      value: new Renewal(failure),
+      bytes: 0,
+    });
+  /**
+   * `earlier` is the evaluation that was running when the caller began reading where a listing
+   * is kept outside this read, such as search rows.
+   */
+  const readAt = (
+    state: InvocationSnapshot,
+    evaluate: Evaluate,
+    read: ListingRead = {},
+    earlier?: PendingLoad,
+  ) =>
     Effect.gen(function* () {
       const identity = { app: state.app.id, version: state.version.id };
       const evaluated = (
@@ -190,7 +261,7 @@ export const makeListings = (options: {
           if (outcome instanceof Evaluated) {
             // What the evaluation's CPU, which a Workers I/O clock cannot time, grows with.
             yield* Effect.annotateCurrentSpan(outcome.sizes);
-            if (read.retain !== false)
+            if (read.retain !== false && !partial(outcome.listed.listing.routers))
               yield* cache.set(id, {
                 kind: "value",
                 app: state.app.id,
@@ -224,10 +295,12 @@ export const makeListings = (options: {
         });
       /**
        * Keep a listing beyond this process, and as search rows. It runs after the evaluation's
-       * readers have their outcome, and encodes with the write, so they never wait for it.
+       * readers have their outcome, and encodes with the write, so they never wait for it, and
+       * before the evaluation leaves `pending`: a cold search fill keeps its listing nowhere else,
+       * so a reader that comes meanwhile joins the finished evaluation instead of starting another.
        */
       const store = (outcome: Outcome, load: PendingLoad) =>
-        outcome instanceof Evaluated
+        outcome instanceof Evaluated && !partial(outcome.listed.listing.routers)
           ? options.declarations
               .persist(
                 state.app.id,
@@ -277,10 +350,8 @@ export const makeListings = (options: {
           Effect.tap((outcome) => keep(outcome, load)),
           Effect.onExit((exit) =>
             Effect.gen(function* () {
-              if (Exit.isSuccess(exit)) {
-                cache.end(id, load);
-                return yield* load.done.settle(exit.value);
-              }
+              // It leaves `pending` once `store` below has kept it.
+              if (Exit.isSuccess(exit)) return yield* load.done.settle(exit.value);
               // Remembered before it leaves `pending`, like an outcome kept above, so a reader
               // always finds one of them.
               const at = yield* Clock.currentTimeMillis;
@@ -296,6 +367,7 @@ export const makeListings = (options: {
           // In the evaluation's own fiber: background work that offered the write as new
           // background work would find the host refusing it once the request is closing.
           Effect.flatMap((outcome) => store(outcome, load)),
+          Effect.ensuring(Effect.sync(() => cache.end(id, load))),
           Effect.withSpan("sdk.tools.listing.evaluate"),
           // Background work may start uninterruptible; its time bound must still stop it.
           Effect.interruptible,
@@ -363,8 +435,9 @@ export const makeListings = (options: {
       // listing is evaluated again first, like a missing one.
       const refreshes = read.refreshStale !== false;
       const servable = (at: number) =>
-        now - at < policy.freshMillis ||
-        (now - at < policy.maxStaleMillis && (background !== undefined || !refreshes));
+        (read.newerThan === undefined || at > read.newerThan) &&
+        (now - at < policy.freshMillis ||
+          (now - at < policy.maxStaleMillis && (background !== undefined || !refreshes)));
       /**
        * Serve a kept listing, refreshing it in the background once it is past `freshMillis`
        * unless the reader asked not to.
@@ -392,9 +465,16 @@ export const makeListings = (options: {
               : undefined,
           ),
         );
+      // What this process keeps of the app from before its cached data changed is forgotten once
+      // the check this starts, if one is due, reads when that was.
+      if (read.followChanges !== false) yield* options.declarations.followChanges(state.app.id);
       const early = yield* keptListing;
       if (early?.value instanceof Listed && servable(early.at))
         return yield* serve(early.at, early.value, "memory");
+      // What runs before this read looks beyond this process and in memory again, or, as
+      // `earlier`, before its caller read search rows. An evaluation that ends keeps its listing
+      // or failure there before it leaves `pending`, so reading what runs first never misses both.
+      const before = cache.pending(id) ?? earlier;
       // Another isolate's listing, unless an invalidation seen here replaced it. It is kept
       // here too when it fits. A remembered failure here does not hide it.
       const recalling = yield* Effect.forkChild(
@@ -445,10 +525,7 @@ export const makeListings = (options: {
                 ),
               ),
             );
-      // The durable read yielded, and an evaluation may have ended meanwhile. One that ends
-      // keeps its listing or failure before it leaves `pending`, so reading what runs before
-      // what is kept never misses both.
-      const before = cache.pending(id);
+      // The durable read yielded, and an evaluation may have ended meanwhile.
       const kept = yield* keptListing;
       if (kept?.value instanceof Listed && servable(kept.at))
         return yield* serve(kept.at, kept.value, "memory");
@@ -465,17 +542,33 @@ export const makeListings = (options: {
         yield* refresh;
         return yield* Effect.fail(kept.value.error);
       }
-      // Read again so that checking and registering below happen without yielding.
-      const running = cache.pending(id);
-      if (running === undefined && before !== undefined) {
+      /**
+       * An evaluation a reader may share. One that finished, but started no later than an app
+       * cache change seen here, listed the replaced data and was not kept, so a reader evaluates
+       * again as if it had found nothing.
+       */
+      const shared = (load: PendingLoad | undefined) =>
+        load === undefined || (load.done.isSettled() && cache.outdated(state.app.id, load.started))
+          ? undefined
+          : load;
+      // Read again so that checking and registering below happen without yielding. Registering
+      // replaces an evaluation that is not shared.
+      const running = shared(cache.pending(id));
+      const ended = shared(before);
+      if (running === undefined && ended !== undefined) {
         // It ended after the read above: the outcome it left is there already.
         yield* Effect.annotateCurrentSpan("executor.declarations.cache", "joined");
-        return yield* join(before);
+        return yield* join(ended);
       }
       if (running !== undefined) {
         const elapsed = now - running.started;
         const bound = read.reportRunningAfterMillis;
-        if (bound !== undefined && (running.overdue || elapsed >= bound)) {
+        // One that finished and is still keeping its listing has the outcome for this reader.
+        if (
+          bound !== undefined &&
+          !running.done.isSettled() &&
+          (running.overdue || elapsed >= bound)
+        ) {
           yield* authorize;
           yield* Effect.annotateCurrentSpan("executor.declarations.cache", "running");
           return yield* Effect.fail(timedOut(elapsed, true));
@@ -492,33 +585,178 @@ export const makeListings = (options: {
           ? false
           : yield* Effect.uninterruptible(background(run(load, "host")));
       if (detached) return yield* orRecalled(join(load));
-      // Without background work the evaluation belongs to this reader and stops with it.
+      // Without background work the evaluation belongs to this reader and stops with it, unless
+      // the reader is the host's background work.
       load.waiters = 1;
-      yield* run(load, "reader");
+      yield* run(load, read.hosted === true ? "host" : "reader");
       return yield* outcome(yield* load.done.await, load.started);
     }).pipe(
       Effect.withSpan("sdk.tools.listing", {
         attributes: { "executor.app.id": state.app.id },
       }),
     );
+  /**
+   * Renew search rows evaluated at `rows` in the background, only when the store admits another
+   * renewal at once: renewals queued behind others would mostly wait out the host's background
+   * time, the search that starts one is not waiting for it, and every executor of the process or
+   * isolate shares the store, so one request cannot start a renewal for each of many apps. It evaluates the app unless a listing
+   * evaluated since the rows is kept, and writes that listing's rows. Only a failure in the app or
+   * its upstream is kept with it; a renewal the host stopped, that ran past `loadMillis`, or met a
+   * credential or storage failure says nothing about the rows.
+   */
+  const renew = (
+    state: InvocationSnapshot,
+    id: string,
+    listing: ToolSearchListing,
+    evaluate: Evaluate,
+    rows: number,
+    failure: AppEvaluationFailed | AppProviderFailed | undefined,
+  ) =>
+    Effect.gen(function* () {
+      if (background === undefined || cache.pending(id) !== undefined) return;
+      if (!cache.renewing()) return;
+      const work = Effect.gen(function* () {
+        const started = yield* Clock.currentTimeMillis;
+        // An earlier renewal's failure is still reported while this one runs.
+        yield* renewal(id, state, started, failure);
+        // Nobody waits for it, so it joins a running evaluation however long that has run.
+        yield* readAt(state, evaluate, {
+          refreshStale: false,
+          retain: false,
+          hosted: true,
+          newerThan: rows,
+        }).pipe(
+          // Nobody waits for a renewal, so it stops waiting at the load bound rather than keep a
+          // stalled evaluation running.
+          Effect.timeoutOption(policy.loadMillis),
+          // An evaluation this renewal started kept its rows itself; a kept listing evaluated
+          // since the rows, such as another isolate's, is written here. Writing an evaluated one
+          // again would only wait for the first write while holding a connection.
+          Effect.flatMap(
+            Option.match({
+              onNone: () => Effect.void,
+              onSome: (found) =>
+                found.at >= started
+                  ? Effect.void
+                  : search.write(state, listing, found.listing, found.at).pipe(Effect.ignore),
+            }),
+          ),
+          Effect.catch((error) =>
+            error._tag === "AppEvaluationFailed" || error._tag === "AppProviderFailed"
+              ? renewal(id, state, started, error)
+              : Effect.void,
+          ),
+        );
+      }).pipe(
+        Effect.ensuring(Effect.sync(cache.renewed)),
+        Effect.withSpan("sdk.tools.searchable.renewal", {
+          attributes: { "executor.app.id": state.app.id },
+        }),
+      );
+      if (!(yield* background(work))) cache.renewed();
+    });
   return {
+    /** The host API revision this version's invocations are bound to; listings are keyed by it. */
+    hostApi: options.declarations.hostApi,
     read: (state: InvocationSnapshot, evaluate: Evaluate, read: ListingRead = {}) =>
       readAt(state, evaluate, read).pipe(Effect.map(({ listing }) => listing)),
     /**
-     * Keep the listing `read` would serve as search rows, and name them. Rows are current when an
-     * evaluation started within `maxStaleMillis`, as a kept listing a reader that does not refresh
-     * is served, no app cache change since, and no newer listing is kept here. Current rows are
-     * served after the checks a kept listing is, and kept again if a newer listing superseded
-     * them and cleanup has not removed them; otherwise the listing is read as `read` does and named only once the write commits
-     * its rows, at its evaluation's time or a later one. A write that fails is
-     * `ToolSearchUnavailable`: the rows that are kept, if any, are not this listing's.
+     * The listing a reader that does not refresh would be served without evaluating, in two steps:
+     * the one kept in this process is read now, and the returned lookup answers with it, or, only
+     * when run and none was kept here, with the one kept beyond this process. Neither evaluates the
+     * app nor waits for an evaluation that is running, so neither runs the app's code. A call reads
+     * the first step before it hands over its work: an app cache change it makes forgets the app's
+     * kept listings. Nothing is served to a caller, so access is not checked here.
+     */
+    kept: (state: InvocationSnapshot) =>
+      Effect.gen(function* () {
+        if (policy.maxStaleMillis <= 0) return Effect.succeed<ToolListing | undefined>(undefined);
+        const id = yield* options.declarations.key("tools.list", state);
+        const fresh = (at: number) =>
+          Clock.currentTimeMillis.pipe(
+            Effect.map(
+              (now) => now - at < policy.maxStaleMillis && !cache.outdated(state.app.id, at),
+            ),
+          );
+        const memory = yield* cache.get(id);
+        if (memory?.kind === "value" && memory.value instanceof Listed && (yield* fresh(memory.at)))
+          return Effect.succeed<ToolListing | undefined>(memory.value.listing);
+        const beyond: Effect.Effect<ToolListing | undefined> = options.declarations
+          .recall(state.app.id, id)
+          .pipe(
+            Effect.flatMap((recalled) =>
+              recalled === undefined
+                ? Effect.succeed(undefined)
+                : Effect.flatMap(fresh(recalled.at), (servable) =>
+                    servable
+                      ? decodeListing(recalled.json).pipe(
+                          Effect.option,
+                          Effect.map(Option.getOrUndefined),
+                        )
+                      : Effect.succeed(undefined),
+                  ),
+            ),
+            Effect.tap((listing) =>
+              Effect.annotateCurrentSpan("executor.declarations.recalled", listing !== undefined),
+            ),
+            Effect.withSpan("sdk.tools.listing.recall", {
+              attributes: { "executor.app.id": state.app.id },
+            }),
+          );
+        return beyond;
+      }).pipe(
+        Effect.withSpan("sdk.tools.listing.kept", {
+          attributes: { "executor.app.id": state.app.id },
+        }),
+      ),
+    /**
+     * Keep the listing `read` would serve as search rows, and name them. Rows evaluated within
+     * `maxStaleMillis` are served at once after the checks a kept listing is, unless an app cache
+     * change since or a newer listing kept here replaced them, and kept again if a newer listing
+     * superseded them and cleanup has not removed them. Rows older than `renewMillis` are renewed
+     * in the background while they are served; a renewal that failed in the app or its upstream is
+     * reported beside them as `stale` until a later one succeeds. Otherwise the listing is read as
+     * `read` does and named only once the write commits its rows, at its evaluation's time or a
+     * later one. A write that fails is `ToolSearchUnavailable`: the rows that are kept, if any, are
+     * not this listing's.
      */
     searchable: (state: InvocationSnapshot, evaluate: Evaluate, read: ListingRead = {}) =>
       Effect.gen(function* () {
         const id = yield* options.declarations.key("tools.list", state);
         const listing = ToolSearchListing.make(id);
         const now = yield* Clock.currentTimeMillis;
-        const kept = policy.maxStaleMillis <= 0 ? undefined : yield* search.listing(state, listing);
+        // Read before the rows: an evaluation that ends while they are read wrote them first.
+        const running = cache.pending(id);
+        // Rows from before the app's cached data last changed are not served; see `followChanges`.
+        yield* options.declarations.followChanges(state.app.id);
+        // The checks kept rows are served after run beside their read; only kept rows wait on them.
+        const [kept, access] =
+          policy.maxStaleMillis <= 0
+            ? ([undefined, undefined] as const)
+            : yield* Effect.all(
+                [
+                  search.listing(state, listing),
+                  Effect.result(options.declarations.authorize(state)),
+                ],
+                { concurrency: "unbounded" },
+              );
+        // Rows missing, stale or removed are filled from an evaluation through the shared gate,
+        // which keeps no decoded listing: rows are what later searches read. Readers of the same
+        // listing share one evaluation, which the load bound stops like any other once nobody
+        // waits for it.
+        const gated: Evaluate = (context) =>
+          Effect.gen(function* () {
+            const queued = yield* Clock.currentTimeMillis;
+            return yield* searchFillGate.withPermits(1)(
+              Effect.gen(function* () {
+                yield* Effect.annotateCurrentSpan({
+                  "executor.search.fill.wait_ms": (yield* Clock.currentTimeMillis) - queued,
+                  "executor.search.fill.limit": searchFillLimit,
+                });
+                return yield* evaluate(context);
+              }),
+            );
+          }).pipe(Effect.withSpan("sdk.tools.searchable.cold-fill"));
         const memory = yield* cache.get(id);
         const newer =
           memory?.kind === "value" &&
@@ -527,40 +765,50 @@ export const makeListings = (options: {
           memory.at > kept.at;
         if (
           kept !== undefined &&
+          access !== undefined &&
           now - kept.at < policy.maxStaleMillis &&
           !cache.outdated(state.app.id, kept.at) &&
-          !newer
+          !newer &&
+          // Written only for the search that evaluated them; see `partial`.
+          !partial(kept.routers)
         ) {
-          yield* options.declarations.authorize(state);
+          yield* Effect.fromResult(access);
           // A superseded listing is kept again unless cleanup removed it since it was read; then
           // it is written again like a missing one.
           if (kept.superseded === null || (yield* search.revive(listing))) {
-            yield* Effect.annotateCurrentSpan("executor.search.rows", "kept");
-            return { listing, routers: kept.routers };
+            const aged = now - kept.at >= policy.renewMillis;
+            const last = yield* cache.get(renewalKey(id));
+            // The latest renewal started since these rows were evaluated.
+            const renewed =
+              last?.kind === "value" && last.value instanceof Renewal && last.at > kept.at
+                ? { at: last.at, failure: last.value.failure }
+                : undefined;
+            yield* Effect.annotateCurrentSpan({
+              "executor.search.rows": aged ? "aged" : "kept",
+              "executor.search.rows.age_ms": now - kept.at,
+            });
+            if (aged && (renewed === undefined || now - renewed.at >= renewalRetryMillis))
+              yield* renew(state, id, listing, evaluate, kept.at, renewed?.failure);
+            return {
+              listing,
+              routers: kept.routers,
+              ...(renewed?.failure === undefined
+                ? {}
+                : { stale: { listedAt: kept.at, failure: renewed.failure } }),
+            };
           }
         }
         yield* Effect.annotateCurrentSpan(
           "executor.search.rows",
-          kept === undefined ? "missing" : kept.superseded !== null ? "removed" : "stale",
+          kept === undefined
+            ? "missing"
+            : kept.superseded !== null
+              ? "removed"
+              : partial(kept.routers)
+                ? "partial"
+                : "stale",
         );
-        // Rows missing, stale or removed are filled from an evaluation through the shared gate,
-        // which keeps no decoded listing: rows are what later searches read. Readers of the same
-        // listing share one evaluation, which the load bound stops like any other once nobody
-        // waits for it.
-        const gated: Evaluate = (context) =>
-          Effect.gen(function* () {
-            const queued = yield* Clock.currentTimeMillis;
-            return yield* searchFillGate.withPermits(1)(
-              Effect.gen(function* () {
-                yield* Effect.annotateCurrentSpan({
-                  "executor.search.fill.wait_ms": (yield* Clock.currentTimeMillis) - queued,
-                  "executor.search.fill.limit": searchFillLimit,
-                });
-                return yield* evaluate(context);
-              }),
-            );
-          }).pipe(Effect.withSpan("sdk.tools.searchable.cold-fill"));
-        const found = yield* readAt(state, gated, { ...read, retain: false });
+        const found = yield* readAt(state, gated, { ...read, retain: false }, running);
         yield* search
           .write(state, listing, found.listing, found.at)
           .pipe(
diff --git a/packages/sdk/src/implementation/oauth-diagnostics.ts b/packages/sdk/src/implementation/oauth-diagnostics.ts
index 5430597ac5..180b7c98a1 100644
--- a/packages/sdk/src/implementation/oauth-diagnostics.ts
+++ b/packages/sdk/src/implementation/oauth-diagnostics.ts
@@ -122,6 +122,17 @@ export const OAuthKnownErrorCode = Schema.Literals([
   "invalid_client_secret",
   "redirect_uri_mismatch",
   "bad_verification_code",
+  // Services' codes for a refresh token that can never be used again: Supabase Auth's, GitHub's,
+  // Slack's and AWS Sign-In's, matched lowercase.
+  "refresh_token_already_used",
+  "refresh_token_not_found",
+  "session_expired",
+  "session_not_found",
+  "bad_refresh_token",
+  "invalid_refresh_token",
+  "token_revoked",
+  "token_expired",
+  "user_credentials_changed",
   unrecognized,
 ]);
 export type OAuthKnownErrorCode = typeof OAuthKnownErrorCode.Type;
diff --git a/packages/sdk/src/implementation/oauth-protocol.ts b/packages/sdk/src/implementation/oauth-protocol.ts
index db9da9e761..16f944c9f4 100644
--- a/packages/sdk/src/implementation/oauth-protocol.ts
+++ b/packages/sdk/src/implementation/oauth-protocol.ts
@@ -193,15 +193,19 @@ const serviceErrorResponse = (error: unknown, description: unknown, secrets: Sen
 
 /**
  * RFC 6749 §5.2: a JSON object with an `error` code and no access token is an error response,
- * whatever its HTTP status.
+ * whatever its HTTP status. Supabase Auth's OAuth server answers a refused refresh in its own
+ * shape, `{"code": 400, "error_code": "refresh_token_already_used", "msg": "..."}`, with no
+ * `error`; its code and message stand in for RFC 6749's.
  */
 const oauthErrorBody = (body: unknown) => {
-  if (!isObject(body)) return undefined;
+  if (!isObject(body) || Reflect.get(body, "access_token") !== undefined) return undefined;
   const error = Reflect.get(body, "error");
-  return typeof error === "string" &&
-    error !== "" &&
-    Reflect.get(body, "access_token") === undefined
-    ? { error, description: Reflect.get(body, "error_description") }
+  if (typeof error === "string" && error !== "")
+    return { error, description: Reflect.get(body, "error_description") };
+  const supabase = Reflect.get(body, "error_code");
+  const message = Reflect.get(body, "msg");
+  return typeof supabase === "string" && supabase !== "" && typeof message === "string"
+    ? { error: supabase, description: message }
     : undefined;
 };
 
@@ -387,9 +391,39 @@ const isClientRejection = (error: string) =>
   error === "invalid_client_id" ||
   error.startsWith("invalid_client:");
 
+/**
+ * Services' own codes for a refresh token that can never be used again, their RFC 6749
+ * `invalid_grant`:
+ *
+ * - Supabase Auth: the token was already used outside the reuse interval, which also revokes every
+ *   token of its session, or it or its session no longer exists or has expired.
+ * - GitHub (`bad_refresh_token`, with HTTP 200): the token is invalid or expired.
+ * - Slack (with HTTP 200): `invalid_refresh_token`, or `token_revoked` for a deleted user or
+ *   workspace or a removed app.
+ * - AWS Sign-In: `TOKEN_EXPIRED` (HTTP 401) once the refresh token's session has ended, at most
+ *   12 hours after sign-in, and `USER_CREDENTIALS_CHANGED` (HTTP 403) after the user's password
+ *   changed, which revokes its refresh tokens.
+ * - OpenID Connect's `login_required` from a token endpoint: the user must sign in again. Tesla
+ *   answers it with HTTP 401 for a refresh token already used, after a password reset, or once the
+ *   user revoked the app.
+ *
+ * Several of these come with HTTP 401, which alone would read as a refusal of the client.
+ */
+const isEndedGrant = (error: string) =>
+  error === "refresh_token_already_used" ||
+  error === "refresh_token_not_found" ||
+  error === "session_expired" ||
+  error === "session_not_found" ||
+  error === "bad_refresh_token" ||
+  error === "invalid_refresh_token" ||
+  error === "token_revoked" ||
+  error === "TOKEN_EXPIRED" ||
+  error === "USER_CREDENTIALS_CHANGED" ||
+  error === "login_required";
+
 /** The reason an RFC 6749 §5.2 error code gives for a failed token request. */
 const errorReason = (error: string) =>
-  error === "invalid_grant"
+  error === "invalid_grant" || isEndedGrant(error)
     ? ("invalid_grant" as const)
     : isClientRejection(error)
       ? ("invalid_client" as const)
@@ -869,6 +903,18 @@ const applicationType = (redirect: URL) =>
     ? "native"
     : "web";
 
+/**
+ * Authorization parameters a server needs before it issues a renewable grant, where its metadata
+ * cannot say so. Google issues a refresh token only for `access_type=offline` and, once a person
+ * has consented, again only with `prompt=consent`; it neither advertises nor accepts
+ * `offline_access`. Without them every Google sign-in, including each reconnect, lasts an hour.
+ * A value the endpoint's own query or the method's `authorizationParams` sets replaces these.
+ */
+const renewableGrantParams = (endpoint: URL): Readonly<Record<string, string>> =>
+  endpoint.protocol === "https:" && endpoint.host === "accounts.google.com"
+    ? { access_type: "offline", prompt: "consent" }
+    : {};
+
 /**
  * A token request as the JSON object some services require instead of RFC 6749's form. The
  * library's parameters and client authentication are kept; only their encoding changes.
@@ -1355,13 +1401,22 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
       )
         scopes.add("offline_access");
       // A declared resource, or an explicit null, always applies. A discovered one is not
-      // sent to a server that takes the audience from the scopes instead.
+      // sent to a server whose metadata suggests it takes the audience from the scopes instead;
+      // that is Executor's inference from the server's own claims, and its source says so.
       const resourceIndicator =
         method.resource !== undefined
           ? method.resource
           : audienceFromScopes
             ? undefined
             : found?.resource;
+      const resourceSource =
+        method.resource !== undefined
+          ? ("declared" as const)
+          : found?.resource === undefined
+            ? ("none" as const)
+            : audienceFromScopes
+              ? ("inferred_scope_audience" as const)
+              : ("metadata" as const);
       // Scopes only the resource metadata lists are what the resource offers, not what an
       // operation requires, so an operator's client may ask for fewer of them.
       const advertised =
@@ -1388,6 +1443,7 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
               ),
             }),
         ...(resourceIndicator == null ? {} : { resource: resourceIndicator }),
+        resourceSource,
       };
       return { settings, ...(document === undefined ? {} : { document }) };
     });
@@ -1454,6 +1510,8 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
               // Undeclared means the client decides: with nothing advertised, a secret uses Basic.
               tokenEndpointAuthMethod: method.tokenEndpointAuthMethod,
               ...(method.resource == null ? {} : { resource: method.resource }),
+              resourceSource:
+                method.resource === undefined ? ("none" as const) : ("declared" as const),
             };
           const resource = yield* secureUrl(method.discover);
           const read = yield* discoverResource(resource);
@@ -1618,6 +1676,8 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
         const verifier = yield* Effect.sync(oauth.generateRandomCodeVerifier);
         const challenge = yield* request(() => oauth.calculatePKCECodeChallenge(verifier));
         const url = new URL(input.server.authorization_endpoint);
+        for (const [key, value] of Object.entries(renewableGrantParams(url)))
+          if (!url.searchParams.has(key)) url.searchParams.set(key, value);
         // Declared extras go first so the protocol parameters below always win.
         for (const [key, value] of Object.entries(input.authorizationParams ?? {}))
           url.searchParams.set(key, value);
@@ -1740,6 +1800,7 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
       server: OAuthServer;
       client: OAuthRegistration;
       refreshToken: string;
+      redirectUri?: string | undefined;
       resource?: string | undefined;
       /** Asked for again only when the grant names them; see `OAuthGrant`. */
       scopes?: readonly string[] | undefined;
@@ -1750,6 +1811,7 @@ export const makeOAuthProtocol = (options: OAuthOptions) => {
         async (settings) => {
           const server = metadata(input.server);
           const additionalParameters = {
+            ...(input.redirectUri === undefined ? {} : { redirect_uri: input.redirectUri }),
             ...(input.scopes === undefined || input.scopes.length === 0
               ? {}
               : { scope: input.scopes.join(" ") }),
diff --git a/packages/sdk/src/implementation/oauth.ts b/packages/sdk/src/implementation/oauth.ts
index c7fdded551..d2ad7e9c63 100644
--- a/packages/sdk/src/implementation/oauth.ts
+++ b/packages/sdk/src/implementation/oauth.ts
@@ -42,6 +42,8 @@ import {
   type OAuthClientSetup,
   OAuthCompletionFailed,
   type OAuthCompletionReason,
+  OAuthResourceIndicator,
+  type OAuthResourceSource,
   OAuthAttempt,
   OAuthAttemptId,
   OAuthAttemptRecord,
@@ -66,6 +68,7 @@ import {
   type OAuthOptions,
   type OAuthTokenServer,
   type ImportOAuthGrant,
+  type ImportedGrantTokens,
   OAuthGrantNotImportable,
 } from "../contracts/oauth.ts";
 import {
@@ -96,7 +99,7 @@ import {
 import { StoredAccount, type Credentials } from "../contracts/storage.ts";
 import { type AccountCredential, invocationAccount } from "./provider.ts";
 import { intersectCredentialHosts } from "./credential-handles.ts";
-import { query, transaction, type Query } from "./database.ts";
+import { inOrder, query, transaction, type Query } from "./database.ts";
 import {
   claimCredentials,
   credentialsDigest,
@@ -114,7 +117,7 @@ import {
   registrationGrantTypes,
   type OAuthProtocolFailed,
 } from "./oauth-protocol.ts";
-import { defaultLabel, ownedAccount } from "./accounts.ts";
+import { defaultLabel, ownedAccount, resumeWaitingSources } from "./accounts.ts";
 import type { OAuthCallbackField, OAuthFailureDetail } from "./oauth-diagnostics.ts";
 
 /**
@@ -393,11 +396,14 @@ const outcome = (error: OAuthProtocolFailed) =>
             : "incompatible";
 
 /**
- * Classify a failed renewal. Only RFC 6749 §5.2's `invalid_grant` says this account's grant has
- * ended: its refresh token was revoked, expired or already used. Every other refusal keeps the
- * grant, because it says nothing about it:
+ * Classify a failed renewal. Only RFC 6749 §5.2's `invalid_grant`, or a service's own code for
+ * it such as Supabase Auth's `refresh_token_already_used`, GitHub's `bad_refresh_token`,
+ * Slack's `invalid_refresh_token` or AWS Sign-In's `TOKEN_EXPIRED`, says this account's grant
+ * has ended, whatever the HTTP status:
+ * its refresh token was revoked, expired or already used. Every other refusal keeps the grant,
+ * because it says nothing about it:
  *
- * - `invalid_client`, `unauthorized_client` and a 401 are about the OAuth client, which every
+ * - `invalid_client`, `unauthorized_client` and any other 401 are about the OAuth client, which every
  *   account on that client shares. They are also what a fault in Executor's own client
  *   authentication produces; ending every grant for that would force every user to sign in again
  *   once it is fixed. The account reports `client_rejected` and renews again on its next use.
@@ -479,8 +485,43 @@ const clientCredentialsFailed = (error: OAuthProtocolFailed) => {
   });
 };
 
+/**
+ * The resource indicator a sign-in sent and where it came from, or why it sent none. Undefined for
+ * an attempt started before its source was kept, which leaves a refusal unnamed.
+ */
+const sentResource = (
+  value: typeof HttpUrl.Type | undefined,
+  source: OAuthResourceSource | undefined,
+): OAuthResourceIndicator | undefined => {
+  if (source === undefined) return undefined;
+  const indicator = { value: value ?? null, source };
+  return Schema.is(OAuthResourceIndicator)(indicator) ? indicator : undefined;
+};
+
+/**
+ * RFC 8707 §2: the service refused the resource indicator the sign-in sent, or its absence. Only
+ * a refusal is: a 429 or an outage answered with `invalid_target` keeps its own classification and
+ * Retry-After.
+ */
+const resourceRefused = (
+  stage: "authorize" | "exchange",
+  error: OAuthProtocolFailed,
+  sent: OAuthResourceIndicator | undefined,
+) =>
+  error.diagnostics?.providerCode === "invalid_target" && sent !== undefined
+    ? new OAuthCompletionFailed({
+        cause: causeOf(stage, error),
+        ...serviceErrorOf(error),
+        reason: "resource_rejected",
+        resource: sent,
+      })
+    : undefined;
+
 /** A failed token exchange. Callback validation runs first, so every failure here reached the token endpoint or failed before sending. */
-const exchangeFailed = (error: OAuthProtocolFailed) => {
+const exchangeFailed = (error: OAuthProtocolFailed, sent: OAuthResourceIndicator | undefined) => {
+  const refused =
+    outcome(error) === "rejected" ? resourceRefused("exchange", error, sent) : undefined;
+  if (refused !== undefined) return refused;
   const reason =
     error.reason === "invalid_client" || error.reason === "unsupported"
       ? error.reason
@@ -532,7 +573,10 @@ const secretMethod = (supported: readonly string[] | undefined) =>
  * A failed authorization response: its RFC 9207 issuer, then an RFC 6749 §4.1.2.1 error code.
  * Codes outside the recorded vocabulary are still authorization errors, never a cancellation.
  */
-const callbackFailed = (error: OAuthProtocolFailed) =>
+const callbackFailed = (error: OAuthProtocolFailed, sent: OAuthResourceIndicator | undefined) =>
+  (error.code === "OAUTH_AUTHORIZATION_RESPONSE_ERROR"
+    ? resourceRefused("authorize", error, sent)
+    : undefined) ??
   new OAuthCompletionFailed({
     cause: causeOf("authorize", error),
     ...serviceErrorOf(error),
@@ -755,17 +799,30 @@ export const makeOAuth = (
     Effect.gen(function* () {
       if (protocol === undefined || options === undefined)
         return yield* new OAuthSetupFailed({ reason: "unsupported" });
-      const row = yield* query(() =>
-        db.findFirst("providers", { where: (b) => b("id", "=", input.provider) }),
-      );
-      if (row === null) return yield* new ProviderNotFound({ provider: input.provider });
-      const provider = yield* decode(Provider, row);
+      return yield* setupOf(yield* storedProvider(input.provider), input);
+    });
+
+  const storedProvider = (id: ProviderId) =>
+    Effect.gen(function* () {
+      const row = yield* query(() => db.findFirst("providers", { where: (b) => b("id", "=", id) }));
+      if (row === null) return yield* new ProviderNotFound({ provider: id });
+      return yield* decode(Provider, row);
+    });
+
+  /** `resolveSetup` for a provider already read, or one an undeployed app declares. */
+  const setupOf = (
+    provider: Provider,
+    input: { readonly method: string; readonly redirectUri?: string | undefined },
+  ) =>
+    Effect.gen(function* () {
+      if (protocol === undefined || options === undefined)
+        return yield* new OAuthSetupFailed({ reason: "unsupported" });
       yield* Effect.annotateCurrentSpan("oauth.provider.id", provider.id);
       const method = Object.hasOwn(provider.definition.auth, input.method)
         ? provider.definition.auth[input.method]
         : undefined;
       if (method === undefined || method.type !== "oauth2")
-        return yield* new AuthMethodInvalid({ provider: input.provider, method: input.method });
+        return yield* new AuthMethodInvalid({ provider: provider.id, method: input.method });
       const redirect =
         method.grant === "client_credentials" || input.redirectUri === undefined
           ? undefined
@@ -1096,12 +1153,20 @@ export const makeOAuth = (
         existing === undefined && firstParty === undefined && registration === "manual"
           ? ("client-required" as const)
           : ("automatic" as const);
+      const resource =
+        firstParty !== undefined
+          ? sentResource(firstParty.client.server.resource, "operator")
+          : sentResource(discovered.resource, discovered.resourceSource);
+      // Discovery records a source with every resource it chooses, or with its absence.
+      if (resource === undefined)
+        return yield* Effect.die(new Error("OAuth discovery recorded no resource source"));
       if (method.grant === "client_credentials")
         return {
           mode,
           scopes: discovered.scopes,
           grant: method.grant,
           tokenEndpointAuthMethod: method.tokenEndpointAuthMethod,
+          resource,
         } satisfies OAuthClientSetup;
       const operator =
         firstParty === undefined ? {} : { firstParty: { label: firstParty.client.label } };
@@ -1126,6 +1191,7 @@ export const makeOAuth = (
           ? {}
           : { tokenEndpointAuthMethod: discovered.tokenEndpointAuthMethod }),
         ...(user.length === 0 ? {} : { userScopes: user }),
+        resource,
       } satisfies OAuthClientSetup;
     }).pipe(Effect.withSpan("oauth.setup"));
 
@@ -1264,15 +1330,21 @@ export const makeOAuth = (
       if (methods.length === 0)
         return yield* new OAuthClientsUnsupported({ provider: input.provider });
       if (protocol === undefined) return yield* new OAuthSetupFailed({ reason: "unsupported" });
-      return yield* Effect.forEach(methods, ({ name, method }) =>
-        protocol.discover(method).pipe(
-          Effect.mapError(discoveryFailed),
-          Effect.map((discovered) => ({
-            method: name,
-            issuer: HttpUrl.make(oauthClientIssuer(discovered.server)),
-          })),
-        ),
+      // Discovered at once; the first method that failed, in order, is the one reported.
+      const discovered = yield* Effect.forEach(
+        methods,
+        ({ name, method }) =>
+          protocol.discover(method).pipe(
+            Effect.mapError(discoveryFailed),
+            Effect.map((found) => ({
+              method: name,
+              issuer: HttpUrl.make(oauthClientIssuer(found.server)),
+            })),
+            Effect.result,
+          ),
+        { concurrency: "unbounded" },
       );
+      return yield* Effect.forEach(discovered, (result) => Effect.fromResult(result));
     }).pipe(Effect.withSpan("oauth.clients.issuers"));
 
   const clients = {
@@ -1617,7 +1689,7 @@ export const makeOAuth = (
             if (stored === undefined) {
               yield* query(() => tx.create("accounts", { ...saved, encryptedCredentials }));
               if (lifecycle) yield* lifecycle.accountCreated(saved);
-            } else
+            } else {
               // Connecting an existing account again starts a new credential generation.
               yield* query(() =>
                 tx.updateMany("accounts", {
@@ -1628,6 +1700,8 @@ export const makeOAuth = (
                   },
                 }),
               );
+              yield* resumeWaitingSources(tx, stored.id);
+            }
             const state = {
               encrypted: encryptedGrant,
               status: ready,
@@ -2010,11 +2084,15 @@ export const makeOAuth = (
       const holding = holder?.kind === "held" ? holder.row : undefined;
       if (holding !== undefined && !(yield* clientAuthorized(holding)))
         return yield* failed("client_unavailable");
+      const sent = sentResource(
+        operating.resource,
+        isFirstPartyAttempt(attempt) ? "operator" : attempt.resourceSource,
+      );
       const parameters = yield* protocol
         .callback(operating, callback)
-        .pipe(Effect.mapError(callbackFailed));
+        .pipe(Effect.mapError((error) => callbackFailed(error, sent)));
       const tokens = yield* protocol.exchange(operating, parameters).pipe(
-        Effect.mapError(exchangeFailed),
+        Effect.mapError((error) => exchangeFailed(error, sent)),
         Effect.catchIf(
           (error) => error.reason === "invalid_client" && storedRef?.source === "registered",
           (error) =>
@@ -2085,10 +2163,16 @@ export const makeOAuth = (
             }),
         ),
       );
+      // A grant that expires without a refresh token needs a reconnect then; record it at sign-in.
+      yield* Effect.annotateCurrentSpan(
+        "oauth.grant.refresh_token",
+        tokens.refresh_token !== undefined,
+      );
       const completedAt = yield* Clock.currentTimeMillis;
       const issued = {
         response: attempt.response,
         fields,
+        redirectUri: attempt.redirectUri,
         ...(tokens.refresh_token === undefined ? {} : { refreshToken: tokens.refresh_token }),
         ...expiry(completedAt, tokens.expires_in),
       };
@@ -2191,6 +2275,7 @@ export const makeOAuth = (
                 set: { encryptedCredentials, credentialGeneration: generation },
               }),
             );
+            yield* resumeWaitingSources(tx, target.id);
           } else {
             yield* query(() =>
               tx.create("accounts", { ...saved, encryptedCredentials, credentialGeneration: 0 }),
@@ -2699,35 +2784,60 @@ export const makeOAuth = (
     );
 
   /**
-   * Fail as `resolve` would when the stored grant can no longer release credentials, without
+   * Fail as `resolve` would when a stored grant can no longer release credentials, without
    * renewing it or releasing anything. A grant that renewal would replace still passes; its
    * outcome is known only once a live resolve renews it. A grant that needs reconnecting is
    * recorded as the span's outcome, as `resolve` records it, and fails only after the span.
+   *
+   * Each of `checks` is checked in order, and the first that fails decides the failure. Their
+   * grants are read in one query and one span covers the whole check, so checking a selection
+   * costs the same however many accounts it names.
    */
-  const usable = (account: StoredAccount, provider: ProviderDefinition) =>
+  const usableAll = (
+    checks: ReadonlyArray<{
+      readonly account: StoredAccount;
+      readonly provider: ProviderDefinition;
+    }>,
+  ) =>
     Effect.gen(function* () {
-      yield* Effect.annotateCurrentSpan("oauth.provider.id", account.provider);
-      if (provider.auth[account.method]?.type === "secrets") return;
-      const reconnect = (reason: ReconnectReason) =>
-        reconnectRequired("oauth.usable", account.id, reason);
-      const row = yield* query(() =>
-        db.findFirst("oauthGrants", { where: (b) => b("id", "=", account.id) }),
-      );
-      if (row === null) return yield* reconnect("grant_missing");
-      if (row.status === "reconnect") return yield* reconnect("grant_unusable");
-      // A renewal in progress, or one a stopped process abandoned, is settled by the next live
-      // resolve; its outcome is not known until then.
-      if (!row.status.startsWith("ready_")) return;
-      const now = yield* Clock.currentTimeMillis;
-      const grant = yield* decrypt(account.id, row.encrypted, OAuthGrant);
-      const renewable = grant.grant === "client_credentials" || grant.refreshToken !== undefined;
-      if (
-        grant.expiresAt === undefined ||
-        grant.expiresAt > now + 30_000 ||
-        (!renewable && grant.expiresAt > now)
-      )
-        return;
-      if (protocol === undefined || !renewable) return yield* reconnect("not_renewable");
+      yield* Effect.annotateCurrentSpan("oauth.usable.accounts", checks.length);
+      const granted = [
+        ...new Set(
+          checks
+            .filter(({ account, provider }) => provider.auth[account.method]?.type !== "secrets")
+            .map(({ account }) => account.id),
+        ),
+      ];
+      const rows =
+        granted.length === 0
+          ? []
+          : yield* query(() =>
+              db.findMany("oauthGrants", { where: (b) => b("id", "in", granted) }),
+            );
+      const grants = new Map(rows.map((row) => [row.id, row] as const));
+      for (const { account, provider } of checks) {
+        // The provider of the account checked last: on failure, the one that failed.
+        yield* Effect.annotateCurrentSpan("oauth.provider.id", account.provider);
+        if (provider.auth[account.method]?.type === "secrets") continue;
+        const reconnect = (reason: ReconnectReason) =>
+          reconnectRequired("oauth.usable", account.id, reason);
+        const row = grants.get(account.id);
+        if (row === undefined) return yield* reconnect("grant_missing");
+        if (row.status === "reconnect") return yield* reconnect("grant_unusable");
+        // A renewal in progress, or one a stopped process abandoned, is settled by the next live
+        // resolve; its outcome is not known until then.
+        if (!row.status.startsWith("ready_")) continue;
+        const now = yield* Clock.currentTimeMillis;
+        const grant = yield* decrypt(account.id, row.encrypted, OAuthGrant);
+        const renewable = grant.grant === "client_credentials" || grant.refreshToken !== undefined;
+        if (
+          grant.expiresAt === undefined ||
+          grant.expiresAt > now + 30_000 ||
+          (!renewable && grant.expiresAt > now)
+        )
+          continue;
+        if (protocol === undefined || !renewable) return yield* reconnect("not_renewable");
+      }
     }).pipe(
       Effect.withSpan("oauth.usable"),
       Effect.flatMap((checked) =>
@@ -2853,9 +2963,17 @@ export const makeOAuth = (
       selected,
     ),
   ) =>
-    Effect.flatMap(authority, (checked) => {
+    Effect.gen(function* () {
+      const supplied = yield* GrantReadAhead;
+      // Without grant rows the caller read in its own batch, the selection's grants are read
+      // here in one query, beside the authority check, and stand in for each grant's first read,
+      // as the caller's would. Nothing is decrypted or returned unless the check passed.
+      const [checked, readAhead] =
+        supplied === undefined
+          ? yield* inOrder(authority, selectionGrants(selected))
+          : [yield* authority, supplied];
       const recheck = selectionAuthorized(use, selected);
-      return Effect.forEach(selected, ({ account, provider }) =>
+      return yield* Effect.forEach(selected, ({ account, provider }) =>
         Effect.gen(function* () {
           const credential = yield* resolveAuthorized(
             account,
@@ -2869,7 +2987,29 @@ export const makeOAuth = (
           return (definition: ProviderDefinition) =>
             invocationAccount(account, definition, credential, firstPartyClients);
         }),
+      ).pipe(Effect.provideService(GrantReadAhead, readAhead));
+    });
+  /**
+   * The grant rows of the selected accounts that sign in with OAuth, read in one query, by
+   * account. An account without a row maps to null, as a missing grant reads.
+   */
+  const selectionGrants = (
+    selected: ReadonlyArray<{
+      readonly account: StoredAccount;
+      readonly provider: ProviderDefinition;
+    }>,
+  ) =>
+    Effect.gen(function* () {
+      const ids = selected
+        .filter(({ account, provider }) => provider.auth[account.method]?.type !== "secrets")
+        .map(({ account }) => account.id);
+      if (ids.length === 0) return undefined;
+      const rows = yield* query(() =>
+        db.findMany("oauthGrants", { where: (b) => b("id", "in", ids) }),
       );
+      const byId = new Map<AccountId, GrantRow | null>(ids.map((id) => [id, null]));
+      for (const row of rows) if (byId.has(row.id as AccountId)) byId.set(row.id as AccountId, row);
+      return byId;
     });
   /**
    * The service refused these credentials. Renew the grant once, or read a renewal another call
@@ -3045,20 +3185,15 @@ export const makeOAuth = (
     });
 
   /**
-   * Save an account whose grant another product issued (`OAuthGrantImport`). A grant to a client
-   * the product registered keeps that client and renews as that product did
-   * (`ImportOAuthGrant.renewal`), whatever the provider's method declares; an authorization-code
-   * client also becomes a stored client of the owner, as an entered client a sign-in keeps does,
-   * so a reconnect can name it. A grant to one of the operator's clients is saved as a sign-in
-   * with it saves one: it keeps only the client's ID, and no client is stored for the owner.
+   * Everything an imported grant is checked against before anything is saved, with the provider
+   * its account's app declares: the method and callback a sign-in would use, the provider's
+   * discovery, the operator's client for a grant it issued, the token response's fields, the token
+   * endpoint renewals use and the grant itself. `importGrant` saves what this returns, and
+   * `checkGrant` stops here, so a check refuses exactly what an import would.
    */
-  const importGrant = (input: ImportOAuthGrant) =>
+  const preparedGrant = (provider: Provider, input: ImportOAuthGrant) =>
     Effect.gen(function* () {
-      const { method, discovered, issuer } = yield* resolveSetup({
-        provider: input.provider,
-        method: input.method,
-        redirectUri: input.redirectUri,
-      });
+      const { method, discovered, issuer } = yield* setupOf(provider, input);
       const { renewal } = input;
       const firstParty =
         "firstParty" in input
@@ -3074,16 +3209,6 @@ export const makeOAuth = (
           ? {}
           : { refreshToken: Redacted.value(input.refreshToken) };
       const scopes = renewal.scopes.length === 0 ? {} : { scopes: renewal.scopes };
-      const createdAt = yield* Clock.currentTimeMillis;
-      const account = yield* decode(Account, {
-        id: AccountId.make(`acc_${yield* nextId}`),
-        provider: input.provider,
-        owner: input.owner,
-        label: input.label,
-        description: null,
-        method: input.method,
-        createdAt: new Date(createdAt),
-      });
       const registered =
         "client" in input
           ? yield* Effect.gen(function* () {
@@ -3099,77 +3224,120 @@ export const makeOAuth = (
               const server = { ...discovered.server, token_endpoint: tokenEndpoint.href };
               const resource =
                 input.renewal.resource === undefined ? {} : { resource: input.renewal.resource };
-              const stored =
-                discovered.grant === "client_credentials"
-                  ? undefined
-                  : yield* Effect.gen(function* () {
-                      const id = OAuthClientId.make(`oac_${yield* nextId}`);
-                      const details = registrationCredentials(client);
-                      return {
-                        row: {
-                          id,
-                          owner: input.owner,
-                          provider: null,
-                          issuer,
-                          clientId: client.client_id,
-                          source: "manual" as const,
-                          hasSecret: client.token_endpoint_auth_method !== "none",
-                          automaticKey: null,
-                          confirmed: true,
-                          createdAt: new Date(createdAt),
-                          encrypted: yield* encrypt(id, details),
-                        },
-                        digest: yield* digestOf({ owner: input.owner, issuer }, details),
-                      };
-                    });
-              const grantOf = (oauthClient: OAuthClientId | undefined) =>
-                discovered.grant === "client_credentials"
-                  ? {
-                      ...Struct.omit(discovered, ["resource"]),
-                      server,
-                      scopes: input.renewal.scopes,
-                      ...resource,
-                      client,
-                      fields,
-                      response: method.response,
-                      generation: 0,
-                      ...expires,
-                    }
-                  : {
-                      server,
-                      client,
-                      ...(oauthClient === undefined ? {} : { oauthClient }),
-                      response: method.response,
-                      ...scopes,
-                      ...resource,
-                      ...(discovered.tokenRequestFormat === undefined
-                        ? {}
-                        : { tokenRequestFormat: discovered.tokenRequestFormat }),
-                      ...(discovered.tokenResponse === undefined
-                        ? {}
-                        : { tokenResponse: discovered.tokenResponse }),
-                      fields,
-                      ...refresh,
-                      generation: 0,
-                      ...expires,
-                    };
-              return { stored, grantOf };
+              return { client, server, resource };
             })
           : undefined;
-      const encryptGrant = (grant: unknown) =>
-        decode(OAuthGrant, grant).pipe(
+      /** The grant, naming the owner's stored client a sign-in with it would keep. */
+      const grantOf = (oauthClient: OAuthClientId | undefined) =>
+        registered === undefined
+          ? {
+              grant: "authorization_code",
+              firstParty: firstParty?.id,
+              response: method.response,
+              fields,
+              ...refresh,
+              ...scopes,
+              generation: 0,
+              ...expires,
+            }
+          : discovered.grant === "client_credentials"
+            ? {
+                ...Struct.omit(discovered, ["resource"]),
+                server: registered.server,
+                scopes: renewal.scopes,
+                ...registered.resource,
+                client: registered.client,
+                fields,
+                response: method.response,
+                generation: 0,
+                ...expires,
+              }
+            : {
+                server: registered.server,
+                client: registered.client,
+                ...(oauthClient === undefined ? {} : { oauthClient }),
+                response: method.response,
+                ...scopes,
+                ...registered.resource,
+                ...(discovered.tokenRequestFormat === undefined
+                  ? {}
+                  : { tokenRequestFormat: discovered.tokenRequestFormat }),
+                ...(discovered.tokenResponse === undefined
+                  ? {}
+                  : { tokenResponse: discovered.tokenResponse }),
+                fields,
+                ...refresh,
+                generation: 0,
+                ...expires,
+              };
+      const grantOrRefused = (oauthClient: OAuthClientId | undefined) =>
+        decode(OAuthGrant, grantOf(oauthClient)).pipe(
           Effect.mapError(() => new OAuthSetupFailed({ reason: "invalid_client" })),
-          Effect.flatMap((decoded) => encrypt(account.id, decoded)),
         );
+      // A stored client's ID changes nothing the schema checks, so a grant that decodes without
+      // one decodes with it.
+      yield* grantOrRefused(undefined);
+      return { discovered, issuer, fields, registered, grantOrRefused };
+    });
+
+  /**
+   * Save an account whose grant another product issued (`OAuthGrantImport`). A grant to a client
+   * the product registered keeps that client and renews as that product did
+   * (`ImportOAuthGrant.renewal`), whatever the provider's method declares; an authorization-code
+   * client also becomes a stored client of the owner, as an entered client a sign-in keeps does,
+   * so a reconnect can name it. A grant to one of the operator's clients is saved as a sign-in
+   * with it saves one: it keeps only the client's ID, and no client is stored for the owner.
+   */
+  const importGrant = (input: ImportOAuthGrant) =>
+    Effect.gen(function* () {
+      if (protocol === undefined || options === undefined)
+        return yield* new OAuthSetupFailed({ reason: "unsupported" });
+      const { discovered, issuer, fields, registered, grantOrRefused } = yield* preparedGrant(
+        yield* storedProvider(input.provider),
+        input,
+      );
+      const createdAt = yield* Clock.currentTimeMillis;
+      const account = yield* decode(Account, {
+        id: AccountId.make(`acc_${yield* nextId}`),
+        provider: input.provider,
+        owner: input.owner,
+        label: input.label,
+        description: null,
+        method: input.method,
+        createdAt: new Date(createdAt),
+      });
+      const stored =
+        registered === undefined || discovered.grant === "client_credentials"
+          ? undefined
+          : yield* Effect.gen(function* () {
+              const id = OAuthClientId.make(`oac_${yield* nextId}`);
+              const details = registrationCredentials(registered.client);
+              return {
+                row: {
+                  id,
+                  owner: input.owner,
+                  provider: null,
+                  issuer,
+                  clientId: registered.client.client_id,
+                  source: "manual" as const,
+                  hasSecret: registered.client.token_endpoint_auth_method !== "none",
+                  automaticKey: null,
+                  confirmed: true,
+                  createdAt: new Date(createdAt),
+                  encrypted: yield* encrypt(id, details),
+                },
+                digest: yield* digestOf({ owner: input.owner, issuer }, details),
+              };
+            });
       const encryptedCredentials = yield* encrypt(account.id, fields);
       const ready = `ready_${yield* nextId}`;
       yield* transaction(db, (tx) =>
         Effect.gen(function* () {
           // Credentials another stored client holds are that client; nothing is stored twice.
           const saved =
-            registered?.stored === undefined
+            stored === undefined
               ? undefined
-              : yield* createStoredClient(tx, registered.stored.row, registered.stored.digest);
+              : yield* createStoredClient(tx, stored.row, stored.digest);
           const oauthClient =
             saved === undefined ? undefined : saved.stored ? saved.client.id : saved.holder;
           yield* query(() =>
@@ -3177,20 +3345,7 @@ export const makeOAuth = (
           );
           if (lifecycle) yield* lifecycle.accountCreated(account);
           const state = {
-            encrypted: yield* encryptGrant(
-              registered === undefined
-                ? {
-                    grant: "authorization_code",
-                    firstParty: firstParty?.id,
-                    response: method.response,
-                    fields,
-                    ...refresh,
-                    ...scopes,
-                    generation: 0,
-                    ...expires,
-                  }
-                : registered.grantOf(oauthClient),
-            ),
+            encrypted: yield* encrypt(account.id, yield* grantOrRefused(oauthClient)),
             status: ready,
             updatedAt: new Date(createdAt),
           };
@@ -3206,11 +3361,114 @@ export const makeOAuth = (
       return account;
     }).pipe(Effect.withSpan("oauth.importGrant"));
 
+  /**
+   * Check an imported grant as `importGrant` would, against the provider an app that is not
+   * deployed declares, and save nothing (`OAuthGrantImport.checkOAuthGrant`).
+   */
+  const checkGrant = (input: ImportOAuthGrant & { readonly definition: ProviderDefinition }) =>
+    preparedGrant({ id: input.provider, definition: input.definition }, input).pipe(
+      Effect.asVoid,
+      Effect.withSpan("oauth.checkGrant"),
+    );
+
+  /**
+   * Bring an imported account's grant up to date with the tokens the issuing product holds now
+   * (`OAuthGrantImport.refreshImportedGrant`). The grant keeps its client and renewal settings;
+   * only its tokens are replaced, and only when the product holds another refresh token than the
+   * grant and the grant needs reconnecting, or the product's access token expires later, so it
+   * renewed after this grant did. A grant that needs reconnecting with the product's own refresh
+   * token already used it, and the service refused it. A grant being renewed is decided once that
+   * renewal has saved its result. A grant reconnected since the import, one without a refresh token
+   * to compare, and one that changes while this runs are kept.
+   */
+  const refreshImportedGrant = (account: AccountId, tokens: ImportedGrantTokens) =>
+    Effect.gen(function* () {
+      const stored = yield* query(() =>
+        db.findFirst("accounts", { where: (b) => b("id", "=", account) }),
+      );
+      if (stored === null || stored.credentialGeneration > 0) return "kept";
+      let row = yield* query(() =>
+        db.findFirst("oauthGrants", { where: (b) => b("id", "=", account) }),
+      );
+      // A renewal holds the grant: wait for its result, which decides whether v2's tokens still
+      // work. A claim unconfirmed for the renewal lease was abandoned, and its row still holds the
+      // grant it started from.
+      while (
+        row !== null &&
+        row.status !== "reconnect" &&
+        !row.status.startsWith("ready_") &&
+        (heldClaims.has(row.status) ||
+          (yield* Clock.currentTimeMillis) - row.updatedAt.getTime() <= renewalLease)
+      ) {
+        yield* Effect.sleep("100 millis");
+        row = yield* query(() =>
+          db.findFirst("oauthGrants", { where: (b) => b("id", "=", account) }),
+        );
+      }
+      if (row === null) return "kept";
+      const read = row;
+      const reconnect = read.status === "reconnect";
+      const grant = yield* decrypt(account, read.encrypted, OAuthGrant);
+      if (grant.grant === "client_credentials" || (grant.generation ?? 0) > 0) return "kept";
+      const refreshToken =
+        tokens.refreshToken === undefined ? undefined : Redacted.value(tokens.refreshToken);
+      if (refreshToken === undefined || refreshToken === grant.refreshToken) return "kept";
+      const renewedLater =
+        tokens.expiresAt !== undefined &&
+        grant.expiresAt !== undefined &&
+        tokens.expiresAt > grant.expiresAt;
+      if (!reconnect && !renewedLater) return "kept";
+      const fields = yield* project(grant.response, {
+        ...grant.fields,
+        access_token: Redacted.value(tokens.accessToken),
+        token_type: "Bearer",
+      });
+      const replaced = yield* decode(OAuthGrant, {
+        ...Struct.omit(grant, ["expiresAt"]),
+        fields,
+        ...(refreshToken === undefined ? {} : { refreshToken }),
+        ...(tokens.expiresAt === undefined ? {} : { expiresAt: tokens.expiresAt }),
+      });
+      const encrypted = yield* encrypt(account, replaced);
+      const encryptedCredentials = yield* encrypt(account, fields);
+      const ready = `ready_${yield* nextId}`;
+      const updatedAt = new Date(yield* Clock.currentTimeMillis);
+      return yield* transaction(db, (tx) =>
+        Effect.gen(function* () {
+          // Written only over the grant read above, so a renewal or reconnect meanwhile stands.
+          yield* query(() =>
+            tx.updateMany("oauthGrants", {
+              where: (b) =>
+                b.and(
+                  b("id", "=", account),
+                  b("status", "=", read.status),
+                  b("encrypted", "=", read.encrypted),
+                ),
+              set: { status: ready, encrypted, updatedAt },
+            }),
+          );
+          const written = yield* query(() =>
+            tx.findFirst("oauthGrants", { where: (b) => b("id", "=", account) }),
+          );
+          if (written?.status !== ready) return "kept" as const;
+          yield* query(() =>
+            tx.updateMany("accounts", {
+              where: (b) => b("id", "=", account),
+              set: { encryptedCredentials },
+            }),
+          );
+          return "replaced" as const;
+        }),
+      );
+    }).pipe(Effect.withSpan("oauth.refreshImportedGrant"));
+
   return {
     revocation,
     clients,
     connections: { oauthSetup, startOAuth, completeOAuth },
     importGrant,
+    checkGrant,
+    refreshImportedGrant,
     /** The operator's client `id` as the importer checks a grant against it, without its secret. */
     firstPartyClient: (id: string) => {
       const client = [...firstPartyClients.values()].find((candidate) => candidate.id === id);
@@ -3220,7 +3478,7 @@ export const makeOAuth = (
     resolve: (account: StoredAccount, provider: ProviderDefinition) => resolve(account, provider),
     resolveSelected,
     renewRejected,
-    usable,
+    usableAll,
     revokeRemoved,
   };
 };
diff --git a/packages/sdk/src/implementation/provider.ts b/packages/sdk/src/implementation/provider.ts
index 5527dbf5da..70e6f1b41b 100644
--- a/packages/sdk/src/implementation/provider.ts
+++ b/packages/sdk/src/implementation/provider.ts
@@ -14,7 +14,8 @@ import { AuthMethodInvalid, ProviderDefinition } from "../contracts/provider.ts"
 import { ProviderId, StorageError, type Json } from "../contracts/shared.ts";
 import { JsonObject } from "../contracts/shared.ts";
 
-function canonical(value: Json): string {
+/** JSON with object keys sorted, so equal definitions compare equal regardless of key order. */
+export function canonical(value: Json): string {
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
   if (value !== null && typeof value === "object") {
     return `{${Object.entries(value)
diff --git a/packages/sdk/src/implementation/reactive-orm.ts b/packages/sdk/src/implementation/reactive-orm.ts
index 532c5c2500..391e2a2cd3 100644
--- a/packages/sdk/src/implementation/reactive-orm.ts
+++ b/packages/sdk/src/implementation/reactive-orm.ts
@@ -3,6 +3,7 @@ import { Context, Effect, Option } from "effect";
 import { SqlClient } from "effect/sql";
 import { SqlError, UnknownError } from "effect/sql/SqlError";
 import type { ReactiveStore } from "@executor-js/reactivity";
+import { withFailureAttributes } from "@executor-js/telemetry/failed-span";
 import type { Orm, OrmError } from "fumadb-effect";
 import type { AnySchema, AnyTable } from "fumadb-effect/schema";
 import type { UpsertOptions, TableToColumnValues } from "fumadb-effect/query";
@@ -56,6 +57,23 @@ function writes(
   return [...found];
 }
 
+/**
+ * A failed statement names its operation, its table and the database's kind of failure, for the
+ * span that records it once the failure is a `StorageError`. Never its SQL, values or message.
+ */
+const located = <A>(
+  operation: string,
+  table: PropertyKey,
+  effect: Effect.Effect<A, OrmError, SqlClient.SqlClient>,
+) =>
+  Effect.mapError(effect, (error) =>
+    withFailureAttributes(error, {
+      "executor.storage.operation": operation,
+      "executor.storage.table": String(table),
+      "executor.storage.reason": error._tag === "SqlError" ? error.reason._tag : error.reason,
+    }),
+  );
+
 /**
  * Capture the host driver without starting another Effect runtime. Transactions
  * keep their fiber-local SQL connection and publish only after commit. App record
@@ -137,21 +155,42 @@ export function bindOrm<S extends AnySchema>(
     options: UpsertOptions<S["tables"][T], boolean>,
   ): Effect.Effect<void | TableToColumnValues<S["tables"][T]>, OrmError> {
     return options.returning === true
-      ? write(table, "onUpdate", orm.upsert(table, { ...options, returning: true }))
-      : write(table, "onUpdate", orm.upsert(table, { ...options, returning: false }));
+      ? write(
+          table,
+          "onUpdate",
+          located("upsert", table, orm.upsert(table, { ...options, returning: true })),
+        )
+      : write(
+          table,
+          "onUpdate",
+          located("upsert", table, orm.upsert(table, { ...options, returning: false })),
+        );
   }
   return {
     schema: orm.schema,
     transaction: (effect) => provide(trackedTransaction(effect)),
-    count: (table, options) => read(table, false, orm.count(table, options)),
+    count: (table, options) =>
+      read(table, false, located("count", table, orm.count(table, options))),
     findFirst: (table, options) =>
-      read(table, options?.join !== undefined, orm.findFirst(table, options)),
+      read(
+        table,
+        options?.join !== undefined,
+        located("findFirst", table, orm.findFirst(table, options)),
+      ),
     findMany: (table, options) =>
-      read(table, options?.join !== undefined, orm.findMany(table, options)),
-    create: (table, values) => write(table, "insert", orm.create(table, values)),
-    createMany: (table, values) => write(table, "insert", orm.createMany(table, values)),
-    updateMany: (table, options) => write(table, "onUpdate", orm.updateMany(table, options)),
-    deleteMany: (table, options) => write(table, "onDelete", orm.deleteMany(table, options)),
+      read(
+        table,
+        options?.join !== undefined,
+        located("findMany", table, orm.findMany(table, options)),
+      ),
+    create: (table, values) =>
+      write(table, "insert", located("create", table, orm.create(table, values))),
+    createMany: (table, values) =>
+      write(table, "insert", located("createMany", table, orm.createMany(table, values))),
+    updateMany: (table, options) =>
+      write(table, "onUpdate", located("updateMany", table, orm.updateMany(table, options))),
+    deleteMany: (table, options) =>
+      write(table, "onDelete", located("deleteMany", table, orm.deleteMany(table, options))),
     upsert,
   };
 }
diff --git a/packages/sdk/src/implementation/remote-app-runner.ts b/packages/sdk/src/implementation/remote-app-runner.ts
index 8541b6ec0e..8fe8696715 100644
--- a/packages/sdk/src/implementation/remote-app-runner.ts
+++ b/packages/sdk/src/implementation/remote-app-runner.ts
@@ -71,7 +71,15 @@ export type RemoteAppRunner<Result> = {
 
 const RemoteResult = Schema.fromJsonString(
   Schema.Union([
-    Schema.Struct({ ok: Schema.Literal(true), value: Schema.Json }),
+    Schema.Struct({
+      ok: Schema.Literal(true),
+      value: Schema.Json,
+      /**
+       * The host API revision the runner bound the call's cache and network to. A runner from
+       * before that check sends none, and its caller refuses the result; see `remoteAppRunner`.
+       */
+      hostApi: Schema.optionalKey(Schema.NonEmptyString),
+    }),
     Schema.Struct({
       ok: Schema.Literal(false),
       reason: Schema.optionalKey(RuntimeFailure),
@@ -253,9 +261,16 @@ const refused = (error: unknown) =>
       : { ok: false as const, reason: classify(error) };
 const encodeResult = Schema.encodeUnknownEffect(RemoteResult);
 
-const answer = (effect: Effect.Effect<unknown, unknown>) =>
+/**
+ * The runner's reply as JSON: its value, or the failure it can name. A rejected RPC loses an error's
+ * fields, and Cap'n Web replaces its text, so a failure crosses inside the reply instead. `hostApi`
+ * is the revision the runner bound the call to; see `RemoteResult`.
+ */
+export const runnerReply = (
+  effect: Effect.Effect<{ readonly value: unknown; readonly hostApi?: string }, unknown>,
+) =>
   effect.pipe(
-    Effect.map((value) => ({ ok: true as const, value })),
+    Effect.map((result) => ({ ok: true as const, ...result })),
     Effect.catchCause((cause) => Effect.succeed(refused(Cause.squash(cause)))),
     Effect.flatMap((result) =>
       encodeResult(result).pipe(
@@ -275,7 +290,7 @@ export const serveAppRunner = (
   read: (build: BuildId) => Effect.Effect<LoadedWorkerBuild, RuntimeBuildUnavailable>,
 ): RemoteAppRunner<Effect.Effect<string>> => ({
   invoke: (invocation, capabilities) =>
-    answer(
+    runnerReply(
       Effect.scoped(
         Effect.gen(function* () {
           // The runner's part starts here, so decoding the call and reading its build count too.
@@ -289,9 +304,12 @@ export const serveAppRunner = (
           // The caller's trace context travels in the invocation's headers; the runner's spans join it.
           return yield* Effect.gen(function* () {
             const loader = yield* invocationBuildLoader(decoded, read(build));
-            return yield* loader.refused(
+            const value = yield* loader.refused(
               runner.invoke(decoded, yield* localCapabilities(capabilities, loader.load)),
             );
+            return decoded.hostApi === undefined
+              ? { value }
+              : { value, hostApi: decoded.hostApi.revision };
           }).pipe(
             Effect.provideService(RunnerIngress, ingress),
             withRemoteSpan(
@@ -303,14 +321,21 @@ export const serveAppRunner = (
       ).pipe(Effect.ensuring(Effect.sync(() => releaseCapabilities(capabilities)))),
     ),
   declare: (bundle, headers) =>
-    answer(
+    runnerReply(
       Schema.decodeUnknownEffect(encodedBuild)(bundle).pipe(
         Effect.flatMap((bundle) => runner.declare(bundle, headers)),
+        Effect.map((value) => ({ value })),
       ),
     ),
 });
 
-const result = <E>(effect: Effect.Effect<string, E>) =>
+/**
+ * Decode a runner's reply: its value, or the runtime failure it names. A call bound to a host API
+ * revision (`hostApi`) succeeds only when the runner says it bound the call's cache and network to
+ * that revision: a runner deployed before that check ignores it, and would fill the revision's
+ * cache with whichever document it read.
+ */
+export const runnerResult = <E>(effect: Effect.Effect<string, E>, hostApi?: string) =>
   effect.pipe(
     // A rejected RPC carries the platform's text, such as a size or memory limit, only here.
     Effect.catch(failedFrom(false)),
@@ -322,7 +347,9 @@ const result = <E>(effect: Effect.Effect<string, E>) =>
     Effect.flatMap(
       (reply): Effect.Effect<unknown, RuntimeProtocolFailed | RuntimeProtocolUnsupported> =>
         reply.ok
-          ? Effect.succeed(reply.value)
+          ? hostApi === undefined || reply.hostApi === hostApi
+            ? Effect.succeed(reply.value)
+            : Effect.fail(new RuntimeProtocolFailed({ reason: "unsupported" }))
           : reply.unsupported !== undefined
             ? Effect.fail(reply.unsupported)
             : Effect.fail(
@@ -349,15 +376,19 @@ export const remoteAppRunner = <E>(remote: RemoteAppRunner<Effect.Effect<string,
           workflowControls: capabilities.controls !== null,
         }).pipe(Effect.mapError(() => new RuntimeProtocolFailed()));
         const callbacks = yield* remoteCapabilities(capabilities, lifetime.signal);
-        return yield* result(remote.invoke(encoded, callbacks));
+        return yield* runnerResult(remote.invoke(encoded, callbacks), invocation.hostApi?.revision);
       }),
-    ).pipe(Effect.withSpan("runtime.app.remote.invoke")),
+    ).pipe(
+      Effect.withSpan("runtime.app.remote.invoke", {
+        attributes: { "executor.app.id": invocation.app },
+      }),
+    ),
   declare: (bundle: LoadedWorkerBuild, headers: Readonly<Record<string, string>>) =>
     Effect.try({
       try: () => encodeLoadedBuild(bundle),
       catch: () => new RuntimeProtocolFailed(),
     }).pipe(
-      Effect.flatMap((encoded) => result(remote.declare(encoded, headers))),
+      Effect.flatMap((encoded) => runnerResult(remote.declare(encoded, headers))),
       Effect.withSpan("runtime.app.remote.declare"),
     ),
 });
diff --git a/packages/sdk/src/implementation/remote-registry.ts b/packages/sdk/src/implementation/remote-registry.ts
index bc0c2088e5..90ea59b792 100644
--- a/packages/sdk/src/implementation/remote-registry.ts
+++ b/packages/sdk/src/implementation/remote-registry.ts
@@ -1,5 +1,6 @@
 /** Browser-safe public registry reads shared with server-side discovery. */
-import { Clock, Duration, Effect, Option, Schema, Stream } from "effect";
+import { Clock, Duration, Effect, Option, Result, Schema, Stream } from "effect";
+import { issueSummary } from "@executor-js/telemetry/schema-issue";
 import {
   FetchHttpClient,
   HttpClient,
@@ -13,6 +14,7 @@ import {
   RegistryError,
   type Registry,
 } from "../contracts/registry.ts";
+import { wireRevision, wireRevisionHeader } from "../contracts/wire-revision.ts";
 
 const maxResponseBytes = 32 * 1024 * 1024;
 
@@ -50,6 +52,42 @@ const readBody = (response: HttpClientResponse.HttpClientResponse) =>
     }),
   );
 
+/** A registry request that states the wire revision this release reads. */
+const registryRequest = (url: URL) =>
+  HttpClientRequest.get(url).pipe(
+    HttpClientRequest.setHeader(wireRevisionHeader, String(wireRevision)),
+  );
+
+/** A listing's name for a log line, bounded: the registry chose it, and it may not be a package name. */
+const listingLabel = (entry: unknown) =>
+  typeof entry === "object" && entry !== null && "name" in entry && typeof entry.name === "string"
+    ? JSON.stringify(entry.name.slice(0, 140))
+    : "without a name";
+
+/**
+ * Keep the listings this release can read. Each one it cannot is left out and logged with what
+ * failed to decode, so one entry never fails the whole catalog.
+ */
+const readableListings = (entries: ReadonlyArray<unknown>) =>
+  Effect.gen(function* () {
+    const listings: Array<Publication> = [];
+    for (const entry of entries) {
+      const decoded = Schema.decodeUnknownResult(Publication)(entry);
+      if (Result.isSuccess(decoded)) {
+        listings.push(decoded.success);
+        continue;
+      }
+      const issues = [...new Set(issueSummary(decoded.failure.issue))].slice(0, 10).join(", ");
+      yield* Effect.logWarning(
+        `Left out public registry listing ${listingLabel(entry)}, which this Executor release cannot read (${issues}). A newer release reads listings in formats added since this one, not malformed ones.`,
+      );
+    }
+    const unreadable = entries.length - listings.length;
+    if (unreadable > 0)
+      yield* Effect.annotateCurrentSpan("registry.listings_unreadable", unreadable);
+    return listings;
+  });
+
 const parseJson = (bytes: Uint8Array): Option.Option<unknown> => {
   try {
     return Option.some(JSON.parse(new TextDecoder().decode(bytes)));
@@ -66,7 +104,7 @@ export const remoteRegistry = (origin: string): Registry => {
   const read = <A>(operation: string, path: string, schema: Schema.Decoder<A>) => {
     const url = new URL(path, origin);
     return Effect.gen(function* () {
-      const response = yield* HttpClient.execute(HttpClientRequest.get(url)).pipe(
+      const response = yield* HttpClient.execute(registryRequest(url)).pipe(
         Effect.mapError(() => new RegistryError({ reason: "network" })),
       );
       yield* Effect.annotateCurrentSpan("http.response.status_code", response.status);
@@ -112,7 +150,7 @@ export const remoteRegistry = (origin: string): Registry => {
       origin,
     );
     return Effect.gen(function* () {
-      const response = yield* HttpClient.execute(HttpClientRequest.get(url)).pipe(
+      const response = yield* HttpClient.execute(registryRequest(url)).pipe(
         Effect.mapError(() => new RegistryError({ reason: "network" })),
       );
       yield* Effect.annotateCurrentSpan("http.response.status_code", response.status);
@@ -137,8 +175,8 @@ export const remoteRegistry = (origin: string): Registry => {
     read(
       "list",
       `/api/registry/apps${name === undefined ? "" : `?name=${encodeURIComponent(name)}`}`,
-      Schema.Array(Publication),
-    );
+      Schema.Array(Schema.Unknown),
+    ).pipe(Effect.flatMap(readableListings));
   // Only a settled listing is shared. Concurrent reads of an expired listing each fetch it, so no
   // request ever waits on another's fetch; a Worker isolate cannot resume one request from another.
   let kept: { readonly listings: ReadonlyArray<Publication>; readonly until: number } | undefined;
diff --git a/packages/sdk/src/implementation/request-rejection.ts b/packages/sdk/src/implementation/request-rejection.ts
new file mode 100644
index 0000000000..2ee44502a1
--- /dev/null
+++ b/packages/sdk/src/implementation/request-rejection.ts
@@ -0,0 +1,58 @@
+/**
+ * Effect's HTTP API rejects a request that does not match its endpoint's schema before any
+ * handler runs, and on its own answers an empty 400 that no operation declares. Product APIs
+ * apply `RequestRejection` to every endpoint instead, so the answer is the declared
+ * `RequestInvalid`, naming where the request did not match.
+ */
+import { recordRequestRejection } from "@executor-js/telemetry/http";
+import { Effect, SchemaIssue } from "effect";
+import { type HttpApiError, HttpApiMiddleware } from "effect/http-api";
+import {
+  RequestInvalid,
+  type RequestIssue,
+  type RequestPart,
+  RequestRejection,
+} from "../contracts/shared.ts";
+
+/** Request parts the caller supplies. Response encoding failures stay server faults. */
+const parts: Partial<Record<HttpApiError.HttpApiSchemaError["kind"], RequestPart>> = {
+  Params: "path",
+  Headers: "headers",
+  Query: "query",
+  Payload: "body",
+};
+
+const maxIssues = 10;
+const maxExpected = 300;
+// HTTP API decoding does not retain input (`reportInput`), so these messages state what the
+// schema expects without the submitted value. A filter's own message can name the caller's path.
+const format = SchemaIssue.makeFormatterStandardSchemaV1();
+const segment = (key: PropertyKey) =>
+  typeof key === "number" ? `[${key}]` : `.${String(key).slice(0, 64)}`;
+
+const issues = (error: HttpApiError.HttpApiSchemaError): ReadonlyArray<RequestIssue> => {
+  const found = new Map<string, RequestIssue>();
+  for (const issue of format(error.cause.issue).issues) {
+    const path = `$${(issue.path ?? []).map((key) => segment(typeof key === "object" ? key.key : key)).join("")}`;
+    const expected = issue.message.slice(0, maxExpected);
+    // Union members can repeat the same finding.
+    found.set(`${path}\n${expected}`, { path, expected });
+  }
+  return [...found.values()].slice(0, maxIssues);
+};
+
+/** Answer a request its endpoint's schema rejected with `RequestInvalid`, recorded on its span. */
+export const rejectRequest = (error: HttpApiError.HttpApiSchemaError) => {
+  const part = parts[error.kind];
+  return part === undefined
+    ? Effect.fail(error)
+    : recordRequestRejection(error).pipe(
+        Effect.andThen(Effect.fail(new RequestInvalid({ part, issues: issues(error) }))),
+      );
+};
+
+/** The `RequestRejection` middleware product APIs serve. */
+export const requestRejections = HttpApiMiddleware.layerSchemaErrorTransform(
+  RequestRejection,
+  rejectRequest,
+);
diff --git a/packages/sdk/src/implementation/runtime.ts b/packages/sdk/src/implementation/runtime.ts
index b4a8654899..ab0f250a06 100644
--- a/packages/sdk/src/implementation/runtime.ts
+++ b/packages/sdk/src/implementation/runtime.ts
@@ -110,9 +110,10 @@ export const createAppRuntime = (options: {
 }): ResolvedAppRuntime => {
   const runtime = toEffectRuntime(options.runtime, options.blobs);
   const asset = runtime.asset;
+  // Standalone callers serve no host API, so each build's app cache is its own.
   const context = (accounts: ResolvedAccountsInput) =>
     Schema.decodeUnknownEffect(Schema.RedactedFromValue(ResolvedAccounts))(accounts).pipe(
-      Effect.map((accounts) => ({ accounts })),
+      Effect.map((accounts) => ({ accounts, hostApi: undefined })),
       Effect.mapError(() => new HostAccountsInvalid()),
     );
   return {
diff --git a/packages/sdk/src/implementation/schedule-worker.ts b/packages/sdk/src/implementation/schedule-worker.ts
index 9af911ed34..4773133357 100644
--- a/packages/sdk/src/implementation/schedule-worker.ts
+++ b/packages/sdk/src/implementation/schedule-worker.ts
@@ -1,6 +1,7 @@
 /** A Node host owns polling and every in-flight task in its existing Effect scope. */
 import { WebhookSourceHost } from "../contracts/webhooks.ts";
 import { Effect, Queue, Schedule, Schema, Semaphore } from "effect";
+import { traceFailure } from "@executor-js/telemetry/failed-span";
 import type { Executor } from "../contracts/executor.ts";
 import type { ScheduleAuthority } from "../contracts/scheduler.ts";
 import { ScheduleHostReady, ScheduleWorkerOptions } from "../contracts/schedule-worker.ts";
@@ -23,11 +24,20 @@ export const startScheduleWorker = (
         runner: config.runner,
         maxCandidates: config.concurrency,
         authorize,
-        execute: (operation) => pool.withPermitsIfAvailable(1)(operation).pipe(Effect.asVoid),
+        // Each operation a pass finds is one trace, rooted in a dispatch as a Cloud
+        // coordinator's pass is.
+        execute: (operation) =>
+          pool
+            .withPermitsIfAvailable(1)(
+              operation.pipe(Effect.withSpan("schedule.dispatch"), Effect.withTracerEnabled(true)),
+            )
+            .pipe(Effect.asVoid),
       })
       .pipe(
-        // Each pass is one trace, as a Cloud coordinator's dispatch is.
-        Effect.withSpan("schedule.dispatch"),
+        // A pass runs every second; one that finds nothing to run records nothing. One that
+        // fails is still a trace of its own.
+        Effect.withTracerEnabled(false),
+        traceFailure("schedule.dispatch"),
         Effect.catch(() => Effect.logError("Scheduled dispatch failed")),
         Effect.forkIn(scope),
         Effect.asVoid,
diff --git a/packages/sdk/src/implementation/schedules.ts b/packages/sdk/src/implementation/schedules.ts
index 56dc763683..4b0596c28d 100644
--- a/packages/sdk/src/implementation/schedules.ts
+++ b/packages/sdk/src/implementation/schedules.ts
@@ -10,6 +10,7 @@ import {
 } from "../contracts/executor.ts";
 import { AccountRequired, type AccountScope } from "../contracts/apps.ts";
 import {
+  CredentialsError,
   StorageError,
   RequestInvalid,
   type AccountId,
@@ -30,7 +31,7 @@ import {
   ScheduleInvalid,
   ScheduleScopeRequired,
 } from "../contracts/schedules.ts";
-import { InvocationRun } from "../contracts/runtime.ts";
+import { CallFailureSources, InvocationRun, type CallFailureSource } from "../contracts/runtime.ts";
 import { ScheduleObservation } from "../contracts/scheduler.ts";
 import type { ScheduleDispatcher } from "../contracts/scheduler.ts";
 import type { Credentials } from "../contracts/storage.ts";
@@ -49,6 +50,25 @@ const diagnostic = (error: unknown) =>
   error instanceof Error && Schema.isSchema(error.constructor)
     ? (SchemaAST.resolveIdentifier(error.constructor.ast) ?? "ExecutionFailed")
     : "ExecutionFailed";
+/**
+ * What a failed run names as its cause when no runtime failure of its call did: Executor's own
+ * storage, or anything else, such as an account or authorization the run cannot use.
+ */
+const failureSource = (error: unknown): CallFailureSource =>
+  Schema.is(StorageError)(error) || Schema.is(CredentialsError)(error) ? "storage" : "other";
+/**
+ * Collect the source of a run's call failures (`CallFailureSources`) for `source`, which falls back
+ * to `failureSource` when its call did not fail in the runtime.
+ */
+const observedSources = () => {
+  let observed: CallFailureSource | undefined;
+  return {
+    observe: (source: CallFailureSource) => {
+      observed = source;
+    },
+    source: (error: unknown) => observed ?? failureSource(error),
+  };
+};
 const sameTiming = Schema.toEquivalence(ScheduleTiming);
 const nextOccurrence = (timing: ScheduleTiming, after: Date) =>
   Effect.try({
@@ -217,10 +237,12 @@ export const makeSchedules = (
       if (row === null) return yield* new ScheduleNotFound();
       return yield* parse(ScheduleSettings, row);
     });
+  /** `source` is what a run that did not succeed failed with (`executor.failure.source`). */
   const finish = (
     run: StoredScheduledRun,
     status: ScheduledRun["status"],
     failure: string | null = null,
+    source: CallFailureSource | null = null,
   ) =>
     transaction(db, () =>
       Effect.gen(function* () {
@@ -304,6 +326,7 @@ export const makeSchedules = (
                     ? "cancelled"
                     : "failed",
               ...(failure === null ? {} : { "error.type": failure }),
+              ...(source === null ? {} : { "executor.failure.source": source }),
             }).pipe(
               Effect.andThen(
                 Effect.flatMap(ScheduleObservation, (observer) => observer.completed(completed)),
@@ -487,14 +510,17 @@ export const makeSchedules = (
         yield* apps.get(input);
         const settings = yield* savedFor(input.app);
         // Enabled schedules report what they wait on, so the owner sees why none run.
-        return yield* Effect.forEach(settings, (setting) =>
-          setting.enabled
-            ? waitingOn(setting).pipe(
-                Effect.map((waiting) =>
-                  waiting === undefined ? setting : { ...setting, ...waiting },
-                ),
-              )
-            : Effect.succeed(setting),
+        return yield* Effect.forEach(
+          settings,
+          (setting) =>
+            setting.enabled
+              ? waitingOn(setting).pipe(
+                  Effect.map((waiting) =>
+                    waiting === undefined ? setting : { ...setting, ...waiting },
+                  ),
+                )
+              : Effect.succeed(setting),
+          { concurrency: 4 },
         );
       }),
     configure: (input: typeof ScheduleInputs.configure.Type) =>
@@ -658,23 +684,27 @@ export const makeSchedules = (
   const complete = (
     run: StoredScheduledRun,
     result: Awaited<Effect.Success<ReturnType<typeof tools.resume>>>,
+    source: (error: unknown) => CallFailureSource,
   ) => {
     switch (result.status) {
       case "completed":
+        // Only an MCP tool's error result, which its server returned, marks a completed call.
         return result.toolError === true
-          ? finish(run, "failed", "McpToolError")
+          ? finish(run, "failed", "McpToolError", "upstream")
           : finish(run, "succeeded");
       case "denied":
-        return finish(run, "denied");
+        return finish(run, "denied", null, "approval");
       case "cancelled":
         return finish(run, "cancelled");
       case "already-consumed":
-        return finish(run, "interrupted", "AlreadyConsumed");
+        return finish(run, "interrupted", "AlreadyConsumed", "approval");
       case "failed":
         // A resumed call that failed records its own error, as a live call's failure does.
         return result.reason === "execution-failed"
-          ? finish(run, "failed", diagnostic(result.error))
-          : finish(run, result.reason === "expired" ? "expired" : "failed", result.reason);
+          ? finish(run, "failed", diagnostic(result.error), source(result.error))
+          : result.reason === "expired"
+            ? finish(run, "expired", result.reason, "approval")
+            : finish(run, "failed", result.reason, "other");
     }
   };
   // Retire only the scanned occurrence. A concurrent configuration or claim owns
@@ -700,7 +730,7 @@ export const makeSchedules = (
           }),
         );
         const runs = yield* parse(Schema.Array(StoredScheduledRun), rows);
-        for (const run of runs) yield* finish(run, "interrupted", "RunnerStopped");
+        for (const run of runs) yield* finish(run, "interrupted", "RunnerStopped", "runtime");
       }),
     nextWake: Effect.gen(function* () {
       const settings = yield* query(() =>
@@ -745,7 +775,7 @@ export const makeSchedules = (
             execute(
               Effect.gen(function* () {
                 if (pending.expiresAt !== null && pending.expiresAt <= time) {
-                  yield* finish(pending, "expired", "ApprovalExpired");
+                  yield* finish(pending, "expired", "ApprovalExpired", "approval");
                   return;
                 }
                 if (pending.requestId === null || pending.answer === null) return;
@@ -767,6 +797,7 @@ export const makeSchedules = (
                   }),
                 );
                 if (claim === null) return;
+                const sources = observedSources();
                 yield* Effect.gen(function* () {
                   const settings = yield* readSettings(claim.scheduleId);
                   yield* authorize({ ...settings, phase: "resume" });
@@ -783,11 +814,14 @@ export const makeSchedules = (
                         systemCaller("schedule", settings.actor ?? undefined),
                       ),
                     );
-                  yield* complete(claim, response);
+                  yield* complete(claim, response, sources.source);
                 }).pipe(
                   Effect.withErrorReporting,
-                  Effect.catch((error) => finish(claim, "failed", diagnostic(error))),
-                  Effect.onInterrupt(() => finish(claim, "interrupted", "Interrupted")),
+                  Effect.catch((error) =>
+                    finish(claim, "failed", diagnostic(error), sources.source(error)),
+                  ),
+                  Effect.onInterrupt(() => finish(claim, "interrupted", "Interrupted", "runtime")),
+                  Effect.provideService(CallFailureSources, sources.observe),
                   Effect.provideService(InvocationRun, claim.id),
                   Effect.withSpan("schedule.run", {
                     attributes: {
@@ -814,6 +848,15 @@ export const makeSchedules = (
             orderBy: ["nextAt", "asc"],
           }),
         ).pipe(Effect.flatMap((rows) => parse(Schema.Array(ScheduleSettings), rows)));
+        // The due work this pass found, at most `maxCandidates`, and how long the oldest of it has
+        // waited, before any of it is claimed: a pass that admits none of it records nothing else.
+        const oldest = due.at(0)?.nextAt;
+        yield* Effect.annotateCurrentSpan({
+          "executor.schedule.due": due.length,
+          ...(oldest instanceof Date
+            ? { "executor.schedule.oldest_due_ms": Math.max(0, time.getTime() - oldest.getTime()) }
+            : {}),
+        });
         yield* Effect.forEach(
           due,
           (setting) =>
@@ -907,6 +950,7 @@ export const makeSchedules = (
                   }),
                 ).pipe(Effect.catchTags({ AppNotFound: () => retireMissingTarget(setting) }));
                 if (claim === null) return;
+                const sources = observedSources();
                 yield* Effect.gen(function* () {
                   const nextKnownAt = yield* nextOccurrence(setting.timing, yield* now);
                   yield* query(() =>
@@ -945,7 +989,7 @@ export const makeSchedules = (
                   });
                   if (response.status === "completed") {
                     yield* response.toolError === true
-                      ? finish(claim, "failed", "McpToolError")
+                      ? finish(claim, "failed", "McpToolError", "upstream")
                       : finish(claim, "succeeded");
                     return;
                   }
@@ -958,6 +1002,7 @@ export const makeSchedules = (
                         owner: setting.owner,
                         response: { action: "accept" },
                       }),
+                      sources.source,
                     );
                   } else {
                     // Serialized with reconcile by the app lock: a schedule removed while this
@@ -995,6 +1040,7 @@ export const makeSchedules = (
                           owner: setting.owner,
                           response: { action: "decline" },
                         }),
+                        sources.source,
                       );
                   }
                 }).pipe(
@@ -1005,7 +1051,9 @@ export const makeSchedules = (
                     Effect.annotateCurrentSpan(
                       "executor.schedule.skip_reason",
                       "account_reconnect",
-                    ).pipe(Effect.andThen(finish(claim, "failed", "OAuthReconnectRequired"))),
+                    ).pipe(
+                      Effect.andThen(finish(claim, "failed", "OAuthReconnectRequired", "other")),
+                    ),
                   ),
                   Effect.withErrorReporting,
                   Effect.catch((error) =>
@@ -1027,10 +1075,10 @@ export const makeSchedules = (
                           set: { enabled: false, nextAt: null },
                         }),
                       );
-                      yield* finish(claim, "failed", diagnostic(error));
+                      yield* finish(claim, "failed", diagnostic(error), sources.source(error));
                     }),
                   ),
-                  Effect.onInterrupt(() => finish(claim, "interrupted", "Interrupted")),
+                  Effect.onInterrupt(() => finish(claim, "interrupted", "Interrupted", "runtime")),
                   // Every account the run resolves is checked against the saved actor; an app
                   // schedule has none and runs with the app's accounts.
                   Effect.provideService(CurrentActor, setting.actor ?? undefined),
@@ -1038,6 +1086,7 @@ export const makeSchedules = (
                     CurrentCaller,
                     systemCaller("schedule", setting.actor ?? undefined),
                   ),
+                  Effect.provideService(CallFailureSources, sources.observe),
                   Effect.provideService(InvocationRun, claim.id),
                   Effect.withSpan("schedule.run", {
                     attributes: {
diff --git a/packages/sdk/src/implementation/skills.ts b/packages/sdk/src/implementation/skills.ts
index 924bfc0094..9f73127855 100644
--- a/packages/sdk/src/implementation/skills.ts
+++ b/packages/sdk/src/implementation/skills.ts
@@ -100,6 +100,7 @@ export const makeSkills = (
                       app: app.id,
                       build: state.version.build,
                       sharedRuntime: sharesRuntime(state.version.requirements),
+                      hostApi: declarations.hostApi(state.version),
                       sources,
                       ...context,
                     })
diff --git a/packages/sdk/src/implementation/storage-migration-error.ts b/packages/sdk/src/implementation/storage-migration-error.ts
new file mode 100644
index 0000000000..d536be8e8b
--- /dev/null
+++ b/packages/sdk/src/implementation/storage-migration-error.ts
@@ -0,0 +1,78 @@
+/** Startup diagnostics keep codes and schema versions without retaining driver messages or SQL. */
+import { Schema } from "effect";
+
+/** Error classes a cause chain may name; any other is reported as `UnknownError`. */
+const CauseTag = Schema.Literals([
+  "StorageError",
+  "MigrationError",
+  "SqlError",
+  "ConnectionError",
+  "AuthenticationError",
+  "AuthorizationError",
+  "SqlSyntaxError",
+  "UniqueViolation",
+  "ConstraintError",
+  "DeadlockError",
+  "SerializationError",
+  "LockTimeoutError",
+  "StatementTimeoutError",
+  "UnknownError",
+  "Error",
+  "TypeError",
+  "RangeError",
+  "DatabaseError",
+]);
+/** How far along the cause chain a failure is read. */
+const maxDepth = 8;
+const sqlStatePattern = /^(?:[0-5][0-9A-Z]|F0|HV|P0|XX)[0-9A-Z]{3}$/u;
+
+/** Every field is bounded by its schema, so no instance can carry text from its cause. */
+export class StorageMigrationFailed extends Schema.TaggedError<StorageMigrationFailed>()(
+  "StorageMigrationFailed",
+  {
+    causeTags: Schema.Array(CauseTag).check(Schema.isMaxLength(maxDepth)),
+    sqlState: Schema.optionalKey(Schema.String.check(Schema.isPattern(sqlStatePattern))),
+    migrationVersion: Schema.optionalKey(
+      Schema.String.check(Schema.isPattern(/^\d{1,3}\.\d{1,3}\.\d{1,3}$/u)),
+    ),
+  },
+) {}
+
+const isCauseTag = Schema.is(CauseTag);
+
+const fromCause = (cause: unknown, migrationVersion: string | undefined) => {
+  if (cause instanceof StorageMigrationFailed) return cause;
+  const causeTags: Array<typeof CauseTag.Type> = [];
+  let sqlState: string | undefined;
+  let current = cause;
+  for (
+    let depth = 0;
+    depth < maxDepth && typeof current === "object" && current !== null;
+    depth++
+  ) {
+    const tag = Reflect.get(current, "_tag") ?? Reflect.get(current, "name");
+    causeTags.push(isCauseTag(tag) ? tag : "UnknownError");
+    const code = Reflect.get(current, "code");
+    if (sqlState === undefined && typeof code === "string" && sqlStatePattern.test(code))
+      sqlState = code;
+    current = Reflect.get(current, "cause");
+  }
+  return new StorageMigrationFailed({
+    causeTags,
+    ...(sqlState === undefined ? {} : { sqlState }),
+    ...(migrationVersion === undefined ? {} : { migrationVersion }),
+  });
+};
+
+/** `migrationVersion` comes from the registered schemas, never the stored journal or driver. */
+export const storageMigrationFailed = (cause: unknown, migrationVersion?: string) => {
+  try {
+    return fromCause(cause, migrationVersion);
+  } catch {
+    // A cause whose getters throw is reported without anything read from it or thrown by it.
+    return new StorageMigrationFailed({
+      causeTags: ["UnknownError"],
+      ...(migrationVersion === undefined ? {} : { migrationVersion }),
+    });
+  }
+};
diff --git a/packages/sdk/src/implementation/storage-migrations.ts b/packages/sdk/src/implementation/storage-migrations.ts
index c486a1a89b..7e18df19e8 100644
--- a/packages/sdk/src/implementation/storage-migrations.ts
+++ b/packages/sdk/src/implementation/storage-migrations.ts
@@ -26,6 +26,7 @@ import {
   version4Tables,
   storedOAuthClientIndexes,
   storedOAuthClientIssuerIndexes,
+  queueReadIndexes,
 } from "./storage-schema.ts";
 
 /** Indexes the 4.0.1 step added. Released steps never change; later indexes join their own step. */
@@ -75,6 +76,7 @@ export const currentIndexes = [
   ...storedOAuthClientIndexes,
   ...boundedReadIndexes,
   ...storedOAuthClientIssuerIndexes,
+  ...queueReadIndexes,
 ] as const;
 
 /** Versions built by {@link indexOnlyVersion}. */
@@ -471,6 +473,20 @@ const version4 = <Version extends string>(version: Version, up?: CustomMigration
     },
   });
 
+/** The 4.0.15 layout: webhook sources count their failed attempts. */
+const version4015Schema = schema({
+  version: "4.0.15",
+  tables: version4015Tables,
+  relations: {
+    accounts: ({ one }) => ({
+      providerDefinition: one("providers", ["provider", "id"]).foreignKey(),
+    }),
+    apps: ({ one }) => ({
+      deployment: one("deployments", ["activeDeployment", "id"], ["code", "code"]).foreignKey(),
+    }),
+  },
+});
+
 /** Version 4 is the oldest supported layout. Append future compatible upgrades here. */
 export const storageSchemas = [
   version4("4.0.0"),
@@ -633,18 +649,9 @@ export const storageSchemas = [
   }),
   // Additive for the running server: a source it writes keeps the default count, which only
   // shortens that source's next retry delay.
-  schema({
-    version: "4.0.15",
-    tables: version4015Tables,
-    relations: {
-      accounts: ({ one }) => ({
-        providerDefinition: one("providers", ["provider", "id"]).foreignKey(),
-      }),
-      apps: ({ one }) => ({
-        deployment: one("deployments", ["activeDeployment", "id"], ["code", "code"]).foreignKey(),
-      }),
-    },
-  }),
+  version4015Schema,
+  // Additive: three indexes; the running server's queries are unchanged.
+  indexOnlyVersion(version4015Schema, "4.0.16", queueReadIndexes),
 ] as const;
 
 /** Checked when this module loads, so a misbuilt index-only version fails every host's start. */
diff --git a/packages/sdk/src/implementation/storage-schema.ts b/packages/sdk/src/implementation/storage-schema.ts
index 53c74359f7..e3e2d69e20 100644
--- a/packages/sdk/src/implementation/storage-schema.ts
+++ b/packages/sdk/src/implementation/storage-schema.ts
@@ -837,7 +837,7 @@ const retriedWebhookSources = table("executor_webhook_sources", {
   retries: column("retries", Schema.Int).default(0),
 }).unique("executor_webhook_sources_app_account", ["app", "account"]);
 
-/** Tables of the 4.0.15 layout, the current one. */
+/** Tables of the 4.0.15 layout, the current one; 4.0.16 only adds indexes. */
 export const version4015Tables = {
   ...version4014Tables,
   webhookSources: retriedWebhookSources,
@@ -853,3 +853,18 @@ export const scopedRunKeyIndex =
 /** One app schedule per declaration; members' copies stay unique by `executor_schedules_copy`. */
 export const appScheduleIndex =
   "CREATE UNIQUE INDEX IF NOT EXISTS executor_schedules_app ON executor_schedules (app, name) WHERE actor IS NULL";
+
+/**
+ * Indexes added in 4.0.16 for reads that scanned the whole table before. Each webhook source tick
+ * reads the sources waiting to run, saved intent first and then retries, and skips every `ready`
+ * source, nearly all of them; each index holds only the sources one of those reads takes. Account
+ * checks are read by account. The 4.0.3 layout declared them unique by account and app, but the
+ * 4.0.6 layout declares the table again without it, and databases have no such index; a check's
+ * ID, its account and app, still keeps one per pair. In the order the account and app removal
+ * paths write: webhook sources, then account checks.
+ */
+export const queueReadIndexes = [
+  "CREATE INDEX IF NOT EXISTS executor_webhook_sources_intent ON executor_webhook_sources (lease_until) WHERE status = 'pending' AND lease IS NULL",
+  "CREATE INDEX IF NOT EXISTS executor_webhook_sources_retry ON executor_webhook_sources (lease_until) WHERE status <> 'ready'",
+  "CREATE INDEX IF NOT EXISTS executor_account_checks_account_app ON executor_account_checks (account, app)",
+] as const;
diff --git a/packages/sdk/src/implementation/storage.ts b/packages/sdk/src/implementation/storage.ts
index c2c6391876..2dfa59728d 100644
--- a/packages/sdk/src/implementation/storage.ts
+++ b/packages/sdk/src/implementation/storage.ts
@@ -12,15 +12,19 @@ import {
   storageSchemas,
   trailingStorageIndexVersions,
 } from "./storage-migrations.ts";
+import { storageMigrationFailed } from "./storage-migration-error.ts";
 import { makeToolSearchStore } from "./tool-search-store.ts";
 
+/** The version a new database is created at, reported when creating it fails. */
+const latestVersion = storageSchemas.at(-1)?.version;
+
 /** Capture caller-owned SQL. Migrations accept only fresh or supported version 4 databases. */
 export const makeExecutorStorage = (options: { readonly provider: SqlProvider }) =>
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
     const reactivity = yield* makeReactiveStore({ namespace: "executor" });
     const client = executorDatabase.client(sqlAdapter({ provider: options.provider }));
-    const db = bindOrm(client.orm("4.0.15"), sql, reactivity);
+    const db = bindOrm(client.orm("4.0.16"), sql, reactivity);
     const checkMigration = Effect.gen(function* () {
       const migrator = yield* client.createMigrator;
       const version = yield* migrator.version;
@@ -29,7 +33,7 @@ export const makeExecutorStorage = (options: { readonly provider: SqlProvider })
         return yield* new StorageError();
     }).pipe(
       Effect.provideService(SqlClient.SqlClient, sql),
-      Effect.mapError(() => new StorageError()),
+      Effect.mapError((cause) => storageMigrationFailed(cause)),
     );
     const upgrade = (stopAt: ReadonlySet<string>) =>
       Effect.gen(function* () {
@@ -40,10 +44,12 @@ export const makeExecutorStorage = (options: { readonly provider: SqlProvider })
           // A new database needs the current layout and all of its indexes, not
           // historical data conversions. FumaDB's direct diff omits custom steps.
           // Its tables are empty, so no index build waits on or blocks a writer.
-          yield* (yield* migrator.migrateToLatest()).execute;
-          yield* Effect.forEach(currentIndexes, (statement) => sql.unsafe(statement).unprepared, {
-            discard: true,
-          });
+          yield* Effect.gen(function* () {
+            yield* (yield* migrator.migrateToLatest()).execute;
+            yield* Effect.forEach(currentIndexes, (statement) => sql.unsafe(statement).unprepared, {
+              discard: true,
+            });
+          }).pipe(Effect.mapError((cause) => storageMigrationFailed(cause, latestVersion)));
           return;
         }
         // Execute every registered upgrade in order. A direct diff to latest can skip
@@ -52,12 +58,14 @@ export const makeExecutorStorage = (options: { readonly provider: SqlProvider })
         const current = storageSchemas.findIndex((entry) => entry.version === version.value);
         for (const entry of storageSchemas.slice(current + 1)) {
           if (stopAt.has(entry.version)) return;
-          yield* (yield* migrator.up()).execute;
+          yield* Effect.gen(function* () {
+            yield* (yield* migrator.up()).execute;
+          }).pipe(Effect.mapError((cause) => storageMigrationFailed(cause, entry.version)));
         }
       }).pipe(
         sql.withTransaction,
         Effect.provideService(SqlClient.SqlClient, sql),
-        Effect.mapError(() => new StorageError()),
+        Effect.mapError((cause) => storageMigrationFailed(cause)),
       );
     /** Every upgrade except the trailing index-only versions, which `migrate` then runs. */
     const migrateTables = upgrade(trailingStorageIndexVersions);
@@ -71,7 +79,7 @@ export const makeExecutorStorage = (options: { readonly provider: SqlProvider })
       Effect.mapError(() => new StorageError()),
     );
     return {
-      orm: (_version: "4.0.15") => db,
+      orm: (_version: "4.0.16") => db,
       reactivity,
       // Search rows are derived data no reactive reader watches, ranked by SQL the ORM cannot express.
       toolSearch: makeToolSearchStore(sql),
diff --git a/packages/sdk/src/implementation/tools.ts b/packages/sdk/src/implementation/tools.ts
index 8964996e18..5ebb958ba4 100644
--- a/packages/sdk/src/implementation/tools.ts
+++ b/packages/sdk/src/implementation/tools.ts
@@ -48,7 +48,13 @@ import {
   type Executor,
   type ResourceLifecycle,
 } from "../contracts/executor.ts";
-import { AppCodeEntered, type Runtime } from "../contracts/runtime.ts";
+import {
+  AppCodeEntered,
+  CallFailureSources,
+  runtimeFailures,
+  type CallFailureSource,
+  type Runtime,
+} from "../contracts/runtime.ts";
 import {
   Cursor,
   ToolName,
@@ -66,6 +72,7 @@ import { OAuthReconnectRequired } from "../contracts/oauth.ts";
 import { GrantReadAhead, type GrantRow, type makeOAuth } from "./oauth.ts";
 import {
   AppEvaluationFailed,
+  type AppFailure,
   appFailure,
   appFailureText,
   type CallFailure,
@@ -144,6 +151,34 @@ interface SnapshotReads {
   readonly accounts: SelectionAccountsRead;
 }
 
+/**
+ * {@link SnapshotReads} for a snapshot nobody read ahead for: the app and the accounts its input
+ * names, at once. None when it names no accounts, which leaves a single read.
+ */
+const snapshotReads = (
+  db: Query,
+  input: {
+    readonly app: AppId;
+    readonly accounts?: AppAccounts | undefined;
+    readonly captured?: { readonly accounts: SelectedAccounts } | undefined;
+  },
+) => {
+  const ids =
+    input.captured !== undefined
+      ? selectionAccountIds(input.captured.accounts)
+      : input.accounts === undefined
+        ? []
+        : namedAccounts(input.accounts);
+  return ids.length === 0
+    ? Effect.succeed(undefined)
+    : Effect.all(
+        [Effect.result(readApp(db, input.app)), Effect.result(readSelectionAccounts(db, ids))],
+        {
+          concurrency: "unbounded",
+        },
+      ).pipe(Effect.map(([app, rows]): SnapshotReads => ({ app, accounts: { ids, rows } })));
+};
+
 /**
  * Resolve the app, pinned version and the named accounts before invoking authored code. The
  * snapshot keeps the current actor, so work it starts, such as a workflow, is checked against the
@@ -170,9 +205,10 @@ export function snapshot(
      */
     captured?: { readonly accounts: SelectedAccounts; readonly scope: AccountScope } | undefined;
   },
-  ahead?: SnapshotReads,
+  readAhead?: SnapshotReads,
 ) {
   return Effect.gen(function* () {
+    const ahead = readAhead ?? (yield* snapshotReads(db, input));
     const row =
       ahead !== undefined && answered(ahead.app)
         ? yield* Effect.fromResult(ahead.app)
@@ -718,10 +754,8 @@ const runtimeFailure = (
       HostToolApprovalRequired: () => new ToolApprovalRequired(identity),
       HostToolPolicyFailed: () => new ToolPolicyFailed(identity),
       HostOutputInvalid: () => new ToolCallFailed({ ...identity, reason: "Tool execution failed" }),
-      HostRequestInvalid: () =>
-        new AppEvaluationFailed({ ...identity, reason: "App evaluation failed" }),
-      HostAccountsInvalid: () =>
-        new AppEvaluationFailed({ ...identity, reason: "App evaluation failed" }),
+      HostRequestInvalid: (error) => evaluationFailure(identity, error),
+      HostAccountsInvalid: (error) => evaluationFailure(identity, error),
       // Also how the app's framework reports an unexpected failure anywhere in its handling of
       // the call, including after the handler returned, so it is not reported as a failure to
       // load the app's tools.
@@ -734,20 +768,81 @@ const runtimeFailure = (
       HostEvaluationFailed: (error) => evaluationFailure(identity, error),
       SkillLoadFailed: (error) => evaluationFailure(identity, error),
       McpError: (error) => operationMcpFailure(identity, error),
-      RuntimeBuildUnavailable: () =>
-        new AppEvaluationFailed({ ...identity, reason: "App evaluation failed" }),
+      RuntimeBuildUnavailable: (error) => evaluationFailure(identity, error),
       // The runtime's reply to the call was lost or unusable, which can happen after the tool ran,
-      // so it is not reported as a failure to load the app's tools.
-      RuntimeProtocolFailed: () =>
-        new ToolCallFailed({
-          ...identity,
-          reason: "Executor did not receive a usable result from this tool call.",
-        }),
-      RuntimeProtocolUnsupported: (error) =>
-        new AppEvaluationFailed({ ...identity, reason: error.message }),
+      // so it is not reported as a failure to load the app's tools. The kind is matched from the
+      // runtime's error, which the app's isolate can produce, so it is not claimed: a size failure
+      // stays a likely cause.
+      RuntimeProtocolFailed: ({ reason }) =>
+        reason === "too-large"
+          ? new ToolCallFailed({
+              ...identity,
+              reason: "Executor did not receive this tool call's result.",
+              rpcLimitMatched: true,
+            })
+          : new ToolCallFailed({
+              ...identity,
+              reason: `Executor did not receive a usable result from this tool call. ${
+                reason === undefined
+                  ? "The runtime did not report why."
+                  : reason === "unrecognized"
+                    ? "The runtime did not recognize why."
+                    : `The runtime’s error matches this cause, which Executor has not confirmed: ${runtimeFailures[reason]}.`
+              }`,
+            }),
+      RuntimeProtocolUnsupported: (error) => evaluationFailure(identity, error, error.message),
     }),
   );
 
+/** The source a failure from the app's framework names: its code, a service or its storage. */
+const detailSource = ({ source }: { readonly source?: AppFailure["source"] }): CallFailureSource =>
+  source === "service" ? "upstream" : source === "storage" ? "storage" : "app";
+
+/**
+ * What a runtime's failure of a call names as its cause (`CallFailureSource`), read before
+ * `runtimeFailure` turns it into the caller's error, which can no longer tell them apart: a lost
+ * reply and the app's own exception are both `ToolCallFailed`.
+ */
+const failureSource = Match.type<CallError>().pipe(
+  Match.withReturnType<CallFailureSource>(),
+  Match.tagsExhaustive({
+    ProviderError: () => "upstream",
+    OpenapiResponseError: () => "upstream",
+    McpError: () => "upstream",
+    SkillLoadFailed: () => "upstream",
+    HostOperationFailed: detailSource,
+    HostEvaluationFailed: detailSource,
+    HostDeclarationInvalid: detailSource,
+    HostToolNotFound: () => "app",
+    HostOperationNotFound: () => "app",
+    HostKindMismatch: () => "app",
+    HostInputInvalid: () => "app",
+    HostOutputInvalid: () => "app",
+    WorkflowFailure: ({ reason }) =>
+      reason === "engine" || reason === "unavailable"
+        ? "runtime"
+        : reason === "approval"
+          ? "approval"
+          : reason === "credentials"
+            ? "other"
+            : "app",
+    DatabaseLimitExceeded: () => "storage",
+    HostToolBlocked: () => "approval",
+    HostToolApprovalRequired: () => "approval",
+    HostToolPolicyFailed: () => "approval",
+    RuntimeProtocolFailed: () => "runtime",
+    RuntimeBuildUnavailable: () => "runtime",
+    RuntimeProtocolUnsupported: () => "runtime",
+    HostRequestInvalid: () => "runtime",
+    HostAccountsInvalid: () => "other",
+    ElicitationFailed: () => "other",
+  }),
+);
+
+/** Tell the caller's observer, if any, what a call failed with (`CallFailureSources`). */
+const observeFailure = (source: CallFailureSource) =>
+  Effect.map(CallFailureSources, (observe) => observe?.(source));
+
 /**
  * The error a failed call reports to its caller, such as an agent. A call that may write, a
  * mutation or a call that names no kind, may already have made its change once the host handed any of
@@ -757,13 +852,14 @@ const runtimeFailure = (
  * work after the hand-off, such as saving an approval request. Its error records that, so it leads
  * with Executor's instruction not to repeat the call and is never offered as a retry. That includes
  * a refusal, such as invalid input or a denied approval, which the app's reply reports. A failure
- * before the host handed over any work, and every failure of a query, keep their own
- * classification.
+ * before the host handed over any work, and every failure of a call the app confirms only reads
+ * (`confirmedRead`), keep their own classification. A query only its upstream calls one, such as
+ * an MCP tool with `readOnlyHint`, may write like any other call.
  */
 const callFailure =
-  (kind: ToolKind | undefined, enteredApp: boolean) =>
+  (read: boolean, enteredApp: boolean) =>
   (failure: CallFailure): CallFailure =>
-    kind === "query" || !enteredApp
+    read || !enteredApp
       ? failure
       : Match.value(failure).pipe(
           Match.tagsExhaustive({
@@ -811,7 +907,7 @@ const summarizeTool = ({
 /** Live calls return completion or a durable approval request. Resume trusts the supplied SDK decision. */
 export const makeTools = (
   storage: ExecutorDatabase,
-  oauth: Pick<ReturnType<typeof makeOAuth>, "resolveSelected" | "renewRejected" | "usable">,
+  oauth: Pick<ReturnType<typeof makeOAuth>, "resolveSelected" | "renewRejected" | "usableAll">,
   clients: ReadonlyMap<string, FirstPartyOAuthClient>,
   runtime: Runtime,
   credentials: Credentials,
@@ -844,24 +940,33 @@ export const makeTools = (
     Schema.is(ProviderError)(error)
       ? appProviderFailure(state, error, renewal)
       : evaluationFailure({ app: state.app.id, version: state.version.id }, error);
+  /** Fail with a catalog evaluation's typed error, telling the caller's observer its source. */
+  const failCatalog = (
+    state: InvocationSnapshot,
+    error: Effect.Error<ReturnType<typeof runtime.index>>,
+    renewal?: Renewal,
+  ) =>
+    observeFailure(failureSource(error)).pipe(
+      Effect.andThen(Effect.fail(catalogFailure(state, error, renewal))),
+    );
   /**
    * Run a tool, live or approved, and renew an account the service refuses. A 401 means the
    * service did not perform the refused request, but an earlier request in the same call may
-   * already have made changes. A query only reads, so it is repeated once with the renewed
-   * credentials, and a failed renewal is its failure. A call that may write is never repeated: the
-   * renewal, renewed or failed, comes after the call was dispatched, so it is reported with the
-   * call's failure rather than in its place.
+   * already have made changes. A call the app confirms only reads (`read`, see `confirmedRead`) is
+   * repeated once with the renewed credentials, and a failed renewal is its failure. A call that may
+   * write is never repeated: the renewal, renewed or failed, comes after the call was dispatched, so
+   * it is reported with the call's failure rather than in its place.
    */
-  const executeRenewing = <A, E, R>(
+  const executeRenewing = <A, E, R, R2>(
     state: InvocationSnapshot,
     context: InvocationContext,
-    kind: ToolKind | undefined,
+    read: Effect.Effect<boolean, never, R2>,
     execute: (context: InvocationContext) => Effect.Effect<Result.Result<A, E>, never, R>,
   ) =>
     Effect.gen(function* () {
       const result = yield* execute(context);
       if (Result.isSuccess(result)) return { result };
-      if (kind === "query") {
+      if (yield* read) {
         const renewed = yield* renewRefused(oauth, clients, state, context, result.failure);
         if (renewed === undefined) return { result };
         yield* Effect.annotateCurrentSpan("executor.tool.retry", "credentials_renewed");
@@ -879,6 +984,7 @@ export const makeTools = (
     app: state.app.id,
     build: state.version.build,
     sharedRuntime: sharesRuntime(state.version.requirements),
+    hostApi: listings.hostApi(state.version),
     ...context,
     ...(workflows === undefined ? {} : { workflowControls: workflows(state) }),
     ...(state.version.requirements.capabilities?.sharedDefinitions === true
@@ -902,8 +1008,8 @@ export const makeTools = (
         renewRefused(oauth, clients, state, context, error).pipe(
           Effect.flatMap((renewed) =>
             renewed === undefined
-              ? Effect.fail(catalogFailure(state, error))
-              : inspect(renewed).pipe(Effect.mapError((error) => catalogFailure(state, error))),
+              ? failCatalog(state, error)
+              : inspect(renewed).pipe(Effect.catch((error) => failCatalog(state, error))),
           ),
         ),
       ),
@@ -968,7 +1074,7 @@ export const makeTools = (
     inspectTool(state, name, context).pipe(
       Effect.catch((error) =>
         renewOnce(state, context, error).pipe(
-          Effect.flatMap((renewal) => Effect.fail(catalogFailure(state, error, renewal))),
+          Effect.flatMap((renewal) => failCatalog(state, error, renewal)),
         ),
       ),
       Effect.flatMap(found(state, name)),
@@ -989,19 +1095,25 @@ export const makeTools = (
     kind: ToolKind | undefined,
   ) =>
     kind === undefined
-      ? listings.read(state, callListingOf(state), { refreshStale: false, resolved: context }).pipe(
-          Effect.map((listing) => listing.items.find((tool) => tool.name === name)),
-          // A listing that did not finish says nothing about the tool.
-          Effect.catchTag("ToolListingTimedOut", () => Effect.succeed(undefined)),
-          Effect.flatMap((listed) =>
-            listed === undefined ? catalogKind(state, context, name) : Effect.succeed(listed),
-          ),
-          Effect.map((tool): ToolKind | undefined =>
-            tool.readOnly === true ? "query" : "mutation",
-          ),
-          Effect.catchTag("ToolNotFound", () => Effect.succeed(undefined)),
-          Effect.withSpan("sdk.tools.kind"),
-        )
+      ? listings
+          .read(state, callListingOf(state), {
+            refreshStale: false,
+            followChanges: false,
+            resolved: context,
+          })
+          .pipe(
+            Effect.map((listing) => listing.items.find((tool) => tool.name === name)),
+            // A listing that did not finish says nothing about the tool.
+            Effect.catchTag("ToolListingTimedOut", () => Effect.succeed(undefined)),
+            Effect.flatMap((listed) =>
+              listed === undefined ? catalogKind(state, context, name) : Effect.succeed(listed),
+            ),
+            Effect.map((tool): ToolKind | undefined =>
+              tool.readOnly === true ? "query" : "mutation",
+            ),
+            Effect.catchTag("ToolNotFound", () => Effect.succeed(undefined)),
+            Effect.withSpan("sdk.tools.kind"),
+          )
       : Effect.succeed(kind);
   /**
    * With the accounts the host's check resolved ({@link InvocationSelection}), make the call's
@@ -1253,6 +1365,42 @@ export const makeTools = (
     inspectRenewing(state, context, (context) => runtime.inspect(inspection(state, context))).pipe(
       Effect.map(toListing(state)),
     );
+  /**
+   * Whether the app confirms that a tool only reads: its kept listing names the tool a query of a
+   * kind the app's code or the tool's protocol fixes (`kindConfirmed`), not one only an upstream
+   * claims, such as an MCP server's `readOnlyHint`. Only a call named a query and confirmed here
+   * keeps a read's advice to repeat it after it fails, and only such a call is repeated with renewed
+   * credentials. The caller's kind is its own claim and confirms nothing. It comes only from a
+   * listing already kept (`listings.kept`): evaluating the catalog after a call failed would run
+   * the app's code again, and its writes, only to word the failure. The listing kept in this
+   * process is taken before the call hands over its work, since a cache change the call makes
+   * forgets it; it is checked, and one kept beyond this process is read, only once the call failed
+   * after the hand-off. A tool the kept listing does not confirm, or no kept listing, is not
+   * confirmed.
+   */
+  const readOf = (state: InvocationSnapshot, name: ToolName, kind: ToolKind | undefined) =>
+    kind === "query"
+      ? listings.kept(state).pipe(
+          Effect.orElseSucceed(() => Effect.succeed<ToolListing | undefined>(undefined)),
+          Effect.flatMap((kept) =>
+            Effect.cached(
+              kept.pipe(
+                Effect.map(
+                  (listing) =>
+                    listing?.items.some(
+                      (tool) =>
+                        tool.name === name && tool.readOnly === true && tool.kindConfirmed === true,
+                    ) === true,
+                ),
+                Effect.tap((confirmed) =>
+                  Effect.annotateCurrentSpan("executor.tool.read_confirmed", confirmed),
+                ),
+                Effect.withSpan("sdk.tools.read_confirmed"),
+              ),
+            ),
+          ),
+        )
+      : Effect.succeed(Effect.succeed(false));
   /**
    * The listing a call that names no kind evaluates when none is kept. Evaluating the catalog runs
    * the app's code, which may write before it fails, and the call may write, so it is evaluated
@@ -1263,7 +1411,7 @@ export const makeTools = (
     runtime.inspect(inspection(state, context)).pipe(
       Effect.catch((error) =>
         renewOnce(state, context, error).pipe(
-          Effect.flatMap((renewal) => Effect.fail(catalogFailure(state, error, renewal))),
+          Effect.flatMap((renewal) => failCatalog(state, error, renewal)),
         ),
       ),
       Effect.map(toListing(state)),
@@ -1282,16 +1430,19 @@ export const makeTools = (
     accountNeedingReconnect: (input: { app: AppId; accounts: AppAccounts }) =>
       Effect.gen(function* () {
         const state = yield* snapshot(db, input);
-        for (const { required, accounts } of state.selections)
-          for (const account of accounts) {
-            const usable = yield* oauth.usable(account, required.definition).pipe(Effect.result);
-            if (Result.isFailure(usable)) {
-              if (!Schema.is(OAuthReconnectRequired)(usable.failure))
-                return yield* Effect.fail(usable.failure);
-              yield* accountsOutcome("reconnect");
-              return account.id;
-            }
-          }
+        const usable = yield* oauth
+          .usableAll(
+            state.selections.flatMap(({ required, accounts }) =>
+              accounts.map((account) => ({ account, provider: required.definition })),
+            ),
+          )
+          .pipe(Effect.result);
+        if (Result.isFailure(usable)) {
+          if (!Schema.is(OAuthReconnectRequired)(usable.failure))
+            return yield* Effect.fail(usable.failure);
+          yield* accountsOutcome("reconnect");
+          return usable.failure.account;
+        }
         yield* accountsOutcome("ready");
         return undefined;
       }).pipe(
@@ -1350,6 +1501,7 @@ export const makeTools = (
             state.scope,
           ),
           routers: found.routers.filter((router) => router.error !== undefined),
+          ...(found.stale === undefined ? {} : { stale: found.stale }),
         };
       }).pipe(Effect.withSpan("sdk.tools.searchable")),
     /**
@@ -1530,10 +1682,12 @@ export const makeTools = (
             enteredApp = true;
           },
         };
-        // The caller's kind decides how a failure is reported and whether a refused call is
-        // repeated. For a call that names none, the catalog only names the kind it is dispatched
-        // with: reading the catalog ran the app's code, so the call's outcome stays unknown.
+        // The caller's kind, confirmed by the app for a query (`confirmedRead`), decides how a
+        // failure is reported and whether a refused call is repeated. For a call that names none,
+        // the catalog only names the kind it is dispatched with: reading the catalog ran the app's
+        // code, so the call's outcome stays unknown.
         const named = parsed.kind;
+        const read = yield* readOf(state, parsed.tool, named);
         // Every failure from here, the app's or Executor's own, passes through `callFailure` once.
         return yield* Effect.gen(function* () {
           const kind = yield* kindOf(state, context, parsed.tool, named);
@@ -1545,6 +1699,7 @@ export const makeTools = (
                 app: state.app.id,
                 ...(workflows === undefined ? {} : { workflowControls: workflows(state) }),
                 build: state.version.build,
+                hostApi: listings.hostApi(state.version),
                 database: ownsDatabase(state.version.requirements),
                 sharedRuntime: sharesRuntime(state.version.requirements),
                 ...context,
@@ -1562,7 +1717,7 @@ export const makeTools = (
               }),
               Effect.result,
             );
-          const { result, renewal } = yield* executeRenewing(state, context, named, execute);
+          const { result, renewal } = yield* executeRenewing(state, context, read, execute);
           // The tool is named once the app has answered for it: a name it lacks is the caller's text.
           if (
             Result.isSuccess(result) ||
@@ -1596,34 +1751,41 @@ export const makeTools = (
               },
             );
           }
+          yield* observeFailure(failureSource(result.failure));
           return yield* Effect.fail(runtimeFailure(identity, state, renewal)(result.failure));
         }).pipe(
-          Effect.mapError((failure) =>
-            // Only a query's renewal fails a call itself (`executeRenewing`), and a query keeps
-            // its classification. A missing account is the host's finding while it resolves
-            // accounts, before any of the app's code runs for it.
+          Effect.catch((failure) =>
+            // Only a confirmed read's renewal fails a call itself (`executeRenewing`), and a
+            // confirmed read keeps its classification. A missing account is the host's finding
+            // while it resolves accounts, before any of the app's code runs for it.
             failure._tag === "OAuthReconnectRequired" ||
             failure._tag === "OAuthRenewalFailed" ||
-            failure._tag === "AccountRequired"
-              ? failure
-              : callFailure(named, enteredApp)(failure),
+            failure._tag === "AccountRequired" ||
+            !enteredApp
+              ? Effect.fail(failure)
+              : Effect.flatMap(read, (read) => Effect.fail(callFailure(read, enteredApp)(failure))),
           ),
           // A defect after the hand-off, such as in Executor's own code, does not establish what
           // the app's code did either. A call that may write reports it as a failure that records
           // the write, and the defect is still reported as one. Interruption is unchanged.
           Effect.catchCause((cause) =>
-            named === "query" || !enteredApp || !Cause.hasDies(cause) || Cause.hasInterrupts(cause)
+            !enteredApp || !Cause.hasDies(cause) || Cause.hasInterrupts(cause)
               ? Effect.failCause(cause)
-              : reportDefect(cause).pipe(
-                  Effect.andThen(
-                    Effect.fail(
-                      new ToolCallFailed({
-                        ...identity,
-                        reason: "Executor failed unexpectedly while handling this tool call.",
-                        mayHaveWritten: true,
-                      }),
-                    ),
-                  ),
+              : Effect.flatMap(read, (read) =>
+                  read
+                    ? Effect.failCause(cause)
+                    : reportDefect(cause).pipe(
+                        Effect.andThen(observeFailure("runtime")),
+                        Effect.andThen(
+                          Effect.fail(
+                            new ToolCallFailed({
+                              ...identity,
+                              reason: "Executor failed unexpectedly while handling this tool call.",
+                              mayHaveWritten: true,
+                            }),
+                          ),
+                        ),
+                      ),
                 ),
           ),
           Effect.provideService(AppCodeEntered, appCode),
@@ -1719,6 +1881,9 @@ export const makeTools = (
                     );
                     // Set by the host when it hands this call's work to the app's code, as for a call.
                     let enteredApp = false;
+                    // As for a call, the saved (caller's) kind counts as a read only when the app
+                    // confirms it.
+                    const read = yield* readOf(state, saved.tool, saved.kind);
                     // As for a call, every failure from here passes through `callFailure` once, so a
                     // resumed call that may write reports what it failed with as possibly written.
                     return yield* Effect.gen(function* () {
@@ -1733,6 +1898,7 @@ export const makeTools = (
                               ? {}
                               : { workflowControls: workflows(state) }),
                             build: state.version.build,
+                            hostApi: listings.hostApi(state.version),
                             database: ownsDatabase(state.version.requirements),
                             sharedRuntime: sharesRuntime(state.version.requirements),
                             ...context,
@@ -1753,15 +1919,16 @@ export const makeTools = (
                           }),
                           Effect.result,
                         );
-                      // As for a call, the saved (caller's) kind decides whether a refused call is
-                      // repeated; the catalog's only sets the dispatched kind.
+                      // As for a call, the saved (caller's) kind, confirmed by the app, decides whether
+                      // a refused call is repeated; the catalog's only sets the dispatched kind.
                       const { result, renewal } = yield* executeRenewing(
                         state,
                         context,
-                        saved.kind,
+                        read,
                         execute,
                       );
-                      if (Result.isFailure(result))
+                      if (Result.isFailure(result)) {
+                        yield* observeFailure(failureSource(result.failure));
                         return yield* Effect.fail(
                           runtimeFailure(
                             { app: saved.app, version: saved.version, tool: saved.tool },
@@ -1769,6 +1936,7 @@ export const makeTools = (
                             renewal,
                           )(result.failure),
                         );
+                      }
                       const value = result.success;
                       if (toolError)
                         yield* Effect.annotateCurrentSpan({
@@ -1781,12 +1949,15 @@ export const makeTools = (
                         ...(toolError ? { toolError: true as const } : {}),
                       };
                     }).pipe(
-                      Effect.mapError((failure) =>
+                      Effect.catch((failure) =>
                         failure._tag === "OAuthReconnectRequired" ||
                         failure._tag === "OAuthRenewalFailed" ||
-                        failure._tag === "AccountRequired"
-                          ? failure
-                          : callFailure(saved.kind, enteredApp)(failure),
+                        failure._tag === "AccountRequired" ||
+                        !enteredApp
+                          ? Effect.fail(failure)
+                          : Effect.flatMap(read, (read) =>
+                              Effect.fail(callFailure(read, enteredApp)(failure)),
+                            ),
                       ),
                       Effect.provideService(AppCodeEntered, {
                         entered: () => {
diff --git a/packages/sdk/src/implementation/webhook-sources.ts b/packages/sdk/src/implementation/webhook-sources.ts
index 2f24ca1ac7..d952f4ad21 100644
--- a/packages/sdk/src/implementation/webhook-sources.ts
+++ b/packages/sdk/src/implementation/webhook-sources.ts
@@ -60,16 +60,55 @@ const StoredSource = Schema.Struct({
 type StoredSource = typeof StoredSource.Type;
 
 /**
- * The wait after a source's `retries`-th failure in a row: 30 seconds, doubling to at most an hour.
- * A failure that persists, such as a service refusing the account's OAuth client, then costs one
- * attempt an hour instead of one a tick. New intent resets the count and runs at once.
+ * The wait after a source's `retries`-th attempt in a row that failed or found it needing setup: 30
+ * seconds, doubling to at most an hour. A failure that persists, such as a service refusing the
+ * account's OAuth client, then costs one attempt an hour instead of one a tick, and so does a
+ * source waiting for a person, which an attempt cannot fix. New intent resets the count and runs
+ * at once.
  */
 const retryDelay = (retries: number) => Math.min(30_000 * 2 ** (retries - 1), 3_600_000);
 
+/**
+ * Completing a manual setup is new intent for the source whose subscription it completed: a source
+ * that needs that setup runs again at once rather than waiting out its delay. Run in the
+ * completion's transaction after it takes the app's lock, as every write that saves intent does, so
+ * a pass completing meanwhile sees the new revision and runs again.
+ */
+export const setupCompleted = (
+  tx: Query,
+  input: { readonly app: AppId; readonly account: AccountId },
+) =>
+  Effect.gen(function* () {
+    const row = yield* query(() =>
+      tx.findFirst("webhookSources", {
+        where: (b) => b.and(b("app", "=", input.app), b("account", "=", input.account)),
+      }),
+    );
+    if (row === null || row.status === "removing") return;
+    yield* query(() =>
+      tx.updateMany("webhookSources", {
+        where: (b) => b("id", "=", row.id),
+        set: {
+          status: "pending",
+          failure: null,
+          retries: 0,
+          revision: row.revision + 1,
+        },
+      }),
+    );
+  });
+
 /**
  * Keys of managed subscriptions start with `setup-` and hash the definition, source, configuration
- * and version, so retries reuse a registration and a new version registers again. The
- * actor and its accounts are not part of the key: callbacks resolve them at each delivery.
+ * and the version that created them, so retries reuse a registration and a new version registers
+ * again. A manual subscription instead moves to the new version while its setup still fits, since
+ * a person copied its callback URL and secret into the provider. The actor and its accounts are not
+ * part of the key: callbacks resolve them at each delivery.
+ *
+ * A reconciliation works for the activation it claimed, the app's `activatedSequence`, which every
+ * activation advances, also one back to the same version. It creates and removes subscriptions
+ * only while that activation is current, and a source it claimed is ready only if no other
+ * activation came in between; otherwise the source stays pending and reconciles again.
  */
 export const makeWebhookSources = (
   db: Query,
@@ -80,8 +119,10 @@ export const makeWebhookSources = (
     /** Evaluated now, never reused: reconciliation changes upstream registrations. */
     readonly liveDefinitions: ReturnType<typeof makeWebhooks>["liveDefinitions"];
     readonly retarget: ReturnType<typeof makeWebhooks>["retarget"];
-    /** Creates a managed subscription beside a stopped one with the same key. */
+    /** Creates a managed subscription beside earlier ones with the same key, for an activation. */
     readonly createManaged: ReturnType<typeof makeWebhooks>["createManaged"];
+    /** Removes a managed subscription while an activation is current. */
+    readonly removeManaged: ReturnType<typeof makeWebhooks>["removeManaged"];
     /** Stored-state check for an account whose sign-in must reconnect. */
     readonly accountNeedingReconnect: ReturnType<typeof makeTools>["accountNeedingReconnect"];
   },
@@ -165,10 +206,15 @@ export const makeWebhookSources = (
           Effect.gen(function* () {
             const { app, current } = claim;
             if (current === undefined) return undefined;
-            if (!claim.claimed) return yield* view(current);
+            if (!claim.claimed) {
+              yield* Effect.annotateCurrentSpan("executor.webhooks.source.claimed", false);
+              return yield* view(current);
+            }
             const removing = current.status === "removing";
             let failure: WebhookSource["failure"] = null;
             let status: WebhookSource["status"] = removing ? "removing" : "ready";
+            // How many of the active version's webhooks use this source, once evaluated.
+            let served: number | undefined;
             const attempt = yield* Effect.gen(function* () {
               const hooks = yield* managed(current);
               if (removing) {
@@ -188,6 +234,7 @@ export const makeWebhookSources = (
                 return;
               }
               const version = app.activeVersion;
+              const activation = app.activatedSequence;
               const accounts = yield* accountsOf(current);
               const state: InvocationSnapshot = yield* snapshot(db, {
                 app: app.id,
@@ -226,26 +273,34 @@ export const makeWebhookSources = (
                   config,
                   version,
                 });
-                desired.add(key);
-                // A registration kept from an earlier actor follows the source's current one.
+                // A subscription pinned to another version, such as one an earlier version created
+                // and a later one carried, goes through creation, which moves a manual one back
+                // only while its setup still fits.
                 const kept = hooks.find(
                   (saved) =>
                     saved.key === key &&
+                    saved.version === version &&
                     (saved.status === "active" ||
                       saved.status === "pending" ||
                       saved.status === "setup-required"),
                 );
-                if (kept !== undefined) yield* resources.retarget(kept.id, current.actor);
+                // Creating may instead carry a manual subscription from an earlier version.
                 const created =
                   kept ??
-                  (yield* resources.createManaged({
-                    app: app.id,
-                    actor: current.actor,
-                    name: hook.name,
-                    sourceAccount: current.account,
-                    key,
-                    config,
-                  }));
+                  (yield* resources.createManaged(
+                    {
+                      app: app.id,
+                      actor: current.actor,
+                      name: hook.name,
+                      sourceAccount: current.account,
+                      key,
+                      config,
+                    },
+                    activation,
+                  ));
+                desired.add(created.id);
+                // A registration kept from an earlier actor follows the source's current one.
+                yield* resources.retarget(created.id, current.actor);
                 const subscription =
                   created.status === "pending"
                     ? yield* resources.webhooks.reconcile({
@@ -261,13 +316,14 @@ export const makeWebhookSources = (
                   failure = "registration";
                 }
               }
+              served = desired.size;
               // Old registrations retain the code and state required for their own cleanup.
               for (const hook of hooks)
-                if (hook.status !== "stopped" && !desired.has(hook.key)) {
-                  const stopped = yield* resources.webhooks.remove({
-                    app: app.id,
-                    subscription: hook.id,
-                  });
+                if (hook.status !== "stopped" && !desired.has(hook.id)) {
+                  const stopped = yield* resources.removeManaged(
+                    { app: app.id, subscription: hook.id },
+                    activation,
+                  );
                   if (stopped.status !== "stopped") {
                     status = "failed";
                     failure = "cleanup";
@@ -303,14 +359,18 @@ export const makeWebhookSources = (
                 failure = "configuration";
               }
             } else if (removing && failure !== null) status = "removing";
-            return yield* transaction(db, (tx) =>
+            const result = yield* transaction(db, (tx) =>
               Effect.gen(function* () {
                 const liveApp = yield* lockApp(tx, { app: input.app });
                 const live = yield* find(input);
                 if (live === undefined || live.lease !== token)
                   return live === undefined ? undefined : yield* view(live);
+                // Another activation since the claim, even one back to the same version, means this
+                // pass may have created or kept subscriptions for an activation that is no longer
+                // current, so it does not count.
                 const changed =
-                  live.revision !== current.revision || liveApp.activeVersion !== app.activeVersion;
+                  live.revision !== current.revision ||
+                  liveApp.activatedSequence !== app.activatedSequence;
                 const completedAt = yield* now;
                 // A removed source is deleted once its subscriptions have stopped.
                 if (!changed && removing && failure === null) {
@@ -324,12 +384,11 @@ export const makeWebhookSources = (
                     ? "removing"
                     : "pending"
                   : status;
-                // Only a failure backs off. A source that needs setup keeps its short delay, so it
-                // runs soon after the setup is done.
-                const retries =
-                  !changed && (next === "failed" || (next === "removing" && failure !== null))
-                    ? live.retries + 1
-                    : 0;
+                // A source that failed, needs setup or could not finish removing backs off: another
+                // attempt cannot succeed until something changes. The changes Executor sees save new
+                // intent, which runs at once: linking, configuring, an activation, new credentials
+                // for its account and completing a manual setup.
+                const retries = !changed && next !== "ready" ? live.retries + 1 : 0;
                 yield* query(() =>
                   tx.updateMany("webhookSources", {
                     where: (b) => b("id", "=", live.id),
@@ -337,14 +396,7 @@ export const makeWebhookSources = (
                       status: next,
                       failure: changed ? null : failure,
                       lease: null,
-                      leaseUntil: new Date(
-                        completedAt +
-                          (changed || next === "ready"
-                            ? 0
-                            : retries > 0
-                              ? retryDelay(retries)
-                              : 30_000),
-                      ),
+                      leaseUntil: new Date(completedAt + (retries > 0 ? retryDelay(retries) : 0)),
                       retries,
                       ...(next === "ready" ? { reconciledDeployment: app.activeVersion } : {}),
                     },
@@ -354,6 +406,15 @@ export const makeWebhookSources = (
                 return saved === undefined ? undefined : yield* view(saved);
               }),
             );
+            yield* Effect.annotateCurrentSpan({
+              "executor.webhooks.source.claimed": true,
+              "executor.webhooks.source.status": result === undefined ? "gone" : result.status,
+              ...(result === undefined || result.failure === null
+                ? {}
+                : { "executor.webhooks.source.failure": result.failure }),
+              ...(served === undefined ? {} : { "executor.webhooks.source.served": served }),
+            });
+            return result;
           }),
         (claim, exit) =>
           !claim.claimed || claim.current === undefined || Exit.isSuccess(exit)
@@ -587,8 +648,9 @@ export const makeWebhookSources = (
                 ),
               );
         // A source that failed on its accounts cannot succeed while one must reconnect or a
-        // requirement needs a choice. Wait instead, checking stored state once per retry delay;
-        // linking again saves new intent, which runs at once.
+        // requirement needs a choice. Wait instead, checking stored state once per retry delay,
+        // which doubles with each check that finds it still waiting. New credentials for the
+        // source's account (`resumeWaitingSources`) and linking again end the wait at once.
         const ready = yield* Effect.filter(retries, (row) =>
           row.failure !== "accounts" || row.lease !== null
             ? Effect.succeed(true)
@@ -604,7 +666,10 @@ export const makeWebhookSources = (
                               b("lease", "is", null),
                               b("leaseUntil", "=", row.leaseUntil),
                             ),
-                          set: { leaseUntil: new Date(time.getTime() + 30_000) },
+                          set: {
+                            leaseUntil: new Date(time.getTime() + retryDelay(row.retries + 1)),
+                            retries: row.retries + 1,
+                          },
                         }),
                       ).pipe(Effect.as(false)),
                 ),
diff --git a/packages/sdk/src/implementation/webhooks.ts b/packages/sdk/src/implementation/webhooks.ts
index 9558d05d33..1d562e77cc 100644
--- a/packages/sdk/src/implementation/webhooks.ts
+++ b/packages/sdk/src/implementation/webhooks.ts
@@ -47,11 +47,13 @@ import {
   type InvocationSnapshot,
 } from "./tools.ts";
 import { storedAccount } from "./accounts.ts";
-import { storedApp, storedVersion } from "./apps.ts";
+import { lockApp, storedApp, storedVersion } from "./apps.ts";
 import { backgroundAccounts } from "./background-accounts.ts";
+import { setupCompleted } from "./webhook-sources.ts";
 import { accountAuthority } from "./selection.ts";
 import type { Declarations } from "./declarations.ts";
 import { ownsDatabase, sharesRuntime } from "../contracts/apps.ts";
+import { declarationLimits } from "../contracts/declarations.ts";
 
 const StoredWebhook = Schema.Struct({
   ...WebhookSubscriptionFields.fields,
@@ -106,6 +108,198 @@ const PrivateState = Schema.Struct({
   state: Schema.Json,
   setup: Schema.optional(ManualWebhookDescriptor),
 });
+type Json = typeof Schema.Json.Type;
+const isList = (value: Json): value is ReadonlyArray<Json> => Array.isArray(value);
+/**
+ * Where a compared value sits in a JSON Schema, which decides how it is put in one order. `schema`
+ * is a schema; `schemas` a list of schemas; `schemaMap` an object of schemas; `items` a schema, or
+ * before 2020-12 a list of them; `names` a list of property names; `dependencies` an object of
+ * schemas or lists of names (Draft 7); `namesMap` an object of lists of names. `data` is compared
+ * as written.
+ */
+type Position =
+  | "data"
+  | "schema"
+  | "schemas"
+  | "schemaMap"
+  | "items"
+  | "names"
+  | "dependencies"
+  | "namesMap";
+/**
+ * Every JSON Schema keyword whose value holds a schema or a list of property names, from Draft 7
+ * to 2020-12. Other keywords hold data, such as `enum`, `const` and `default`.
+ */
+const keywords = new Map<string, Position>([
+  ["additionalItems", "schema"],
+  ["additionalProperties", "schema"],
+  ["allOf", "schemas"],
+  ["anyOf", "schemas"],
+  ["contains", "schema"],
+  ["contentSchema", "schema"],
+  ["definitions", "schemaMap"],
+  ["dependencies", "dependencies"],
+  ["dependentRequired", "namesMap"],
+  ["dependentSchemas", "schemaMap"],
+  ["else", "schema"],
+  ["if", "schema"],
+  ["items", "items"],
+  ["not", "schema"],
+  ["oneOf", "schemas"],
+  ["patternProperties", "schemaMap"],
+  ["prefixItems", "schemas"],
+  ["properties", "schemaMap"],
+  ["propertyNames", "schema"],
+  ["required", "names"],
+  ["then", "schema"],
+  ["unevaluatedItems", "schema"],
+  ["unevaluatedProperties", "schema"],
+  ["$defs", "schemaMap"],
+]);
+/** Where a member of an object at `position` sits. */
+const memberOf = (position: Position, key: string, member: Json): Position => {
+  switch (position) {
+    case "schema":
+      return keywords.get(key) ?? "data";
+    case "schemaMap":
+      return "schema";
+    case "dependencies":
+      return isList(member) ? "names" : "schema";
+    case "namesMap":
+      return "names";
+    default:
+      return "data";
+  }
+};
+/**
+ * How many objects and lists deep a compared value may nest, as deep as the apps package walks an
+ * imported schema document (`documentKeys`).
+ */
+const comparedLevels = 64;
+/**
+ * How long a setup's compared text may be, in characters: the largest evaluated declaration a
+ * Cloud isolate keeps (`declarationLimits.entryBytes`, which counts two bytes per character). The
+ * webhooks declaration holds the state schema and the configuration's defaults.
+ */
+const comparedLength = declarationLimits.entryBytes / 2;
+/** A list or an object being written, and the index of its next element or member. */
+type Frame = (
+  | { readonly elements: ReadonlyArray<Json> }
+  | {
+      readonly members: { readonly [name: string]: Json };
+      /** The members' names in the order they are written. */
+      readonly names: ReadonlyArray<string>;
+    }
+) & { readonly position: Position; readonly depth: number; next: number };
+/**
+ * The JSON text of `fields`, with every object's members in name order and every list of property
+ * names at a schema position sorted, so values that differ only in those orders give the same
+ * text. A reference such as `#/$defs/choice/anyOf/0` names a branch by its position, so every other
+ * list keeps its order; a list of names holds no schema, so no valid reference resolves into it.
+ *
+ * `undefined` when a value nests deeper than `comparedLevels` or the text would be longer than
+ * `comparedLength`. `length` is never more than the whole text's length: it counts what is written
+ * and, for every open list or object, its brackets, separators and member names and one character
+ * for each value it has not written yet. A list or object reserves all of that before it is opened
+ * and before its names are sorted, and a string is checked before it is stringified. So the walk
+ * visits at most `comparedLength` values and holds one frame per level, whatever the input. Listing
+ * the keys of an object, which is already in memory, is the only step taken before its check.
+ */
+const comparedText = (
+  fields: ReadonlyArray<readonly [name: string, value: Json, position: Position]>,
+) => {
+  const parts: Array<string> = [];
+  let length = 0;
+  const reserve = (characters: number) => (length += characters) <= comparedLength;
+  const frames: Array<Frame> = [];
+  // Writes a scalar, or opens a list or object, whose first character is already reserved.
+  const start = (value: Json, position: Position, depth: number) => {
+    if (typeof value !== "object" || value === null) {
+      // A string's text is its quotes and at least its characters.
+      if (typeof value === "string" && length + value.length + 1 > comparedLength) return false;
+      const text = JSON.stringify(value);
+      parts.push(text);
+      return reserve(text.length - 1);
+    }
+    if (depth === comparedLevels) return false;
+    const at = position === "items" ? (isList(value) ? "schemas" : "schema") : position;
+    if (isList(value)) {
+      // Brackets, and each element's first character and separator.
+      if (!reserve(value.length === 0 ? 1 : 2 * value.length)) return false;
+      let elements = value;
+      if (at === "names" && value.every((name) => typeof name === "string")) {
+        let names = length;
+        for (const name of value) if ((names += name.length + 1) > comparedLength) return false;
+        elements = value.toSorted();
+      }
+      const position = at === "schemas" ? "schema" : "data";
+      frames.push({ elements, position, depth, next: 0 });
+      parts.push("[");
+      return true;
+    }
+    const names = Object.keys(value);
+    // Brackets, and each member's quoted name, colon, first character of its value and separator.
+    if (!reserve(names.length === 0 ? 1 : 5 * names.length)) return false;
+    for (const name of names) if (!reserve(name.length)) return false;
+    frames.push({ members: value, names: names.toSorted(), position: at, depth, next: 0 });
+    parts.push("{");
+    return true;
+  };
+  for (const [index, [name, value, position]] of fields.entries()) {
+    const label = `${index === 0 ? "{" : ","}${JSON.stringify(name)}:`;
+    parts.push(label);
+    if (!reserve(label.length + 1) || !start(value, position, 0)) return undefined;
+    for (let frame = frames.at(-1); frame !== undefined; frame = frames.at(-1)) {
+      const next = frame.next++;
+      const count = "names" in frame ? frame.names.length : frame.elements.length;
+      if (next === count) {
+        parts.push("names" in frame ? "}" : "]");
+        frames.pop();
+        continue;
+      }
+      if (next > 0) parts.push(",");
+      if ("names" in frame) {
+        const key = frame.names[next] ?? "";
+        const member = frame.members[key] ?? null;
+        const text = JSON.stringify(key);
+        parts.push(text, ":");
+        if (
+          !reserve(text.length - key.length - 2) ||
+          !start(member, memberOf(frame.position, key, member), frame.depth + 1)
+        )
+          return undefined;
+      } else if (!start(frame.elements[next] ?? null, frame.position, frame.depth + 1))
+        return undefined;
+    }
+  }
+  parts.push("}");
+  return reserve(1) ? parts.join("") : undefined;
+};
+/** A manual subscription's setup at the provider, and the configuration it serves. */
+type Setup = {
+  readonly setup: typeof ManualWebhookDescriptor.Type;
+  readonly config: Json;
+};
+/**
+ * Whether a person's setup at the provider still serves a version's manual declaration: the
+ * provider holds the callback URL and the secret from the same source, the fields they entered fit
+ * a state schema that accepts the same values, and the configuration is the same. Instructions may
+ * change; they only guide a new setup.
+ *
+ * Every value it compares is in `text`, so each goes through `comparedText`'s bounds. A setup too
+ * deep or too long to compare counts as changed, so the version gets a new setup, as every version
+ * did before setups were carried.
+ */
+const sameSetup = (declared: Setup) => {
+  const text = ({ setup, config }: Setup) =>
+    comparedText([
+      ["config", config, "data"],
+      ["signingSecret", setup.signingSecret, "data"],
+      ["stateSchema", setup.stateSchema, "schema"],
+    ]);
+  const expected = text(declared);
+  return (saved: Setup) => expected !== undefined && text(saved) === expected;
+};
 
 /**
  * The host owns origin and authority. Each subscription pins its code and source account; every
@@ -268,6 +462,7 @@ export const makeWebhooks = (
       .webhook({
         app: row.app,
         build: state.version.build,
+        hostApi: declarations.hostApi(state.version),
         database: ownsDatabase(state.version.requirements),
         sharedRuntime: sharesRuntime(state.version.requirements),
         ...context,
@@ -301,6 +496,7 @@ export const makeWebhooks = (
             .webhook({
               app: state.app.id,
               build: state.version.build,
+              hostApi: declarations.hostApi(state.version),
               database: ownsDatabase(state.version.requirements),
               sharedRuntime: sharesRuntime(state.version.requirements),
               ...context,
@@ -313,10 +509,72 @@ export const makeWebhooks = (
         Effect.mapError(failed),
       );
     });
+  /**
+   * A source's live manual subscription to a definition, from any version, of the same source scope,
+   * whose setup at the provider and configuration the active version's declaration still serves
+   * (`sameSetup`). `replaced` reports live ones of the same source scope whose setup no longer fits,
+   * which the new subscription replaces.
+   */
+  const carryable = (input: {
+    readonly app: AppId;
+    readonly actor: string | null;
+    readonly name: string;
+    readonly sourceAccount: AccountId;
+    readonly config: typeof Schema.Json.Type;
+    readonly setup: typeof ManualWebhookDescriptor.Type;
+  }) =>
+    Effect.gen(function* () {
+      const serves = sameSetup({ setup: input.setup, config: input.config });
+      const rows = yield* query(() =>
+        db.findMany("webhooks", {
+          where: (b) =>
+            b.and(
+              b("app", "=", input.app),
+              b("sourceAccount", "=", input.sourceAccount),
+              b("name", "=", input.name),
+              b("status", "in", ["active", "setup-required"]),
+            ),
+        }),
+      );
+      let replaced = false;
+      let carried: { row: typeof StoredWebhook.Type; saved: typeof PrivateState.Type } | undefined;
+      for (const value of rows) {
+        const row = yield* Schema.decodeUnknownEffect(StoredWebhook)(value).pipe(
+          Effect.mapError(() => new StorageError()),
+        );
+        // Only a source's own subscriptions, of the definition's scope: an app-account webhook's
+        // has no actor, and a user-account webhook's follows its source's actor.
+        if (!row.key.startsWith("setup-") || (row.actor === null) !== (input.actor === null))
+          continue;
+        const saved = yield* decrypt(row);
+        if (saved.setup === undefined || !serves({ setup: saved.setup, config: saved.config })) {
+          replaced = true;
+          continue;
+        }
+        // The completed setup is the one the provider delivers to; otherwise the newest.
+        if (
+          carried === undefined ||
+          (row.status === "active" && carried.row.status !== "active") ||
+          (row.status === carried.row.status && row.createdAt > carried.row.createdAt)
+        )
+          carried = { row, saved };
+      }
+      if (carried === undefined) return { carried, replaced };
+      // The saved setup follows the version's, whose instructions may have changed.
+      const encrypted = yield* credentials.encrypt(
+        carried.row.id,
+        Redacted.make({ ...carried.saved, setup: input.setup }),
+      );
+      return { carried: { row: carried.row, encrypted }, replaced };
+    });
   const outsideTransaction = storage.reactivity.inTransaction.pipe(
     Effect.flatMap((inside) => (inside ? Effect.fail(new RequestInvalid()) : Effect.void)),
   );
-  const reconcile = (input: typeof WebhookTarget.Type, remove = false) =>
+  /**
+   * Register or remove a subscription. `activation` binds a source's cleanup to the activation its
+   * reconciliation claimed (see `create`): once another supersedes it, nothing is removed.
+   */
+  const reconcile = (input: typeof WebhookTarget.Type, remove = false, activation?: number) =>
     Effect.gen(function* () {
       yield* outsideTransaction;
       const parsed = yield* Schema.decodeUnknownEffect(WebhookTarget)(input).pipe(
@@ -326,6 +584,12 @@ export const makeWebhooks = (
       return yield* Effect.acquireUseRelease(
         transaction(db, () =>
           Effect.gen(function* () {
+            // The app's lock orders this against activation, which takes it too.
+            if (
+              activation !== undefined &&
+              (yield* lockApp(db, { app: parsed.app })).activatedSequence !== activation
+            )
+              return yield* new WebhookConflict();
             const row = yield* read(parsed);
             if (
               row.status === "stopped" ||
@@ -462,11 +726,18 @@ export const makeWebhooks = (
    * Save a subscription and attempt its registration. A caller's repeated key returns its saved
    * subscription, and a stopped key stays stopped. A source's managed keys are derived from what it
    * registers, so once its subscription for a key stopped, registering that key again starts a new
-   * one; the stopped subscription stays as history.
+   * one; the stopped subscription stays as history. One that is disabled or stopping still holds its
+   * key and is returned as it is, never enabled again.
+   *
+   * A source's subscription is created for `activation`, the app's `activatedSequence` when its
+   * reconciliation claimed the source. Every activation advances it, also one back to the same
+   * version, so a reconciliation that another activation superseded writes nothing more, even when
+   * the version it claimed is active again: its definitions and keys are of an earlier activation.
    */
-  const create = (input: typeof ManagedWebhook.Type, managed: boolean) =>
+  const create = (input: typeof ManagedWebhook.Type, activation?: number) =>
     Effect.gen(function* () {
       yield* outsideTransaction;
+      const managed = activation !== undefined;
       // Only a source's managed subscription may have no actor: an app-account webhook.
       const parsed = yield* Schema.decodeUnknownEffect(managed ? ManagedWebhook : CreateWebhook)(
         input,
@@ -486,6 +757,7 @@ export const makeWebhooks = (
       )
         return yield* new WebhookFailed({ reason: "unavailable" });
       const app = yield* storedApp(db, parsed);
+      if (managed && app.activatedSequence !== activation) return yield* new WebhookConflict();
       const version = yield* storedVersion(db, app);
       const sourceAccount = parsed.sourceAccount;
       const state = yield* backgroundAccounts(db, lifecycle, {
@@ -506,6 +778,7 @@ export const makeWebhooks = (
         .webhook({
           app: parsed.app,
           build: state.version.build,
+          hostApi: declarations.hostApi(state.version),
           database: ownsDatabase(state.version.requirements),
           sharedRuntime: sharesRuntime(state.version.requirements),
           ...context,
@@ -525,8 +798,13 @@ export const makeWebhooks = (
       const required = Object.hasOwn(state.version.requirements.accounts, hook.account)
         ? state.version.requirements.accounts[hook.account]
         : undefined;
-      if (required === undefined || (required.scope === "app") !== (actor === undefined))
-        return yield* new WebhookFailed({ reason: "input" });
+      if (required === undefined) return yield* new WebhookFailed({ reason: "definition" });
+      if ((required.scope === "app") !== (actor === undefined))
+        // A caller names an actor, so only the app's link of an account creates an app-account
+        // webhook's subscription.
+        return yield* new WebhookFailed(
+          actor === undefined ? { reason: "input" } : { reason: "input", mismatch: "app-account" },
+        );
       // The source must serve the definition's requirement.
       const selected = Object.hasOwn(state.accounts, hook.account)
         ? state.accounts[hook.account]
@@ -536,7 +814,7 @@ export const makeWebhooks = (
           ? selected === sourceAccount
           : selected?.includes(sourceAccount))
       )
-        return yield* new WebhookFailed({ reason: "input" });
+        return yield* new WebhookFailed({ reason: "input", mismatch: "source" });
       const id = WebhookId.make(`whk_${yield* next}`);
       const callbackUrl = new URL(`/api/webhooks/${parsed.app}/${id}`, base).href;
       const secret = `${yield* next}${yield* next}`;
@@ -544,6 +822,7 @@ export const makeWebhooks = (
         .webhook({
           app: parsed.app,
           build: state.version.build,
+          hostApi: declarations.hostApi(state.version),
           database: ownsDatabase(state.version.requirements),
           sharedRuntime: sharesRuntime(state.version.requirements),
           ...context,
@@ -557,7 +836,27 @@ export const makeWebhooks = (
             sourceAccount,
           },
         })
-        .pipe(Effect.mapError(() => new WebhookFailed({ reason: "input" })));
+        .pipe(Effect.mapError(() => new WebhookFailed({ reason: "input", mismatch: "config" })));
+      // A source's manual subscription keeps its callback URL, secret and entered fields on a new
+      // version whose setup still serves them: a person copied those into the provider, which keeps
+      // delivering to them. A changed setup needs a new one, and the old one is removed after.
+      const manual =
+        managed && hook.setup !== undefined
+          ? yield* carryable({
+              app: app.id,
+              actor: actor ?? null,
+              name: parsed.name,
+              sourceAccount,
+              config,
+              setup: hook.setup,
+            })
+          : undefined;
+      const carried = manual?.carried;
+      if (manual !== undefined)
+        yield* Effect.annotateCurrentSpan({
+          "executor.webhooks.carried": carried !== undefined,
+          "executor.webhooks.setup_changed": carried === undefined && manual.replaced,
+        });
       const encrypted = yield* credentials.encrypt(
         id,
         Redacted.make({
@@ -571,7 +870,8 @@ export const makeWebhooks = (
       const createdAt = new Date(yield* Clock.currentTimeMillis);
       const target = yield* transaction(db, () =>
         Effect.gen(function* () {
-          // Serializes creation and app deletion without holding a lock across provider I/O.
+          // Serializes creation with app deletion and activation without holding a lock across
+          // provider I/O.
           yield* query(() =>
             db.updateMany("apps", {
               where: (b) => b("id", "=", state.app.id),
@@ -579,9 +879,30 @@ export const makeWebhooks = (
             }),
           );
           const current = yield* storedApp(db, { app: state.app.id });
-          if (current.activeVersion !== state.app.activeVersion)
+          // A source's subscription needs the activation it claimed to be current; a caller's,
+          // the version it was evaluated on to be active.
+          if (
+            managed
+              ? current.activatedSequence !== activation
+              : current.activeVersion !== version.id
+          )
             return yield* new WebhookConflict();
-          // At most one subscription per key is not stopped; stopped ones are history.
+          if (carried !== undefined) {
+            if (carried.row.version === state.version.id) return carried.row.id;
+            // Pinned to this version from now on, unless it changed since it was read. The
+            // revision stays, so a setup page opened before the deploy can still complete it.
+            yield* query(() =>
+              db.updateMany("webhooks", {
+                where: (b) =>
+                  b.and(b("id", "=", carried.row.id), b("revision", "=", carried.row.revision)),
+                set: { deployment: state.version.id, encrypted: carried.encrypted },
+              }),
+            );
+            const saved = yield* read({ app: parsed.app, subscription: carried.row.id });
+            if (saved.revision !== carried.row.revision || saved.version !== state.version.id)
+              return yield* new WebhookConflict();
+            return carried.row.id;
+          }
           const keyed = yield* query(() =>
             db.findMany("webhooks", {
               where: (b) =>
@@ -592,6 +913,7 @@ export const makeWebhooks = (
                 ),
             }),
           );
+          // At most one subscription per key is not stopped; stopped ones are history.
           const existing =
             keyed.find((row) => row.status !== "stopped") ?? (managed ? undefined : keyed[0]);
           if (existing !== undefined) {
@@ -683,7 +1005,7 @@ export const makeWebhooks = (
           Effect.mapError(() => new StorageError()),
         );
       }),
-    create: (input: typeof CreateWebhook.Type) => create(input, false),
+    create: (input: typeof CreateWebhook.Type) => create(input),
     reconcile: (input: typeof WebhookTarget.Type) => reconcile(input),
     remove: (input: typeof WebhookTarget.Type) => reconcile(input, true),
     deliver: (input: typeof DeliverWebhook.Type) =>
@@ -722,8 +1044,12 @@ export const makeWebhooks = (
     webhooks,
     /** Reconciliation creates and removes upstream registrations from the current definitions. */
     liveDefinitions: (state: InvocationSnapshot) => definitions(state, true),
-    /** Create a source's managed subscription; see `create`. */
-    createManaged: (input: typeof ManagedWebhook.Type) => create(input, true),
+    /** Create a source's managed subscription for the activation it claimed; see `create`. */
+    createManaged: (input: typeof ManagedWebhook.Type, activation: number) =>
+      create(input, activation),
+    /** Remove a source's managed subscription while the activation it claimed is current. */
+    removeManaged: (input: typeof WebhookTarget.Type, activation: number) =>
+      reconcile(input, true, activation),
     /**
      * Point a subscription at its source's current actor. Callbacks resolve accounts at each
      * delivery, so the upstream registration is unchanged.
@@ -822,6 +1148,8 @@ export const makeWebhooks = (
           const revision = yield* next;
           return yield* transaction(db, () =>
             Effect.gen(function* () {
+              // The app's lock comes first, as in reconciliation, which also changes subscriptions.
+              yield* lockApp(db, { app: row.app });
               yield* query(() =>
                 db.updateMany("webhooks", {
                   where: (b) =>
@@ -835,6 +1163,10 @@ export const makeWebhooks = (
               );
               const current = yield* read(parsed);
               if (current.revision !== revision) return yield* new WebhookConflict();
+              // A managed subscription belongs to its account's webhook source, which may be
+              // waiting for this setup.
+              if (current.key.startsWith("setup-"))
+                yield* setupCompleted(db, { app: current.app, account: current.sourceAccount });
               return yield* metadata(current);
             }),
           );
diff --git a/packages/sdk/src/implementation/wire-revision.ts b/packages/sdk/src/implementation/wire-revision.ts
new file mode 100644
index 0000000000..a07a090aa9
--- /dev/null
+++ b/packages/sdk/src/implementation/wire-revision.ts
@@ -0,0 +1,232 @@
+/**
+ * Registry and publication results as a client reading an earlier wire revision sees them.
+ *
+ * Revision 0 reads a listing in a publishing scope by its organization's slug, `@acme/notes` for
+ * `@acme.executor.community/notes`, as packages were named before scopes, and any other listing by
+ * its own name. A registry may publish `@acme/notes` itself, so a name such a client sends is
+ * resolved against the names the registry publishes, never rewritten by its form alone. When the
+ * registry publishes both, the name could select either: neither is listed to the client, and a
+ * request naming it is refused. A listing the client named is answered by the name it sent, which it
+ * can read: a release after 2.0.0-beta.15 that states no revision may send a full name and requires
+ * the answer to name the same. Names quoted from source files are never rewritten, so readiness a
+ * client cannot read is withheld instead.
+ *
+ * A name selects whichever listing it names when the request arrives, which need not be the one the
+ * client was shown: that listing may have been replaced, or its organization renamed and its slug
+ * taken by another. So a revision 0 name is resolved only to list a listing, or for a request that
+ * also names the commit it was shown, which the registry checks in the same read that returns its
+ * source: source, files, and copies into the caller's own organization. A removal names no commit,
+ * so app management refuses a removal by a name revision 0 reads for a scoped listing and gives the
+ * full name instead; a full name means only itself.
+ */
+import { Array as Arr, Effect, Option } from "effect";
+import type { Executor } from "../contracts/executor.ts";
+import {
+  packageLabel,
+  packageScope,
+  publishingDomain,
+  type PackageName,
+  type Publication,
+  type PublicationReadiness,
+  RegistryError,
+} from "../contracts/registry.ts";
+
+/** Package names as revision 0 decodes them: no dot in the scope. */
+const revisionZeroPackageName = /^@[a-z0-9][a-z0-9-]{0,79}\/[a-z0-9][a-z0-9-]{0,62}$/u;
+const publishingSuffix = `.${publishingDomain}`;
+
+/** The name revision 0 reads a listing by, if it can read one. */
+const revisionZeroName = (name: PackageName): Option.Option<PackageName> => {
+  const scope = packageScope(name);
+  const read = scope.endsWith(publishingSuffix)
+    ? `@${scope.slice(0, -publishingSuffix.length)}/${packageLabel(name)}`
+    : name;
+  return revisionZeroPackageName.test(read) ? Option.some(read) : Option.none();
+};
+/**
+ * The listing name in a publishing scope that revision 0 reads as `name`: for `@acme/notes`,
+ * `@acme.executor.community/notes`. None for any other name, which means only itself.
+ */
+export const scopedNameFor = (name: PackageName): Option.Option<PackageName> =>
+  revisionZeroPackageName.test(name)
+    ? Option.some(`@${packageScope(name)}${publishingSuffix}/${packageLabel(name)}`)
+    : Option.none();
+/** Every listing name revision 0 reads as `name`: itself, and its label in its slug's publishing scope. */
+const namesReadAs = (name: PackageName): ReadonlyArray<PackageName> => [
+  name,
+  ...Option.toArray(scopedNameFor(name)),
+];
+const readable = (publication: Publication) =>
+  Option.map(revisionZeroName(publication.name), (name) => ({ ...publication, name }));
+const leftOut = (count: number) =>
+  count > 0
+    ? Effect.annotateCurrentSpan("registry.listings_unreadable_by_client", count)
+    : Effect.void;
+
+/**
+ * The registry's answer for each listing name revision 0 reads as `name`, `name` itself first: the
+ * listings under that exact name, or none when the registry states it has no such listing, as a
+ * remote registry may.
+ */
+const answersFor = (registry: Executor["registry"], name: PackageName) =>
+  Effect.forEach(
+    namesReadAs(name),
+    (candidate) =>
+      registry.list({ name: candidate }).pipe(
+        Effect.map((all) => Option.some(all.filter((listing) => listing.name === candidate))),
+        Effect.catchTag("RegistryError", (error) =>
+          error.reason === "not-found" ? Effect.succeedNone : Effect.fail(error),
+        ),
+      ),
+    { concurrency: "unbounded" },
+  );
+/** The published listings revision 0 reads as `name`, found by their exact names. */
+const publishedAs = (registry: Executor["registry"], name: PackageName) =>
+  Effect.map(answersFor(registry, name), (answers) => Arr.getSomes(answers).flat());
+
+/**
+ * The listings revision 0's `name` selects, all under one published name. None when no listing
+ * reads as it and the registry states it has no listing named `name`, which the client is answered
+ * with as this release's clients are. When two published names read as it, the client cannot have
+ * told them apart, so the request is refused rather than sent to either.
+ */
+const selected = (registry: Executor["registry"], name: PackageName) =>
+  Effect.gen(function* () {
+    const answers = yield* answersFor(registry, name);
+    const found = Arr.getSomes(answers).flat();
+    if (found.length === 0 && Option.isNone(Option.flatten(Arr.head(answers))))
+      return Option.none<ReadonlyArray<Publication>>();
+    const names = Arr.dedupe(found.map((listing) => listing.name));
+    if (names.length > 1) {
+      yield* Effect.annotateCurrentSpan("registry.ambiguous_for_client", true);
+      yield* Effect.logWarning(
+        `Refused ${name} for an Executor release up to 2.0.0-beta.15: the public listings ${names.join(" and ")} both read as that name there.`,
+      );
+      return yield* new RegistryError({ reason: "conflict" });
+    }
+    return Option.some(found);
+  });
+/** The listing name revision 0's `name` selects; unchanged when nothing is published under it. */
+const selectedName = (registry: Executor["registry"], name: PackageName) =>
+  Effect.map(selected(registry, name), (found) =>
+    Option.match(Option.flatMap(found, Arr.head), {
+      onNone: () => name,
+      onSome: (listing) => listing.name,
+    }),
+  );
+
+/**
+ * The listing name a client reading wire `revision` means by `name`, for a request that names the
+ * commit it was shown. Never resolve one for a write that names no commit.
+ */
+export const packageNameFromRevision = (
+  registry: Executor["registry"],
+  revision: number,
+  name: PackageName,
+) => (revision >= 1 ? Effect.succeed(name) : selectedName(registry, name));
+
+/**
+ * One listing for a client reading wire `revision`. The client named it, or its owner published it
+ * under the organization's slug, so its name reads unless another listing reads the same.
+ */
+export const publicationForRevision = (
+  registry: Executor["registry"],
+  revision: number,
+  publication: Publication,
+) =>
+  revision >= 1
+    ? Effect.succeed(publication)
+    : Option.match(readable(publication), {
+        onNone: () => Effect.fail(new RegistryError({ reason: "invalid-response" })),
+        onSome: (listing) => selected(registry, listing.name).pipe(Effect.as(listing)),
+      });
+
+/**
+ * Listings for a client reading wire `revision`. Ones it cannot read, or cannot tell apart from
+ * another published listing, are left out and counted.
+ */
+export const publicationsForRevision = (
+  registry: Executor["registry"],
+  revision: number,
+  all: ReadonlyArray<Publication>,
+) =>
+  revision >= 1
+    ? Effect.succeed(all)
+    : Effect.forEach(all, (publication) =>
+        Option.match(readable(publication), {
+          onNone: () => Effect.succeedNone,
+          onSome: (listing) =>
+            Effect.map(publishedAs(registry, listing.name), (found) =>
+              found.every((other) => other.name === publication.name)
+                ? Option.some(listing)
+                : Option.none(),
+            ),
+        }),
+      ).pipe(
+        Effect.map(Arr.getSomes),
+        Effect.tap((listings) => leftOut(all.length - listings.length)),
+      );
+
+/** The whole catalog for revision 0, without the listings it cannot read or tell apart by name. */
+const revisionZeroCatalog = (all: ReadonlyArray<Publication>) =>
+  Effect.gen(function* () {
+    const named = all.flatMap((publication) => Option.toArray(readable(publication)));
+    const readers = new Map<string, number>();
+    for (const { name } of named) readers.set(name, (readers.get(name) ?? 0) + 1);
+    const listings = named.filter(({ name }) => readers.get(name) === 1);
+    yield* leftOut(all.length - listings.length);
+    return listings;
+  });
+
+/** Readiness for a client reading wire `revision`, or null when it names a package the client cannot read. */
+export const readinessForRevision = (
+  revision: number,
+  readiness: PublicationReadiness | null,
+): PublicationReadiness | null => {
+  if (revision >= 1 || readiness === null) return readiness;
+  const names =
+    readiness.status === "ready"
+      ? [readiness.manifest.name]
+      : readiness.suggestedName === null
+        ? []
+        : [readiness.suggestedName];
+  return names.every((name) => Option.exists(revisionZeroName(name), (read) => read === name))
+    ? readiness
+    : null;
+};
+
+/** Registry reads for a client reading wire `revision`. */
+export const registryForRevision = (
+  registry: Executor["registry"],
+  revision: number,
+): Executor["registry"] =>
+  revision >= 1
+    ? registry
+    : {
+        list: (input = {}) => {
+          const { name } = input;
+          return name === undefined
+            ? registry.list({}).pipe(Effect.flatMap(revisionZeroCatalog))
+            : selected(registry, name).pipe(
+                Effect.flatMap(
+                  Option.match({
+                    onNone: () => Effect.fail(new RegistryError({ reason: "not-found" })),
+                    onSome: (found) =>
+                      Effect.succeed(found.map((listing) => ({ ...listing, name }))),
+                  }),
+                ),
+              );
+        },
+        snapshot: (input) =>
+          selectedName(registry, input.name).pipe(
+            Effect.flatMap((name) => registry.snapshot({ ...input, name })),
+            Effect.map((snapshot) => ({
+              ...snapshot,
+              publication: { ...snapshot.publication, name: input.name },
+            })),
+          ),
+        file: (input) =>
+          selectedName(registry, input.name).pipe(
+            Effect.flatMap((name) => registry.file({ ...input, name })),
+          ),
+      };
diff --git a/packages/sdk/src/implementation/worker-workflow-rpc.ts b/packages/sdk/src/implementation/worker-workflow-rpc.ts
index e977f1c5d5..ff0864651d 100644
--- a/packages/sdk/src/implementation/worker-workflow-rpc.ts
+++ b/packages/sdk/src/implementation/worker-workflow-rpc.ts
@@ -1,10 +1,12 @@
 /** Invocation-owned RPC capabilities preserve the Effect context across Dynamic Worker calls. */
-import { Cause, Effect, Redacted, Schema } from "effect";
+import { Cause, Effect, Redacted, Schema, SchemaIssue } from "effect";
 import {
   WorkflowFailure,
   WorkflowRpcCommand,
   WorkflowRpcResult,
   WorkflowControlCommand,
+  WorkflowRun,
+  WorkflowRunPage,
   type WorkflowExecution,
   type WorkflowHostControls,
   type WorkflowRpc,
@@ -84,26 +86,68 @@ export const invocationWorkflow = (
         { signal },
       );
   });
-/** App-scoped lifecycle management uses the same private callback transport as step execution. */
+const issues = SchemaIssue.makeFormatterStandardSchemaV1();
+const controlOperations = ["start", "get", "list", "terminate"] as const;
+/**
+ * A control call the host refused before it reached the engine. Names each invalid field and the
+ * rule it broke; the messages describe the schema, not the value.
+ */
+const invalidControl = (input: unknown, error: Schema.SchemaError) => {
+  const operation =
+    typeof input === "object" && input !== null && "operation" in input
+      ? controlOperations.find((name) => name === input.operation)
+      : undefined;
+  const fields = issues(error.issue)
+    .issues.slice(0, 4)
+    .map(({ path, message }) => {
+      const field = (path ?? []).map(String).join(".");
+      return `${field === "" ? "input" : field}: ${message.slice(0, 200)}`;
+    });
+  return new WorkflowFailure({
+    reason: "input",
+    retryable: false,
+    message: `${operation === undefined ? "The workflow call" : `ctx.workflows.${operation}`} was refused before Executor started or changed any run. ${fields.join("; ")}.`,
+  });
+};
+/**
+ * App-scoped lifecycle management uses the same private callback transport as step execution.
+ * Runs are sent in their encoded form, so apps built before a field's rename read its former name.
+ */
 export const invocationWorkflowControls = (controls: WorkflowHostControls, signal: AbortSignal) =>
   Effect.gen(function* () {
     const services = yield* Effect.context<never>();
+    const run = Schema.encodeEffect(WorkflowRun);
     return (input: unknown): Promise<unknown> =>
       Effect.runPromiseWith(services)(
         reply(
           Effect.gen(function* () {
-            const command = yield* Schema.decodeUnknownEffect(WorkflowControlCommand)(input);
+            const command = yield* Schema.decodeUnknownEffect(WorkflowControlCommand)(input).pipe(
+              Effect.mapError((error) => invalidControl(input, error)),
+            );
+            yield* Effect.annotateCurrentSpan("executor.workflow.operation", command.operation);
             switch (command.operation) {
               case "start":
-                return yield* controls.start(command);
+                return yield* controls.start(command).pipe(Effect.flatMap(run));
               case "get":
-                return yield* controls.get(command);
+                return yield* controls.get(command).pipe(Effect.flatMap(run));
               case "list":
-                return yield* controls.list(command);
+                return yield* controls
+                  .list(command)
+                  .pipe(Effect.flatMap(Schema.encodeEffect(WorkflowRunPage)));
               case "terminate":
-                return yield* controls.terminate(command);
+                return yield* controls.terminate(command).pipe(Effect.flatMap(run));
             }
-          }),
+          }).pipe(
+            Effect.tapError((error) =>
+              Schema.is(WorkflowFailure)(error)
+                ? Effect.annotateCurrentSpan({
+                    "executor.workflow.failure.reason": error.reason,
+                    "executor.workflow.failure.retryable": error.retryable,
+                  })
+                : Effect.void,
+            ),
+            Effect.withSpan("workflow.control"),
+          ),
         ),
         { signal },
       );
diff --git a/packages/sdk/src/implementation/workerd-apps.ts b/packages/sdk/src/implementation/workerd-apps.ts
index 6f1b617399..f7b531f258 100644
--- a/packages/sdk/src/implementation/workerd-apps.ts
+++ b/packages/sdk/src/implementation/workerd-apps.ts
@@ -220,7 +220,7 @@ export const workerdApps = (options: {
         name: "executor-apps",
         compatibilityDate: "2026-07-30",
         // The trusted host worker keeps the default network. Only app isolates are restricted.
-        compatibilityFlags: ["nodejs_compat"],
+        compatibilityFlags: ["nodejs_compat", "no_brotli_content_encoding"],
         modules: yield* workerdHostModules,
         durableObjectNamespaces: [
           { className: "AppDataSupervisor", sql: true, uniqueKey: "executor-app-data" },
diff --git a/packages/sdk/src/implementation/workerd-client.ts b/packages/sdk/src/implementation/workerd-client.ts
index 97ed21ffeb..40066e7827 100644
--- a/packages/sdk/src/implementation/workerd-client.ts
+++ b/packages/sdk/src/implementation/workerd-client.ts
@@ -34,7 +34,7 @@ import type { Executor } from "../contracts/executor.ts";
 import { runtimeAdapter } from "./runtime.ts";
 import { appRuntime, buildLoadSpan } from "./app-runtime.ts";
 import { appWorker } from "./app-runner.ts";
-import { encodeLoadedBuild } from "./remote-app-runner.ts";
+import { encodeLoadedBuild, runnerResult } from "./remote-app-runner.ts";
 import { invocationWorkflowControls } from "./worker-workflow-rpc.ts";
 import { loadWorkerBuild, retainWorkerBuild, workerBuildAsset } from "./worker-build-storage.ts";
 import { ownsDatabase } from "../contracts/apps.ts";
@@ -118,6 +118,7 @@ export const workerdHostHandler = (options: {
             const worker = yield* appWorker({
               app: seed.app,
               build: seed.build,
+              ...(seed.hostApi === undefined ? {} : { hostApi: seed.hostApi }),
               database: false,
               command: { operation: "workflow-run", name: seed.name, input: seed.input },
               accounts: Redacted.value(context.accounts),
@@ -246,13 +247,12 @@ export const connectedWorkerdApps = (blobs: BlobStorage, transport: WorkerdTrans
             async () => encodeLoadedBuild(await capabilities.load()),
           );
           return yield* rpc((api) =>
-            Effect.tryPromise({
-              try: async () =>
-                Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Json))(
-                  await api.invoke(encoded, callbacks),
-                ),
-              catch: protocolFailure,
-            }),
+            runnerResult(
+              Effect.tryPromise({
+                try: () => api.invoke(encoded, callbacks),
+                catch: (cause) => cause,
+              }),
+            ),
           );
         }),
       build: ({ files, public: publicPaths, retain = true }) =>
diff --git a/packages/sdk/src/implementation/workerd-entry.ts b/packages/sdk/src/implementation/workerd-entry.ts
index 14f5b443de..2e9725312a 100644
--- a/packages/sdk/src/implementation/workerd-entry.ts
+++ b/packages/sdk/src/implementation/workerd-entry.ts
@@ -34,6 +34,7 @@ import {
 } from "@executor-js/app-data/cloudflare";
 import { EvaluatedCommandJson, EvaluatedReplyJson } from "@executor-js/app-data/evaluated";
 import { makeAppRunner } from "./app-runner.ts";
+import { runnerReply } from "./remote-app-runner.ts";
 import { credentialFetch, credentialKey } from "./credential-handles.ts";
 import {
   defaultAppWorkerLimit,
@@ -53,6 +54,7 @@ import {
   type WorkflowHostCommand,
 } from "../contracts/workerd-host.ts";
 import { LoadedWorkerBuild } from "../contracts/worker-build.ts";
+import { HostApiCheck } from "../contracts/host-api.ts";
 import {
   describeBuildCause,
   RuntimeAppsDependencyMissing,
@@ -143,7 +145,10 @@ const failure = () => new WorkflowFailure({ reason: "engine", retryable: true })
 const buildFailed = (stage: RuntimeBuildFailed["stage"], cause: unknown) =>
   new RuntimeBuildFailed({ stage, message: describeBuildCause(cause) });
 /** What the runner binds to one app's outbound network. App code cannot set it. */
-const OutboundProps = Schema.Struct({ app: Schema.NonEmptyString });
+const OutboundProps = Schema.Struct({
+  app: Schema.NonEmptyString,
+  hostApi: Schema.optionalKey(HostApiCheck),
+});
 type OutboundProps = typeof OutboundProps.Type;
 /** Handles are sealed with a key derived from the secret only this host and its runner share. */
 const credentials = (env: Environment) => credentialKey(env.CREDENTIAL_SECRET);
@@ -161,8 +166,10 @@ const credentials = (env: Environment) => credentialKey(env.CREDENTIAL_SECRET);
 export class AppOutbound extends WorkerEntrypoint<Environment> {
   async fetch(request: Request): Promise<Response> {
     const self = this.env.SELF === undefined ? undefined : URL.parse(this.env.SELF_ORIGIN)?.origin;
+    const props = Schema.decodeUnknownSync(OutboundProps)(this.ctx.props);
     return credentialFetch(request, {
-      app: Schema.decodeUnknownSync(OutboundProps)(this.ctx.props).app,
+      app: props.app,
+      ...(props.hostApi === undefined ? {} : { hostApi: props.hostApi }),
       key: await Effect.runPromise(credentials(this.env)),
       // Refuse a private destination by name, before the public-only network refuses its
       // address with an error app code cannot tell apart from any other connection failure.
@@ -182,8 +189,10 @@ const OutboundExports = Schema.Struct({
 /** The loopback binding to `AppOutbound` that workerd supplies on every context's exports. */
 const appOutbound =
   (context: { readonly exports: unknown }) =>
-  (app: string): Fetcher =>
-    Schema.decodeUnknownSync(OutboundExports)(context.exports).AppOutbound({ props: { app } });
+  (app: string, hostApi: HostApiCheck | undefined): Fetcher =>
+    Schema.decodeUnknownSync(OutboundExports)(context.exports).AppOutbound({
+      props: hostApi === undefined ? { app } : { app, hostApi },
+    });
 const rpcOptions = { onSendError: () => new Error("App runtime request failed") };
 const json = Schema.decodeUnknownSync(Schema.Json);
 const hostRequest = (env: Environment, command: WorkflowHostCommand) =>
@@ -341,28 +350,30 @@ class AppApi extends RpcTarget {
   }
   async invoke(value: string, callbacks: RpcStub<AppHostCallbacks>): Promise<string> {
     return this.#run(
-      Schema.decodeUnknownEffect(Schema.fromJsonString(WorkerInvocation))(value).pipe(
-        Effect.flatMap(({ elicitation, workflowControls, ...invocation }) =>
-          runner(this.#env, this.#context).invoke(invocation, {
-            load: async () =>
-              Schema.decodeUnknownSync(Schema.fromJsonString(LoadedWorkerBuild))(
-                await callbacks.load(),
-              ),
-            elicit: elicitation
-              ? async (input) =>
-                  Schema.decodeUnknownSync(encodedJson)(
-                    await callbacks.elicit(JSON.stringify(input)),
-                  )
-              : null,
-            controls: workflowControls
-              ? async (input) =>
-                  Schema.decodeUnknownSync(encodedJson)(
-                    await callbacks.control(JSON.stringify(input)),
-                  )
-              : null,
-          }),
+      runnerReply(
+        Schema.decodeUnknownEffect(Schema.fromJsonString(WorkerInvocation))(value).pipe(
+          Effect.flatMap(({ elicitation, workflowControls, ...invocation }) =>
+            runner(this.#env, this.#context).invoke(invocation, {
+              load: async () =>
+                Schema.decodeUnknownSync(Schema.fromJsonString(LoadedWorkerBuild))(
+                  await callbacks.load(),
+                ),
+              elicit: elicitation
+                ? async (input) =>
+                    Schema.decodeUnknownSync(encodedJson)(
+                      await callbacks.elicit(JSON.stringify(input)),
+                    )
+                : null,
+              controls: workflowControls
+                ? async (input) =>
+                    Schema.decodeUnknownSync(encodedJson)(
+                      await callbacks.control(JSON.stringify(input)),
+                    )
+                : null,
+            }),
+          ),
+          Effect.map((value) => ({ value })),
         ),
-        Effect.flatMap(Schema.encodeUnknownEffect(encodedJson)),
       ),
     );
   }
@@ -538,6 +549,7 @@ export class AppWorkflows extends WorkflowEntrypoint<Environment, { run: string
               {
                 app: seed.app,
                 build: seed.build,
+                ...(seed.hostApi === undefined ? {} : { hostApi: seed.hostApi }),
                 database: false,
                 accounts,
                 command: { operation: "workflow-run", name: seed.name, input: seed.input },
diff --git a/packages/sdk/src/implementation/workflows.ts b/packages/sdk/src/implementation/workflows.ts
index 7b4897ae86..7d9a5c9fb4 100644
--- a/packages/sdk/src/implementation/workflows.ts
+++ b/packages/sdk/src/implementation/workflows.ts
@@ -1,8 +1,9 @@
 import { systemCaller } from "./caller.ts";
 import { CurrentActor, CurrentCaller } from "../contracts/executor.ts";
 /** Retained run identities pin code/accounts; the backend owns timers and checkpoint execution. */
-import { Cause, Clock, Effect, Redacted, Result, Schema, type Crypto } from "effect";
+import { Cause, Clock, Effect, Exit, Redacted, Result, Schema, type Crypto } from "effect";
 import { Hex } from "effect/encoding";
+import { UserFacingError } from "@executor-js/utils/user-facing-error";
 import {
   HostedWorkflow,
   WorkflowFailure,
@@ -11,6 +12,7 @@ import {
   WorkflowRunFailure,
   WorkflowRunPage,
   WorkflowValue,
+  maxFailureMessageLength,
   type WorkflowHostControls,
 } from "apps/contracts";
 import { workflowFailureDetail } from "../contracts/workflow-errors.ts";
@@ -67,6 +69,28 @@ const terminal = (row: typeof StoredRun.Type) =>
 const unavailable = () => new WorkflowFailure({ reason: "unavailable", retryable: false });
 const failure = (reason: WorkflowFailure["reason"], retryable = false) =>
   new WorkflowFailure({ reason, retryable });
+/** Only the caller's own key finds a start's run again; a start without one makes a new run. */
+const repeatStart = (key: string | undefined) =>
+  key === undefined
+    ? "This start had no key, so starting again creates another run."
+    : "Starting again with the same key and input returns this run.";
+/** A start whose run is saved, but whose state Executor could not read back. */
+const unconfirmedStart = (run: string, key: string | undefined) =>
+  new WorkflowFailure({
+    reason: "engine",
+    retryable: false,
+    message: `Run ${run} exists for this start, but Executor could not read it back, so its state is unknown. Get the run by its ID before starting another. ${repeatStart(key)}`,
+  });
+/** A start whose save may have committed, which Executor could not read back to confirm. */
+const unknownStart = (key: string | undefined) =>
+  new WorkflowFailure({
+    reason: "engine",
+    retryable: false,
+    message:
+      key === undefined
+        ? "Executor could not confirm whether this start saved its run, so the run may exist. This start had no key: check ctx.workflows.list before starting again, because another start creates another run."
+        : "Executor could not confirm whether this start saved its run, so the run may exist. Starting again with the same key and input returns the run if it was saved.",
+  });
 const stable = (value: Json): string => {
   if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
   if (value !== null && typeof value === "object")
@@ -219,6 +243,7 @@ export const makeWorkflowRuns = (
           )),
           // A run's steps run as the host's workflow, for the person it started for, if any.
           ...callerContext(state),
+          hostApi: declarations.hostApi(state.version),
           database: ownsDatabase(state.version.requirements),
           sharedRuntime: sharesRuntime(state.version.requirements),
           workflowControls: controls(state),
@@ -241,10 +266,12 @@ export const makeWorkflowRuns = (
               set: { status: "running" },
             }),
           );
+        const hostApi = declarations.hostApi(state.version);
         return {
           runId: run,
           app: row.app,
           build: state.version.build,
+          ...(hostApi === undefined ? {} : { hostApi }),
           version: row.version,
           name: row.name,
           input: payload.input,
@@ -460,6 +487,7 @@ export const makeWorkflowRuns = (
               app: input.app,
               build: state.version.build,
               sharedRuntime: sharesRuntime(state.version.requirements),
+              hostApi: declarations.hostApi(state.version),
               ...bound,
               command: { operation: "workflow-validate", name: input.workflow, input: input.input },
             })
@@ -478,7 +506,10 @@ export const makeWorkflowRuns = (
           Redacted.make({ input: parsed, request: input.input }),
         );
         const createdAt = new Date(yield* Clock.currentTimeMillis);
-        const saved = yield* transaction(db, () =>
+        // Set once every statement has run. A failure after it comes from the commit, which may
+        // have applied even though its answer was an error or never arrived.
+        let committing = false;
+        const settled = yield* transaction(db, () =>
           Effect.gen(function* () {
             yield* query(() =>
               db.updateMany("apps", {
@@ -522,24 +553,74 @@ export const makeWorkflowRuns = (
               yield* query(() =>
                 db.create("workflowAccounts", { id: `${id}:${account}`, run: id, account }),
               );
+            committing = true;
           }),
-        ).pipe(Effect.result);
-        row = yield* find();
-        if (row === null) {
-          if (Result.isFailure(saved)) return yield* saved.failure;
-          return yield* new StorageError();
+        ).pipe(Effect.exit);
+        // The SQL client reports a failed commit as a defect, so the whole cause is settled here.
+        // Cancellation, and a defect before the commit, end the start as they would anywhere.
+        if (
+          Exit.isFailure(settled) &&
+          (Cause.hasInterrupts(settled.cause) || (!committing && !Cause.hasFails(settled.cause)))
+        )
+          return yield* Effect.failCause(settled.cause);
+        // Run `id` is saved, and a saved queued run is dispatched later even if this call stops.
+        if (Exit.isSuccess(settled)) yield* Effect.annotateCurrentSpan("executor.run.id", id);
+        // Only a read decides what the start saved: a failed transaction may still have committed,
+        // or lost a race to a start with the same key.
+        const found = yield* find().pipe(
+          Effect.result,
+          Effect.withSpan("workflow.start.read-back"),
+        );
+        if (Exit.isSuccess(settled)) {
+          if (Result.isFailure(found) || found.success === null)
+            return yield* unconfirmedStart(id, input.key);
+          row = found.success;
+        } else if (committing) {
+          // A commit that failed or timed out may still have applied. Not finding the run proves
+          // nothing either: the commit may land after this read.
+          if (Result.isFailure(found) || found.success === null)
+            return yield* unknownStart(input.key);
+          row = found.success;
+        } else {
+          // A failure before the commit rolled the transaction back.
+          const error = Cause.findError(settled.cause);
+          if (Result.isFailure(error)) return yield* Effect.failCause(settled.cause);
+          if (Result.isFailure(found))
+            return yield* Schema.is(WorkflowFailure)(error.success)
+              ? error.success
+              : unknownStart(input.key);
+          if (found.success === null) return yield* error.success;
+          row = found.success;
         }
       }
-      const retained = yield* Schema.decodeUnknownEffect(StoredRun)(row).pipe(
-        Effect.mapError(() => new StorageError()),
+      const saved = row;
+      return yield* Effect.gen(function* () {
+        const retained = yield* Schema.decodeUnknownEffect(StoredRun)(saved).pipe(
+          Effect.mapError(() => new StorageError()),
+        );
+        const payload = yield* decrypt(retained);
+        if (retained.name !== input.workflow || stable(payload.request) !== stable(input.input))
+          return yield* failure("conflict");
+        yield* Effect.annotateCurrentSpan("executor.run.id", retained.id);
+        if (!terminal(retained)) yield* dispatch(backend, retained.id);
+        return yield* view(yield* read(retained.id));
+      }).pipe(
+        // The run is saved, and a saved queued run is dispatched later even if this call stops, so
+        // a failure from here on must not read as a start that did not happen.
+        Effect.catchIf(
+          (error) => !(Schema.is(WorkflowFailure)(error) && error.reason === "conflict"),
+          () => Effect.fail(unconfirmedStart(String(saved.id), input.key)),
+        ),
       );
-      const payload = yield* decrypt(retained);
-      if (retained.name !== input.workflow || stable(payload.request) !== stable(input.input))
-        return yield* failure("conflict");
-      yield* Effect.annotateCurrentSpan("executor.run.id", retained.id);
-      if (!terminal(retained)) yield* dispatch(backend, retained.id);
-      return yield* view(yield* read(retained.id));
-    }).pipe(Effect.withSpan("workflow.start", { attributes: { "executor.app.id": input.app } }));
+    }).pipe(
+      Effect.tapError((error) =>
+        Effect.annotateCurrentSpan(
+          "executor.workflow.failure.reason",
+          Schema.is(WorkflowFailure)(error) ? error.reason : error._tag,
+        ),
+      ),
+      Effect.withSpan("workflow.start", { attributes: { "executor.app.id": input.app } }),
+    );
   const terminate = (input: typeof WorkflowTarget.Type) =>
     Effect.gen(function* () {
       yield* storedApp(db, { app: input.app });
@@ -607,7 +688,26 @@ export const makeWorkflowRuns = (
       schema: Schema.Decoder<A>,
       input: unknown,
       run: (input: A) => Effect.Effect<B, unknown>,
-    ) => safe(Schema.decodeUnknownEffect(schema)(input).pipe(Effect.flatMap(run)), "execution");
+    ) =>
+      Schema.decodeUnknownEffect(schema)(input).pipe(
+        Effect.flatMap(run),
+        Effect.catchCause((cause) => {
+          if (Cause.hasInterrupts(cause)) return Effect.interrupt;
+          const error = Cause.squash(cause);
+          if (Schema.is(WorkflowFailure)(error)) return Effect.fail(error);
+          // Executor's own errors carry curated text the app's code can act on.
+          return Effect.fail(
+            UserFacingError.is(error)
+              ? new WorkflowFailure({
+                  reason: "execution",
+                  retryable: error.retryable,
+                  errorName: error._tag.slice(0, 128),
+                  message: error.message.slice(0, maxFailureMessageLength),
+                })
+              : failure("execution"),
+          );
+        }),
+      );
     const within = (input: typeof WorkflowTarget.Type) =>
       Effect.gen(function* () {
         const row = yield* read(input.run, input.app);
@@ -651,6 +751,7 @@ export const makeWorkflowRuns = (
               app: input.app,
               build: state.version.build,
               sharedRuntime: sharesRuntime(state.version.requirements),
+              hostApi: declarations.hostApi(state.version),
               ...context,
               command: { operation: "workflows" },
             }),
diff --git a/packages/sdk/src/workerd.ts b/packages/sdk/src/workerd.ts
index edf9768147..24a2177598 100644
--- a/packages/sdk/src/workerd.ts
+++ b/packages/sdk/src/workerd.ts
@@ -37,3 +37,4 @@ export {
   type CredentialOutbound,
 } from "./implementation/credential-handles.ts";
 export { NetworkUnreachable, networkUnreachableResponse } from "./implementation/app-network.ts";
+export { HostApiCheck } from "./contracts/host-api.ts";
diff --git a/packages/telemetry/motel/source.json b/packages/telemetry/motel/source.json
index d004eff366..49b1353826 100644
--- a/packages/telemetry/motel/source.json
+++ b/packages/telemetry/motel/source.json
@@ -1,4 +1,4 @@
 {
   "repository": "https://github.com/UsefulSoftwareCo/motel.git",
-  "revision": "45c0e60cdbe47236c232bb3ac8f3ec9b7ec79e26"
+  "revision": "f9f6d1baf0a09c59f7e9cda438f0c9e1f235a134"
 }
diff --git a/packages/telemetry/package.json b/packages/telemetry/package.json
index d73c9b2206..c77817dd5e 100644
--- a/packages/telemetry/package.json
+++ b/packages/telemetry/package.json
@@ -10,10 +10,12 @@
     "./http": "./src/http.ts",
     "./isolate": "./src/isolate.ts",
     "./local": "./src/local.ts",
+    "./failed-span": "./src/failed-span.ts",
     "./files": "./src/files.ts",
     "./process": "./src/process.ts",
     "./product-analytics": "./src/product-analytics.ts",
     "./recorded-failure": "./src/recorded-failure.ts",
+    "./schema-issue": "./src/schema-issue.ts",
     "./transport": "./src/transport.ts"
   },
   "scripts": {
diff --git a/packages/telemetry/scripts/build-motel.ts b/packages/telemetry/scripts/build-motel.ts
index 6cf600ebd5..d710aced2d 100644
--- a/packages/telemetry/scripts/build-motel.ts
+++ b/packages/telemetry/scripts/build-motel.ts
@@ -7,8 +7,8 @@ import { realpath } from "node:fs";
 import { promisify } from "node:util";
 
 const build = Effect.gen(function* () {
-  if (process.versions.bun !== "1.4.2")
-    return yield* Effect.die(new Error("Build the collector with Bun 1.4.2."));
+  if (process.versions.bun !== "1.4.4")
+    return yield* Effect.die(new Error("Build the collector with Bun 1.4.4."));
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const processes = yield* ChildProcessSpawner.ChildProcessSpawner;
diff --git a/packages/telemetry/src/failed-span.ts b/packages/telemetry/src/failed-span.ts
new file mode 100644
index 0000000000..dda6e7545e
--- /dev/null
+++ b/packages/telemetry/src/failed-span.ts
@@ -0,0 +1,60 @@
+/** A failure that an untraced poll still exports. */
+import { Cause, Effect, Predicate } from "effect";
+
+/** Attributes a failure carries for the span that records it. */
+type FailureAttributes = Readonly<Record<string, string>>;
+
+const attributesKey: unique symbol = Symbol.for("@executor-js/telemetry/FailureAttributes");
+
+/** The attributes `error` carries for the span that records it; none when it carries none. */
+export const failureAttributes = (error: unknown): FailureAttributes =>
+  Predicate.hasProperty(error, attributesKey) ? (error[attributesKey] as FailureAttributes) : {};
+
+/**
+ * Give `error` attributes for the span that records it, such as which statement failed when the
+ * error that reaches the poll no longer says. Attributes it already carries are kept. Use fixed
+ * names only: an operation, a table, a failure kind. Never a value a caller, a row or a driver's
+ * message supplied. The error's fields and wire encoding are unchanged.
+ */
+export const withFailureAttributes = <E>(error: E, attributes: FailureAttributes): E => {
+  if (typeof error === "object" && error !== null)
+    Object.defineProperty(error, attributesKey, {
+      value: { ...attributes, ...failureAttributes(error) },
+      configurable: true,
+    });
+  return error;
+};
+
+/** The attributes the failure in `cause` carries, if it is not only an interruption. */
+const attributesOf = (cause: Cause.Cause<unknown>) => {
+  const reason = cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+  return reason === undefined
+    ? {}
+    : failureAttributes(Cause.isFailReason(reason) ? reason.error : reason.defect);
+};
+
+/**
+ * Export a failure of `self` as a span named `name`, even where tracing is off. The span records
+ * the failure as any traced operation does, with the attributes its error carries. Inside a traced
+ * operation it is a child; inside an untraced poll it is a root. A success, or an interruption
+ * alone, records nothing.
+ */
+export const traceFailure = (name: string) => {
+  // The span is located where this is applied, as `Effect.withSpan` locates its own.
+  const limit = Error.stackTraceLimit;
+  Error.stackTraceLimit = 2;
+  const site = new Error();
+  Error.stackTraceLimit = limit;
+  const captureStackTrace = () => site.stack?.split("\n")[2]?.trim();
+  return <A, E, R>(self: Effect.Effect<A, E, R>) =>
+    self.pipe(
+      Effect.catchCause((cause) =>
+        Cause.hasInterruptsOnly(cause)
+          ? Effect.failCause(cause)
+          : Effect.failCause(cause).pipe(
+              Effect.withSpan(name, { attributes: attributesOf(cause) }, { captureStackTrace }),
+              Effect.withTracerEnabled(true),
+            ),
+      ),
+    );
+};
diff --git a/packages/telemetry/src/http.ts b/packages/telemetry/src/http.ts
index 59b782f231..6e2bf83d4d 100644
--- a/packages/telemetry/src/http.ts
+++ b/packages/telemetry/src/http.ts
@@ -8,7 +8,11 @@ import {
 } from "effect/http";
 import { forwardTelemetry } from "./relay.ts";
 import { recordResponseReady } from "./measurements.ts";
-export { isRequestRejection, recordRequestRejections } from "./request-rejection.ts";
+export {
+  isRequestRejection,
+  recordRequestRejection,
+  recordRequestRejections,
+} from "./request-rejection.ts";
 
 /**
  * Expose handler-to-response timing and correlation IDs to the caller.
diff --git a/packages/telemetry/src/local.ts b/packages/telemetry/src/local.ts
index d22947d51c..43905bfc46 100644
--- a/packages/telemetry/src/local.ts
+++ b/packages/telemetry/src/local.ts
@@ -1,5 +1,5 @@
 /** Local composition owns persistent files and its optional bundled collector. */
-import { Config, Effect, Layer, Logger, Path } from "effect";
+import { Config, Deferred, Effect, Layer, Logger, Path, Scope } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
 import { CurrentTelemetryClient } from "./transport.ts";
 import { telemetryConfig } from "./config.ts";
@@ -8,17 +8,35 @@ import { rotatingJsonLogger } from "./files.ts";
 import { telemetryLayer } from "./layer.ts";
 import { startProcessMetrics } from "./process.ts";
 
+/** How one local host keeps its diagnostics. */
+export interface LocalTelemetryOptions {
+  /** Also write each log line to stderr; on by default. A background server's has no reader. */
+  readonly stderr?: boolean | undefined;
+  /**
+   * Start the bundled collector in the scope this yields, once it yields one. A host that can lose
+   * the race for its data directory yields the scope that holds the directory, so a collector runs
+   * only while its host owns that data. Logs reach the JSONL file from the start; exports wait for
+   * the collector as they do while it starts.
+   */
+  readonly collectorScope?: Effect.Effect<Scope.Scope> | undefined;
+}
+
 /** Local hosts keep JSONL logs; absent explicit exporters, they own a loopback Motel workerd. */
-export const localTelemetry = (directory: string, service: string) =>
+export const localTelemetry = (
+  directory: string,
+  service: string,
+  options: LocalTelemetryOptions = {},
+) =>
   Layer.unwrap(
     Effect.gen(function* () {
       const path = yield* Path.Path;
       const diagnostics = path.resolve(directory, "diagnostics");
       const { logger: file } = yield* rotatingJsonLogger(diagnostics, service);
-      const stderr = Logger.withConsoleError(Logger.formatJson);
-      const logger = Logger.make((options) => {
-        stderr.log(options);
-        file.log(options);
+      const stderr =
+        options.stderr === false ? undefined : Logger.withConsoleError(Logger.formatJson);
+      const logger = Logger.make((log) => {
+        stderr?.log(log);
+        file.log(log);
       });
       const telemetry = yield* Effect.gen(function* () {
         const config = yield* telemetryConfig(service);
@@ -28,7 +46,19 @@ export const localTelemetry = (directory: string, service: string) =>
         const bundle = yield* Config.String("EXECUTOR_MOTEL_BUNDLE").pipe(
           Config.withDefault(defaultBundle),
         );
-        const ready = yield* startCollector(diagnostics, bundle);
+        const ready = yield* Deferred.make<string>();
+        const start = startCollector(diagnostics, bundle).pipe(
+          Effect.flatMap((address) => Deferred.completeWith(ready, address)),
+        );
+        if (options.collectorScope === undefined) yield* start;
+        else
+          yield* options.collectorScope.pipe(
+            Effect.flatMap((scope) => start.pipe(Scope.provide(scope))),
+            Effect.catchCause((cause) =>
+              Effect.logWarning("Local telemetry collector failed", cause),
+            ),
+            Effect.forkScoped,
+          );
         const client = yield* HttpClient.HttpClient.pipe(Effect.provide(FetchHttpClient.layer));
         // This internal address never reaches the network. Resolve only telemetry
         // requests after readiness; native exporter buffers/timeouts own delivery.
@@ -36,7 +66,7 @@ export const localTelemetry = (directory: string, service: string) =>
         const transport = client.pipe(
           HttpClient.mapRequestEffect((request) => {
             if (new URL(request.url).origin !== origin) return Effect.succeed(request);
-            return ready.pipe(
+            return Deferred.await(ready).pipe(
               Effect.timeout("3 seconds"),
               Effect.map((url) =>
                 HttpClientRequest.setUrl(request, new URL(new URL(request.url).pathname, url)),
diff --git a/packages/telemetry/src/relay.ts b/packages/telemetry/src/relay.ts
index 2800ff053d..7efd0b9265 100644
--- a/packages/telemetry/src/relay.ts
+++ b/packages/telemetry/src/relay.ts
@@ -282,71 +282,79 @@ const exportForwards = (
     const client = retryTelemetryExport(yield* HttpClient.HttpClient);
     const dropped = forwards.reduce((total, { batch }) => total + batch.dropped, 0);
     if (dropped > 0) yield* recordExportFailure("app", "capacity", dropped);
-    for (const signal of ["traces", "logs"] as const) {
-      const target = config[signal];
-      const sending = forwards.filter(({ batch }) => batch[signal].length > 0);
-      if (target === undefined || sending.length === 0) continue;
-      // The isolate return channel is already bounded to four 256 KiB envelopes.
-      // Send each signal once instead of serializing four network acknowledgements
-      // inside the same three-second drain budget.
-      const data =
-        signal === "traces"
-          ? {
-              resourceSpans: yield* Effect.forEach(sending, ({ batch, traceId, source }) =>
-                Effect.forEach(batch.traces, (body) =>
-                  Schema.decodeUnknownEffect(TracePayload)(body),
-                ).pipe(
-                  Effect.map((payloads) => ({
-                    resource: resource(source),
-                    scopeSpans: [
-                      {
-                        scope: { name: service },
-                        spans: payloads
-                          .flatMap((payload) => payload.resourceSpans)
-                          .flatMap((r) => r.scopeSpans.flatMap((s) => s.spans))
-                          .filter((span) => traceId === undefined || span.traceId === traceId)
-                          // An app isolate's records are rebuilt from the host's vocabulary.
-                          .flatMap((span) => {
-                            if (service !== "executor-app") return [span];
-                            const kept = appSpan(span);
-                            return kept === undefined ? [] : [kept];
-                          }),
-                      },
-                    ],
-                  })),
+    const send = (signal: "traces" | "logs") =>
+      Effect.gen(function* () {
+        const target = config[signal];
+        const sending = forwards.filter(({ batch }) => batch[signal].length > 0);
+        if (target === undefined || sending.length === 0) return;
+        // The isolate return channel is already bounded to four 256 KiB envelopes.
+        // Send each signal once instead of serializing four network acknowledgements
+        // inside the same three-second drain budget; the two signals go out at once.
+        const data =
+          signal === "traces"
+            ? {
+                resourceSpans: yield* Effect.forEach(sending, ({ batch, traceId, source }) =>
+                  Effect.forEach(batch.traces, (body) =>
+                    Schema.decodeUnknownEffect(TracePayload)(body),
+                  ).pipe(
+                    Effect.map((payloads) => ({
+                      resource: resource(source),
+                      scopeSpans: [
+                        {
+                          scope: { name: service },
+                          spans: payloads
+                            .flatMap((payload) => payload.resourceSpans)
+                            .flatMap((r) => r.scopeSpans.flatMap((s) => s.spans))
+                            .filter((span) => traceId === undefined || span.traceId === traceId)
+                            // An app isolate's records are rebuilt from the host's vocabulary.
+                            .flatMap((span) => {
+                              if (service !== "executor-app") return [span];
+                              const kept = appSpan(span);
+                              return kept === undefined ? [] : [kept];
+                            }),
+                        },
+                      ],
+                    })),
+                  ),
                 ),
-              ),
-            }
-          : {
-              resourceLogs: yield* Effect.forEach(sending, ({ batch, traceId, source }) =>
-                Effect.forEach(batch.logs, (body) =>
-                  Schema.decodeUnknownEffect(LogPayload)(body),
-                ).pipe(
-                  Effect.map((payloads) => ({
-                    resource: resource(source),
-                    scopeLogs: [
-                      {
-                        scope: { name: service },
-                        logRecords: payloads
-                          .flatMap((payload) => payload.resourceLogs)
-                          .flatMap((r) => r.scopeLogs.flatMap((s) => s.logRecords))
-                          .filter((log) => traceId === undefined || log.traceId === traceId)
-                          .map((log) => (service === "executor-app" ? appLog(log) : log)),
-                      },
-                    ],
-                  })),
+              }
+            : {
+                resourceLogs: yield* Effect.forEach(sending, ({ batch, traceId, source }) =>
+                  Effect.forEach(batch.logs, (body) =>
+                    Schema.decodeUnknownEffect(LogPayload)(body),
+                  ).pipe(
+                    Effect.map((payloads) => ({
+                      resource: resource(source),
+                      scopeLogs: [
+                        {
+                          scope: { name: service },
+                          logRecords: payloads
+                            .flatMap((payload) => payload.resourceLogs)
+                            .flatMap((r) => r.scopeLogs.flatMap((s) => s.logRecords))
+                            .filter((log) => traceId === undefined || log.traceId === traceId)
+                            .map((log) => (service === "executor-app" ? appLog(log) : log)),
+                        },
+                      ],
+                    })),
+                  ),
                 ),
-              ),
-            };
-      yield* client.execute(
-        HttpClientRequest.post(target.url).pipe(
-          HttpClientRequest.setHeaders(
-            target.headers === undefined ? {} : Redacted.value(target.headers),
+              };
+        yield* client.execute(
+          HttpClientRequest.post(target.url).pipe(
+            HttpClientRequest.setHeaders(
+              target.headers === undefined ? {} : Redacted.value(target.headers),
+            ),
+            HttpClientRequest.bodyJsonUnsafe(data),
           ),
-          HttpClientRequest.bodyJsonUnsafe(data),
-        ),
-      );
-    }
+        );
+      });
+    // Each signal is sent even when the other fails; the first failure in order is reported.
+    const sent = yield* Effect.forEach(
+      ["traces", "logs"] as const,
+      (signal) => Effect.result(send(signal)),
+      { concurrency: "unbounded" },
+    );
+    yield* Effect.forEach(sent, (result) => Effect.fromResult(result), { discard: true });
   }).pipe(
     Effect.provide(telemetryHttpClient),
     Effect.provideService(Tracer.DisablePropagation, true),
diff --git a/packages/telemetry/src/request-rejection.ts b/packages/telemetry/src/request-rejection.ts
index 35f9ba4652..b6c6d11b30 100644
--- a/packages/telemetry/src/request-rejection.ts
+++ b/packages/telemetry/src/request-rejection.ts
@@ -1,10 +1,12 @@
 /**
- * Request decoding rejections are client errors. Effect's HTTP API answers them
- * with an empty 400 before any handler runs, so the request span is the only
- * place that can record why. Incident reporting skips them.
+ * Request decoding rejections are client errors, rejected before any handler runs. Product APIs
+ * answer them with `RequestInvalid` through their `RequestRejection` middleware, which records
+ * them here; other endpoints answer an empty 400, and this reporter records why on the request
+ * span. Incident reporting skips them.
  */
-import { Context, Effect, ErrorReporter, Option, type SchemaIssue, Tracer } from "effect";
+import { Context, Effect, ErrorReporter, Option, Tracer } from "effect";
 import { HttpApiError } from "effect/http-api";
+import { issueSummary } from "./schema-issue.ts";
 
 /** Request parts the caller supplies. Response encoding failures (Body, ResponseHeaders) are server faults. */
 const requestKinds: ReadonlySet<HttpApiError.HttpApiSchemaError["kind"]> = new Set([
@@ -19,29 +21,27 @@ export const isRequestRejection = (error: unknown): error is HttpApiError.HttpAp
   HttpApiError.HttpApiSchemaError.is(error) && requestKinds.has(error.kind);
 
 const maxIssues = 10;
-const segment = (key: PropertyKey) =>
-  typeof key === "number" ? `[${key}]` : `.${String(key).slice(0, 64)}`;
-
-/** Issue locations and categories only. Values, messages and annotations can echo request content. */
-const issueSummary = (issue: SchemaIssue.Issue, path: string): ReadonlyArray<string> => {
-  switch (issue._tag) {
-    case "Pointer":
-      return issueSummary(issue.issue, path + issue.path.map(segment).join(""));
-    case "Encoding":
-      return issueSummary(issue.issue, path);
-    case "Composite":
-      return issue.issues.flatMap((inner) => issueSummary(inner, path));
-    // A union lists why each member rejected the value.
-    case "AnyOf":
-      return issue.issues.length === 0
-        ? [`${path}: AnyOf`]
-        : issue.issues.flatMap((inner) => issueSummary(inner, path));
-    default:
-      return [`${path}: ${issue._tag}`];
-  }
+/** Record a rejection on the span that owns the rejected request. */
+const record = (error: HttpApiError.HttpApiSchemaError, context: Context.Context<never>) => {
+  const span = Context.getOption(context, Tracer.ParentSpan);
+  if (Option.isNone(span) || span.value._tag !== "Span") return;
+  // Union members can repeat the same finding.
+  const issues = [...new Set(issueSummary(error.cause.issue, "$"))];
+  span.value.attribute("error.type", "HttpApiSchemaError");
+  span.value.attribute("executor.request.rejection.kind", error.kind);
+  span.value.attribute(
+    "executor.request.rejection.issues",
+    [
+      ...issues.slice(0, maxIssues),
+      ...(issues.length > maxIssues ? [`+${issues.length - maxIssues} more`] : []),
+    ].join(", "),
+  );
 };
 
-/** Record the rejection on the span that owns the rejected request. */
+/** Record a request rejection on the current request's span, for code that answers it itself. */
+export const recordRequestRejection = (error: HttpApiError.HttpApiSchemaError) =>
+  Effect.withFiber((fiber) => Effect.sync(() => record(error, fiber.context)));
+
 const recorder: ErrorReporter.ErrorReporter = {
   [ErrorReporter.TypeId]: ErrorReporter.TypeId,
   report: ({ cause, fiber }) => {
@@ -49,19 +49,7 @@ const recorder: ErrorReporter.ErrorReporter = {
       const error =
         reason._tag === "Fail" ? reason.error : reason._tag === "Die" ? reason.defect : undefined;
       if (!isRequestRejection(error)) continue;
-      const span = Context.getOption(fiber.context, Tracer.ParentSpan);
-      if (Option.isNone(span) || span.value._tag !== "Span") return;
-      // Union members can repeat the same finding.
-      const issues = [...new Set(issueSummary(error.cause.issue, "$"))];
-      span.value.attribute("error.type", "HttpApiSchemaError");
-      span.value.attribute("executor.request.rejection.kind", error.kind);
-      span.value.attribute(
-        "executor.request.rejection.issues",
-        [
-          ...issues.slice(0, maxIssues),
-          ...(issues.length > maxIssues ? [`+${issues.length - maxIssues} more`] : []),
-        ].join(", "),
-      );
+      record(error, fiber.context);
       return;
     }
   },
diff --git a/packages/telemetry/src/schema-issue.ts b/packages/telemetry/src/schema-issue.ts
new file mode 100644
index 0000000000..7ee52a7fdf
--- /dev/null
+++ b/packages/telemetry/src/schema-issue.ts
@@ -0,0 +1,24 @@
+/** Schema decoding failures described without the values that failed. */
+import type { SchemaIssue } from "effect";
+
+const segment = (key: PropertyKey) =>
+  typeof key === "number" ? `[${key}]` : `.${String(key).slice(0, 64)}`;
+
+/** Issue locations and categories only. Values, messages and annotations can echo the input. */
+export const issueSummary = (issue: SchemaIssue.Issue, path = "$"): ReadonlyArray<string> => {
+  switch (issue._tag) {
+    case "Pointer":
+      return issueSummary(issue.issue, path + issue.path.map(segment).join(""));
+    case "Encoding":
+      return issueSummary(issue.issue, path);
+    case "Composite":
+      return issue.issues.flatMap((inner) => issueSummary(inner, path));
+    // A union lists why each member rejected the value.
+    case "AnyOf":
+      return issue.issues.length === 0
+        ? [`${path}: AnyOf`]
+        : issue.issues.flatMap((inner) => issueSummary(inner, path));
+    default:
+      return [`${path}: ${issue._tag}`];
+  }
+};
diff --git a/packages/ui/src/contracts/credentials.ts b/packages/ui/src/contracts/credentials.ts
index cf6a24f08f..0ceae44bba 100644
--- a/packages/ui/src/contracts/credentials.ts
+++ b/packages/ui/src/contracts/credentials.ts
@@ -1,4 +1,4 @@
-import type { OAuthClientSelection } from "@executor-js/sdk";
+import type { OAuthClientId, OAuthClientSelection } from "@executor-js/sdk";
 import { Option, Schema, type Redacted } from "effect";
 import type { ReactNode } from "react";
 
@@ -116,4 +116,8 @@ export interface AccountOAuthProps {
 export interface OAuthSubmission {
   /** Omitted on a reconnect that keeps its account's client. */
   readonly client?: OAuthClientSelection;
+  /** Register the entered client for the organization before signing in with it. */
+  readonly register?: boolean;
+  /** Update this registered client with the entered details before signing in with it. */
+  readonly update?: OAuthClientId;
 }
diff --git a/packages/ui/src/contracts/dashboard.ts b/packages/ui/src/contracts/dashboard.ts
index b801a5727d..83e946a80e 100644
--- a/packages/ui/src/contracts/dashboard.ts
+++ b/packages/ui/src/contracts/dashboard.ts
@@ -127,7 +127,7 @@ export const AppViewFromUrl = Schema.Union([
 export const AssistantId = Schema.Literals([
   "claude",
   "chatgpt",
-  "cursor",
+  "opencode",
   "claude-code",
   "codex",
   "devin",
@@ -180,6 +180,27 @@ export const currentAccountCheck = (account: AccountSummary, app: AppId) => {
   const check = account.health?.apps.find((entry) => entry.app === app)?.check;
   return check?.current === true ? check : undefined;
 };
+/**
+ * A link with the app results of a check of its account that just ran, so the link shows them
+ * before the next read of the links. Other details, such as the reported identity, wait for it.
+ */
+export const withCheckedApps = <
+  L extends { readonly account: { readonly id: AccountId }; readonly health?: AccountHealth },
+>(
+  link: L,
+  checked: AccountHealth,
+): L =>
+  link.health === undefined || link.account.id !== checked.account
+    ? link
+    : {
+        ...link,
+        health: {
+          ...link.health,
+          apps: link.health.apps.map(
+            (entry) => checked.apps.find((item) => item.app === entry.app) ?? entry,
+          ),
+        },
+      };
 /** A current failed check that does not prove the credentials are bad; the app can still open. */
 export interface AccountCheckWarning<A extends AccountSummary> {
   readonly account: A;
diff --git a/packages/ui/src/contracts/http.ts b/packages/ui/src/contracts/http.ts
index 3aadafa6ae..99e453934a 100644
--- a/packages/ui/src/contracts/http.ts
+++ b/packages/ui/src/contracts/http.ts
@@ -2,6 +2,7 @@
 import { Effect, Layer, type Schema } from "effect";
 import { AsyncResult, Atom } from "effect/reactivity";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { wireRevision, wireRevisionHeader } from "@executor-js/sdk";
 
 /**
  * Server-rendered reads have no page location to resolve relative URLs against, so they address
@@ -13,17 +14,21 @@ export const inProcessOrigin = "http://executor.internal";
 const addressHost = HttpClient.mapRequest((request) =>
   request.url.startsWith("/") ? HttpClientRequest.prependUrl(request, inProcessOrigin) : request,
 );
+/** Every dashboard read states the wire revision this build reads. */
+const stateRevision = HttpClient.mapRequest(
+  HttpClientRequest.setHeader(wireRevisionHeader, String(wireRevision)),
+);
 
 /**
  * Effect's Fetch client with the runtime's `Fetch`: the browser's, or on the server the
  * document's in-process fetch supplied by the dashboard atom runtime.
  */
-export const dashboardHttpClient: Layer.Layer<HttpClient.HttpClient> =
-  typeof window === "undefined"
-    ? Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, addressHost)).pipe(
-        Layer.provide(FetchHttpClient.layer),
-      )
-    : FetchHttpClient.layer;
+export const dashboardHttpClient: Layer.Layer<HttpClient.HttpClient> = Layer.effect(
+  HttpClient.HttpClient,
+  Effect.map(HttpClient.HttpClient, (client) =>
+    stateRevision(typeof window === "undefined" ? addressHost(client) : client),
+  ),
+).pipe(Layer.provide(FetchHttpClient.layer));
 
 /** A deterministic key for a request, independent of property order. */
 export const requestKey = (value: unknown): string => {
diff --git a/packages/ui/src/contracts/scoped-connections.ts b/packages/ui/src/contracts/scoped-connections.ts
index de430f2e03..e6f08199f0 100644
--- a/packages/ui/src/contracts/scoped-connections.ts
+++ b/packages/ui/src/contracts/scoped-connections.ts
@@ -43,14 +43,6 @@ export interface ConnectionApp {
   readonly events?: ConnectionEvents;
 }
 
-/** Short summary used in rows, details, and the connection list. */
-export const connectionToolsLabel = (tools: ConnectionTools): string =>
-  tools.kind === "all"
-    ? "All tools"
-    : tools.kind === "readOnly"
-      ? "Read-only tools"
-      : `${tools.names.length.toLocaleString("en-US")} ${tools.names.length === 1 ? "tool" : "tools"}`;
-
 /** Short summary of an event scope, for an app that declares events. */
 export const connectionEventsLabel = (events: ConnectionEvents | undefined): string =>
   events === undefined || events.kind === "all"
@@ -71,6 +63,23 @@ const targetInput = (
 ): ConnectionInput["apps"][number]["runsAs"][number] =>
   target.kind === "app" ? target : { kind: "account", id: target.id };
 
+/**
+ * A connection nobody named is named for its apps, so creating one never starts with naming it.
+ * The result fits the 80 characters a name allows.
+ */
+export const defaultConnectionName = (apps: readonly { readonly name: string }[]): string => {
+  const [first, second, ...rest] = apps.map((app) => app.name);
+  const name =
+    first === undefined
+      ? "New connection"
+      : second === undefined
+        ? first
+        : rest.length === 0
+          ? `${first} and ${second}`
+          : `${first}, ${second} and ${rest.length.toLocaleString("en-US")} more`;
+  return name.length > 80 ? `${name.slice(0, 79)}…` : name;
+};
+
 /** The request for a complete draft. Undefined while any included app has no way to run. */
 export const connectionInput = (draft: ConnectionDraft): ConnectionInput | undefined => {
   const apps: ConnectionInput["apps"][number][] = [];
@@ -84,7 +93,7 @@ export const connectionInput = (draft: ConnectionDraft): ConnectionInput | undef
       ...(app.events === undefined ? {} : { events: app.events }),
     });
   }
-  return { id: draft.id, name: draft.name.trim(), apps };
+  return { id: draft.id, name: draft.name.trim() || defaultConnectionName(draft.apps), apps };
 };
 
 /** Create a new connection or replace an existing one's name and access. */
diff --git a/packages/ui/src/implementation/components/credential-fields.tsx b/packages/ui/src/implementation/components/credential-fields.tsx
index 44088479b3..0810603427 100644
--- a/packages/ui/src/implementation/components/credential-fields.tsx
+++ b/packages/ui/src/implementation/components/credential-fields.tsx
@@ -1,5 +1,8 @@
 import type { AccountFormFields } from "../../contracts/credentials.ts";
 import { Input } from "@executor-js/ui/components/input";
+import { Button } from "./button.tsx";
+import { useRef, type ClipboardEvent, type DragEvent } from "react";
+import { flushSync } from "react-dom";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { SquareLock02Icon, ViewIcon } from "@hugeicons/core-free-icons";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "./tooltip.tsx";
@@ -54,6 +57,90 @@ function FieldAccess({
   );
 }
 
+/** Whether `text` spans lines: it has a line break between other characters. */
+const multiline = (text: string) => /[^\r\n][\r\n]+[^\r\n]/.test(text);
+
+/** How many lines `text` has. A line break at its end doesn't start another. */
+const lineCount = (text: string) => text.replace(/(\r\n|\r|\n)$/, "").split(/\r\n|\r|\n/).length;
+
+/**
+ * A secret credential's text box. An `<input>` turns pasted line breaks into spaces, which changes
+ * a multi-line secret such as a PEM private key, and only a password input hides its text from
+ * assistive software. So a paste or drop that spans lines doesn't go into the input: it replaces
+ * the whole value, exactly as pasted, and the field shows a summary that holds none of the text.
+ * Clear goes back to the empty input. A value without line breaks is the input, as before.
+ */
+export function CredentialInput({
+  value,
+  onValueChange,
+  required,
+  disabled,
+}: {
+  readonly value: string;
+  readonly onValueChange: (value: string) => void;
+  readonly required?: boolean | undefined;
+  readonly disabled?: boolean | undefined;
+}) {
+  const input = useRef<HTMLInputElement>(null);
+  const summary = useRef<HTMLOutputElement>(null);
+  const take = (
+    event: ClipboardEvent<HTMLInputElement> | DragEvent<HTMLInputElement>,
+    data: DataTransfer,
+  ) => {
+    const text = data.getData("text/plain");
+    if (!multiline(text)) return;
+    event.preventDefault();
+    flushSync(() => onValueChange(text));
+    summary.current?.focus();
+  };
+  if (/[\r\n]/.test(value)) {
+    const lines = lineCount(value);
+    return (
+      <div
+        className="max-[740px]:min-h-11 flex h-9 w-full items-center gap-2 rounded-md border border-input pr-0.5 pl-3 shadow-xs has-[output:focus-visible]:border-ring has-[output:focus-visible]:ring-[3px] has-[output:focus-visible]:ring-ring/50 dark:bg-input/30"
+        // Undo here would reach past this field to the page's previous edit, such as another field.
+        onKeyDown={(event) => {
+          if ((event.ctrlKey || event.metaKey) && /^[yz]$/i.test(event.key)) event.preventDefault();
+        }}
+      >
+        {/* The first control in the field's label, so clicking the label doesn't press Clear. */}
+        <output
+          ref={summary}
+          tabIndex={-1}
+          className="min-w-0 flex-1 truncate text-sm text-muted-foreground outline-none select-none"
+        >
+          {`Multi-line value · ${lines} ${lines === 1 ? "line" : "lines"}`}
+        </output>
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          disabled={disabled}
+          onClick={() => {
+            flushSync(() => onValueChange(""));
+            input.current?.focus();
+          }}
+        >
+          Clear
+        </Button>
+      </div>
+    );
+  }
+  return (
+    <Input
+      ref={input}
+      type="password"
+      autoComplete="off"
+      value={value}
+      onChange={(event) => onValueChange(event.target.value)}
+      onPaste={(event) => take(event, event.clipboardData)}
+      onDrop={(event) => take(event, event.dataTransfer)}
+      required={required}
+      disabled={disabled}
+    />
+  );
+}
+
 /** Empty inputs for new credentials; saved values never enter the form. */
 export function CredentialFields({
   fields,
@@ -104,15 +191,17 @@ export function CredentialFields({
                   ))}
                 </SelectContent>
               </Select>
+            ) : field.type === "string" && !fields.plain?.includes(name) ? (
+              <CredentialInput
+                value={values[name] ?? ""}
+                onValueChange={(value) => onChange({ ...values, [name]: value })}
+                required={fields.required?.includes(name) === true}
+                disabled={pending}
+              />
             ) : (
+              // A plain value is shown, and the summary would hide it, so it keeps main's input.
               <Input
-                type={
-                  field.type !== "string"
-                    ? "number"
-                    : fields.plain?.includes(name)
-                      ? "text"
-                      : "password"
-                }
+                type={field.type === "string" ? "text" : "number"}
                 autoComplete="off"
                 value={values[name] ?? ""}
                 onChange={(event) => onChange({ ...values, [name]: event.target.value })}
diff --git a/packages/ui/src/implementation/components/dialog.tsx b/packages/ui/src/implementation/components/dialog.tsx
index 7519ddc97e..81c75855fc 100644
--- a/packages/ui/src/implementation/components/dialog.tsx
+++ b/packages/ui/src/implementation/components/dialog.tsx
@@ -99,7 +99,7 @@ function DialogContent({
           opener.focus({ preventScroll: true });
         }}
         className={cn(
-          "fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border bg-background p-6 shadow-lg duration-200 outline-none data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95 sm:max-w-lg",
+          "fixed top-[50%] left-[50%] z-50 grid max-h-[calc(100dvh-2rem)] w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border bg-background p-6 shadow-lg duration-200 overflow-y-auto outline-none data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:zoom-in-95 sm:max-w-lg",
           className,
         )}
         {...props}
diff --git a/packages/ui/src/implementation/dashboard/account-health.tsx b/packages/ui/src/implementation/dashboard/account-health.tsx
index 7d4ea99a79..d1361f90df 100644
--- a/packages/ui/src/implementation/dashboard/account-health.tsx
+++ b/packages/ui/src/implementation/dashboard/account-health.tsx
@@ -11,12 +11,16 @@ import { formatMoment, useDisplayFormat } from "../hooks/display-format.ts";
 
 type AccountInfo = NonNullable<AccountHealth["info"]>;
 
-/** What one app's latest check means for the reader; tone matches the other status pills. */
+/**
+ * What one app's latest check means for the reader; tone matches the other status pills.
+ * `credentials_rejected` covers a service refusing the credentials and a sign-in that expired
+ * before any request, so its label claims neither.
+ */
 export const describeAccountCheck = (status: AccountCheckStatus) =>
   Match.value(status).pipe(
     Match.when("healthy", () => ({ label: "Working", tone: "good" as const })),
     Match.when("credentials_rejected", () => ({
-      label: "Sign-in rejected",
+      label: "Credentials not working",
       tone: "bad" as const,
     })),
     Match.when("forbidden", () => ({ label: "Missing permission", tone: "warn" as const })),
@@ -43,7 +47,7 @@ const tones = {
 export function AccountCheckDot({ health }: { readonly health: AccountAppHealth | undefined }) {
   const format = useDisplayFormat();
   const check = health?.check;
-  if (check === null || check === undefined) return null;
+  if (check === null || check === undefined || health?.checkable !== true) return null;
   const { label, tone } = describeAccountCheck(check.status);
   const text = `${check.current ? label : `${label} (outdated)`}${check.message === undefined ? "" : `: ${check.message}`}`;
   return (
@@ -139,10 +143,6 @@ export function AccountHealthPanel<E>({
   const [pending, setPending] = useState(false);
   const [error, setError] = useState<Cause.Cause<E>>();
   const checkable = health?.apps.some((entry) => entry.checkable) ?? false;
-  const stale =
-    health?.apps.some(
-      (entry) => entry.checkable && (entry.check === null || !entry.check.current),
-    ) ?? false;
   const run = async () => {
     setPending(true);
     setError(undefined);
@@ -150,10 +150,17 @@ export function AccountHealthPanel<E>({
     setPending(false);
     if (Exit.isFailure(exit)) setError(exit.cause);
   };
-  const opened = useRef(false);
+  // Each missing or outdated result is checked once while the panel is open, so a redeploy or new
+  // credentials meanwhile check again.
+  const staleResults =
+    health?.apps
+      .filter((entry) => entry.checkable && (entry.check === null || !entry.check.current))
+      .map((entry) => `${entry.app}:${entry.check?.checkedAt.getTime() ?? "none"}`)
+      .join(",") ?? "";
+  const checked = useRef(new Set<string>());
   useEffect(() => {
-    if (opened.current || !stale) return;
-    opened.current = true;
+    if (staleResults === "" || checked.current.has(staleResults)) return;
+    checked.current.add(staleResults);
     void run();
   });
   return (
@@ -174,7 +181,7 @@ export function AccountHealthPanel<E>({
             return (
               <li key={app.id} className="flex items-center justify-between gap-3 py-2.5">
                 <span className="min-w-0 wrap-anywhere">{app.name}</span>
-                <AccountCheckResult health={entry} />
+                <AccountCheckResult health={entry} checking={pending} />
               </li>
             );
           })}
@@ -197,10 +204,46 @@ export function AccountHealthPanel<E>({
   );
 }
 
-/** One app's latest check, spelled out with its time and, when it failed, the reason given. */
-export function AccountCheckResult({ health }: { readonly health: AccountAppHealth | undefined }) {
-  if (health === undefined || (!health.checkable && health.check === null))
+/**
+ * One app's latest check, spelled out with its time and, when it failed, the reason given. While
+ * `checking`, a missing or outdated result gives way to the check in progress.
+ */
+export function AccountCheckResult({
+  health,
+  checking = false,
+  retry,
+}: {
+  readonly health: AccountAppHealth | undefined;
+  readonly checking?: boolean;
+  /** Offered when checking again could not run, while the result is still missing or outdated. */
+  readonly retry?: (() => void) | undefined;
+}) {
+  if (health === undefined || !health.checkable)
     return <span className="text-[12px] text-muted-foreground">No check</span>;
+  if (checking && health.check?.current !== true)
+    return (
+      <span
+        className={`whitespace-nowrap rounded-full px-2 py-0.5 text-[11px] font-medium ${pills.muted}`}
+        data-check-status="checking"
+        aria-live="polite"
+      >
+        Checking…
+      </span>
+    );
+  if (retry !== undefined && health.check?.current !== true)
+    return (
+      <span className="inline-flex items-center gap-2 text-[12px] text-muted-foreground">
+        <span
+          className={`whitespace-nowrap rounded-full px-2 py-0.5 text-[11px] font-medium ${pills.warn}`}
+          data-check-status="recheck_failed"
+        >
+          Couldn't check
+        </span>
+        <button type="button" className="underline underline-offset-2" onClick={retry}>
+          Try again
+        </button>
+      </span>
+    );
   if (health.check === null)
     return <span className="text-[12px] text-muted-foreground">Not checked</span>;
   const { label, tone } = describeAccountCheck(health.check.status);
@@ -211,6 +254,11 @@ export function AccountCheckResult({ health }: { readonly health: AccountAppHeal
           className={`whitespace-nowrap rounded-full px-2 py-0.5 text-[11px] font-medium ${health.check.current ? pills[tone] : pills.muted}`}
           data-check-status={health.check.status}
           data-check-current={health.check.current}
+          title={
+            health.check.current
+              ? undefined
+              : "Checked before the app was redeployed or the account's credentials changed"
+          }
         >
           {health.check.current ? label : `${label} · outdated`}
         </span>
diff --git a/packages/ui/src/implementation/dashboard/add-app.tsx b/packages/ui/src/implementation/dashboard/add-app.tsx
new file mode 100644
index 0000000000..dce28a070d
--- /dev/null
+++ b/packages/ui/src/implementation/dashboard/add-app.tsx
@@ -0,0 +1,251 @@
+import { useState, type ReactElement, type ReactNode } from "react";
+import type { CustomAppInput } from "@executor-js/catalog/contracts";
+import type { DeployedApp } from "@executor-js/sdk";
+import { HugeiconsIcon, type IconSvgElement } from "@hugeicons/react";
+import {
+  AiMagicIcon,
+  ArrowDown01Icon,
+  McpServerIcon,
+  Store01Icon,
+} from "@hugeicons/core-free-icons";
+import type { MutationProps } from "../../contracts/dashboard.ts";
+import { Button } from "../components/button.tsx";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "../components/dialog.tsx";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "../components/dropdown-menu.tsx";
+import { Textarea } from "../components/textarea.tsx";
+import { AgentSetupPrompt, newAppPrompt } from "./agent-setup.tsx";
+import { CustomAppForm } from "./custom-app.tsx";
+
+/** The product's bindings for the custom app and MCP server dialogs. */
+export type AddAppDialogProps<E> = MutationProps<CustomAppInput, DeployedApp, E> & {
+  readonly onInstalled: (app: DeployedApp) => void | Promise<void>;
+  /** This installation's MCP URL, included so an unconnected agent can connect first. */
+  readonly endpoint?: string;
+};
+
+type Opened = "custom" | "mcp" | undefined;
+
+/** Apps' Add app menu: create your own app first, or browse the app catalog. */
+export function AddAppMenu<E>({
+  catalog,
+  ...dialogs
+}: AddAppDialogProps<E> & {
+  /** Wraps the catalog entry in the product's link to its catalog page. */
+  readonly catalog: (content: ReactNode) => ReactElement;
+}) {
+  const [opened, setOpened] = useState<Opened>();
+  return (
+    <>
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <Button>
+            Add app
+            <HugeiconsIcon icon={ArrowDown01Icon} size={14} aria-hidden />
+          </Button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end" className="w-76 p-1.5">
+          <DropdownMenuLabel className="px-2.5 pt-1.5 pb-1 text-[12px] text-muted-foreground">
+            Create your own
+          </DropdownMenuLabel>
+          <CreateChoices setOpened={setOpened} />
+          <DropdownMenuSeparator className="-mx-1.5 my-1.5" />
+          <CatalogChoice catalog={catalog} />
+        </DropdownMenuContent>
+      </DropdownMenu>
+      <AddAppDialogs opened={opened} setOpened={setOpened} {...dialogs} />
+    </>
+  );
+}
+
+/** The catalog page's header button and way out when nothing fits: Add app's create choices. */
+export function MakeYourOwn<E>({
+  appearance = "link",
+  ...dialogs
+}: AddAppDialogProps<E> & { readonly appearance?: "link" | "button" | undefined }) {
+  const [opened, setOpened] = useState<Opened>();
+  return (
+    <>
+      <DropdownMenu>
+        {appearance === "button" ? (
+          <DropdownMenuTrigger asChild>
+            <Button>
+              Make your own
+              <HugeiconsIcon icon={ArrowDown01Icon} size={14} aria-hidden />
+            </Button>
+          </DropdownMenuTrigger>
+        ) : (
+          <DropdownMenuTrigger className="font-medium text-foreground underline underline-offset-4 outline-none hover:text-foreground/80 focus-visible:ring-[3px] focus-visible:ring-ring/50 rounded-sm">
+            Make your own
+          </DropdownMenuTrigger>
+        )}
+        <DropdownMenuContent
+          align={appearance === "button" ? "end" : "center"}
+          className="w-76 p-1.5"
+        >
+          <CreateChoices setOpened={setOpened} />
+        </DropdownMenuContent>
+      </DropdownMenu>
+      <AddAppDialogs opened={opened} setOpened={setOpened} {...dialogs} />
+    </>
+  );
+}
+
+function CreateChoices({ setOpened }: { readonly setOpened: (opened: Opened) => void }) {
+  return (
+    <>
+      <DropdownMenuItem
+        className="items-start gap-3 p-2.5"
+        data-product-area="apps"
+        data-product-action="add_custom_app"
+        onSelect={() => setOpened("custom")}
+      >
+        <Choice
+          icon={AiMagicIcon}
+          title="From scratch"
+          description="Describe it and your agent builds it"
+        />
+      </DropdownMenuItem>
+      <DropdownMenuItem
+        className="items-start gap-3 p-2.5"
+        data-product-area="apps"
+        data-product-action="add_mcp_server"
+        onSelect={() => setOpened("mcp")}
+      >
+        <Choice
+          icon={McpServerIcon}
+          title="From an MCP server"
+          description="Turn a remote MCP server into an app"
+        />
+      </DropdownMenuItem>
+    </>
+  );
+}
+
+function CatalogChoice({ catalog }: { readonly catalog: (content: ReactNode) => ReactElement }) {
+  return (
+    <DropdownMenuItem
+      asChild
+      className="items-start gap-3 p-2.5"
+      data-product-area="apps"
+      data-product-action="browse_catalog"
+    >
+      {catalog(
+        <Choice
+          icon={Store01Icon}
+          title="Browse app catalog"
+          description="Gmail, Notion, Linear and more, ready to add"
+        />,
+      )}
+    </DropdownMenuItem>
+  );
+}
+
+function Choice({
+  icon,
+  title,
+  description,
+}: {
+  readonly icon: IconSvgElement;
+  readonly title: string;
+  readonly description: string;
+}) {
+  return (
+    <>
+      <HugeiconsIcon
+        icon={icon}
+        size={18}
+        aria-hidden
+        className="mt-0.5 shrink-0 text-muted-foreground"
+      />
+      <span className="flex min-w-0 flex-col gap-0.5">
+        <span className="text-[13px] font-medium">{title}</span>
+        <span className="text-[12px] leading-4 text-muted-foreground">{description}</span>
+      </span>
+    </>
+  );
+}
+
+function AddAppDialogs<E>({
+  opened,
+  setOpened,
+  endpoint,
+  ...form
+}: AddAppDialogProps<E> & {
+  readonly opened: Opened;
+  readonly setOpened: (opened: Opened) => void;
+}) {
+  const close = (open: boolean) => {
+    if (!open) setOpened(undefined);
+  };
+  return (
+    <>
+      <Dialog open={opened === "custom"} onOpenChange={close}>
+        <DialogContent className="max-h-[85dvh] gap-5 overflow-y-auto sm:max-w-[560px]">
+          <CustomAppDialog endpoint={endpoint} />
+        </DialogContent>
+      </Dialog>
+      <Dialog open={opened === "mcp"} onOpenChange={close}>
+        <DialogContent className="max-h-[85dvh] gap-5 overflow-y-auto sm:max-w-[560px]">
+          <DialogHeader>
+            <DialogTitle>Create from an MCP server</DialogTitle>
+            <DialogDescription>Turn a remote MCP server into an app by its URL.</DialogDescription>
+          </DialogHeader>
+          <CustomAppForm {...form} />
+          <p className="text-[13px] text-muted-foreground">
+            OpenAPI spec, API key or another service?{" "}
+            <button
+              type="button"
+              onClick={() => setOpened("custom")}
+              className="text-foreground underline underline-offset-4"
+            >
+              Start from scratch
+            </button>
+          </p>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
+/** A custom app starts as a description that the user's agent turns into code. */
+function CustomAppDialog({ endpoint }: { readonly endpoint: string | undefined }) {
+  const [description, setDescription] = useState("");
+  return (
+    <>
+      <DialogHeader>
+        <DialogTitle>Create from scratch</DialogTitle>
+        <DialogDescription>
+          Describe what it should do, or paste an OpenAPI spec’s URL. Your agent writes the app,
+          deploys it here and helps you connect the accounts it needs.
+        </DialogDescription>
+      </DialogHeader>
+      <label className="flex flex-col gap-2.25 text-[13px] font-medium">
+        What should it do?
+        <Textarea
+          value={description}
+          onChange={(event) => setDescription(event.target.value)}
+          placeholder="Every Monday, summarize my open Linear issues and post them to #eng in Slack."
+          rows={3}
+        />
+      </label>
+      <AgentSetupPrompt
+        title="Send this to your agent"
+        description="Paste it into Claude Code, Codex, Cursor or any agent connected to Executor."
+        prompt={newAppPrompt(description, endpoint)}
+      />
+    </>
+  );
+}
diff --git a/packages/ui/src/implementation/dashboard/agent-setup.tsx b/packages/ui/src/implementation/dashboard/agent-setup.tsx
index 475133d961..353aa8022a 100644
--- a/packages/ui/src/implementation/dashboard/agent-setup.tsx
+++ b/packages/ui/src/implementation/dashboard/agent-setup.tsx
@@ -1,14 +1,15 @@
 import { CopyButton } from "./code.tsx";
 
-/**
- * Services Executor cannot add without guessing are set up by the user's agent, which can read the
- * service's documentation and ask the user how they sign in.
- */
-export const agentSetupPrompt = (endpoint?: string) =>
+/** Hands a custom app's description to the user's agent, which writes and deploys it. */
+export const newAppPrompt = (description: string, endpoint?: string) =>
   [
-    "Help me add a service to Executor as an app. Ask me which service I want to connect.",
+    "Help me build a new Executor app.",
     "",
-    "Start with the Executor app's executor skill, then follow its app-authoring skill. Read the service's API and authentication documentation, ask me how I sign in and anything else you need, then write and deploy the app and help me connect my account.",
+    description.trim() === ""
+      ? "Ask me what the app should do."
+      : `What it should do: ${description.trim()}`,
+    "",
+    "Start with the Executor app's executor skill, then follow its app-authoring skill. Ask me anything you need, including which accounts it uses, then write and deploy the app and help me connect my accounts.",
     ...(endpoint === undefined
       ? []
       : [
diff --git a/packages/ui/src/implementation/dashboard/app-accounts.tsx b/packages/ui/src/implementation/dashboard/app-accounts.tsx
index 4f08554484..1f29a3c359 100644
--- a/packages/ui/src/implementation/dashboard/app-accounts.tsx
+++ b/packages/ui/src/implementation/dashboard/app-accounts.tsx
@@ -1,5 +1,15 @@
 import { useQuery } from "./context.tsx";
-import { useEffect, useId, useRef, useState, type ReactNode, type ComponentType } from "react";
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useCallback,
+  useId,
+  useRef,
+  useState,
+  type ReactNode,
+  type ComponentType,
+} from "react";
 import { useAtomSet, useAtomValue } from "@effect/atom-react";
 import { AsyncResult, type Atom } from "effect/reactivity";
 import { Exit, Option, type Cause } from "effect";
@@ -238,16 +248,49 @@ const checkFreshFor = 5 * 60 * 1000;
 
 /**
  * Stale while revalidate: rows show the recorded checks at once, and each account this app checks
- * is checked again in the background, once per view, when its result is missing, outdated or older
- * than `checkFreshFor`.
+ * is checked again in the background when its result is missing, outdated or older than
+ * `checkFreshFor`. Each recorded result is rechecked once, so a redeploy or new credentials while
+ * the page stays open check again, and a recheck that changes nothing does not repeat. A recheck
+ * that cannot run leaves the result as it was, so its rows offer to try again.
  */
 function useRevalidateChecks(
   app: App,
   scope: AccountScope,
   accounts: readonly AccountSummary[],
-  revalidate: ((account: AccountId) => Promise<unknown>) | undefined,
-) {
-  const started = useRef(new Set<AccountId>());
+  revalidate: Revalidate | undefined,
+): Rechecks {
+  const started = useRef(new Set<string>());
+  const [running, setRunning] = useState<ReadonlyMap<AccountId, number>>(new Map());
+  const [failed, setFailed] = useState<ReadonlySet<AccountId>>(new Set());
+  const retry = useCallback(
+    (id: AccountId) => {
+      if (revalidate === undefined) return;
+      const count = (by: number) =>
+        setRunning((runs) => {
+          const next = new Map(runs);
+          const total = (next.get(id) ?? 0) + by;
+          if (total > 0) next.set(id, total);
+          else next.delete(id);
+          return next;
+        });
+      const fail = (failure: boolean) =>
+        setFailed((ids) => {
+          const next = new Set(ids);
+          if (failure) next.add(id);
+          else next.delete(id);
+          return next;
+        });
+      count(1);
+      fail(false);
+      void revalidate(id)
+        .then(
+          (exit) => fail(Exit.isFailure(exit)),
+          () => fail(true),
+        )
+        .finally(() => count(-1));
+    },
+    [revalidate],
+  );
   useEffect(() => {
     if (revalidate === undefined) return;
     const now = Date.now();
@@ -257,26 +300,40 @@ function useRevalidateChecks(
         if (
           account.provider !== requirement.provider ||
           account.health === undefined ||
-          started.current.has(account.id) ||
           accountNeedsSignIn(account) ||
           account.signIn?.state === "unavailable"
         )
           continue;
         const entry = account.health.apps.find((item) => item.app === app.id);
+        if (entry !== undefined && !entry.checkable) continue;
         const checkedAt =
           entry === undefined ? account.health.infoCheckedAt : (entry.check?.checkedAt ?? null);
-        const fresh =
-          checkedAt !== null &&
-          entry?.check?.current !== false &&
-          now - checkedAt.getTime() < checkFreshFor;
-        if (fresh) continue;
-        started.current.add(account.id);
-        void revalidate(account.id);
+        const current = entry?.check?.current !== false;
+        if (checkedAt !== null && current && now - checkedAt.getTime() < checkFreshFor) continue;
+        const result = `${account.id}:${checkedAt?.getTime() ?? "none"}:${current}`;
+        if (started.current.has(result)) continue;
+        started.current.add(result);
+        retry(account.id);
       }
     }
-  });
+  }, [app, scope, accounts, revalidate, retry]);
+  return { running, failed, retry };
 }
 
+/** Check an account again; resolves with the check's outcome. */
+type Revalidate = (account: AccountId) => Promise<Exit.Exit<unknown, unknown>>;
+/** The accounts whose check of this app is running again, or could not run. */
+interface Rechecks {
+  readonly running: ReadonlyMap<AccountId, number>;
+  readonly failed: ReadonlySet<AccountId>;
+  readonly retry: (account: AccountId) => void;
+}
+const Checking = createContext<Rechecks>({
+  running: new Map(),
+  failed: new Set(),
+  retry: () => {},
+});
+
 type RequirementEntry = readonly [string, AccountRequirement];
 
 const scoped = (app: App, scope: AccountScope): readonly RequirementEntry[] =>
@@ -320,7 +377,7 @@ export interface ScopeAccounts<E> {
     | ((account: AccountSummary, slot: string, requirement: AccountRequirement) => ReactNode)
     | undefined;
   /** Check one linked account again; its result reaches `links` through the host's queries. */
-  readonly revalidate?: ((account: AccountId) => Promise<unknown>) | undefined;
+  readonly revalidate?: Revalidate | undefined;
 }
 
 /**
@@ -401,7 +458,7 @@ function LinkScope<E>({
   readonly requirements: readonly RequirementEntry[];
 }) {
   const { app, scope, data } = props;
-  useRevalidateChecks(
+  const checking = useRevalidateChecks(
     app,
     scope,
     data.links.map((link) => link.account),
@@ -410,35 +467,39 @@ function LinkScope<E>({
   const all = Object.values(app.requirements.accounts);
   const readOnly = data.edit === undefined;
   return (
-    <section aria-label={title} data-read-only={readOnly} className="space-y-3">
-      <div>
-        <h2 className="text-sm font-medium">{title}</h2>
-        <p className="text-xs text-muted-foreground">{description}</p>
-      </div>
-      {readOnly && data.readOnly !== undefined && (
-        <p className="text-xs text-muted-foreground">{data.readOnly}</p>
-      )}
-      <div className={cn("space-y-5", readOnly && "opacity-60")}>
-        {requirements.map(([slot, requirement]) => (
-          <RequirementView
-            key={slot}
-            {...props}
-            slot={slot}
-            requirement={requirement}
-            linked={data.links.flatMap((link) => (link.requirement === slot ? [link.account] : []))}
-            label={
-              all.length > 1
-                ? `${requirement.definition.name} (${slot})`
-                : requirement.definition.name
-            }
-            showSlot={
-              all.filter((other) => other.definition.name === requirement.definition.name).length >
-              1
-            }
-          />
-        ))}
-      </div>
-    </section>
+    <Checking.Provider value={checking}>
+      <section aria-label={title} data-read-only={readOnly} className="space-y-3">
+        <div>
+          <h2 className="text-sm font-medium">{title}</h2>
+          <p className="text-xs text-muted-foreground">{description}</p>
+        </div>
+        {readOnly && data.readOnly !== undefined && (
+          <p className="text-xs text-muted-foreground">{data.readOnly}</p>
+        )}
+        <div className={cn("space-y-5", readOnly && "opacity-60")}>
+          {requirements.map(([slot, requirement]) => (
+            <RequirementView
+              key={slot}
+              {...props}
+              slot={slot}
+              requirement={requirement}
+              linked={data.links.flatMap((link) =>
+                link.requirement === slot ? [link.account] : [],
+              )}
+              label={
+                all.length > 1
+                  ? `${requirement.definition.name} (${slot})`
+                  : requirement.definition.name
+              }
+              showSlot={
+                all.filter((other) => other.definition.name === requirement.definition.name)
+                  .length > 1
+              }
+            />
+          ))}
+        </div>
+      </section>
+    </Checking.Provider>
   );
 }
 
@@ -474,7 +535,7 @@ function RequirementView<E>({
   const { data } = props;
   return (
     <section aria-label={label} className="min-w-0 space-y-2.5">
-      <div className="flex min-h-8 min-w-0 items-center gap-3 text-sm [&_.provider-icon]:size-14 [&_.provider-icon]:rounded-lg [&_.provider-icon]:border-0 [&_.provider-icon]:bg-muted/40 [&_.provider-icon>img]:size-8 [&_.provider-icon>svg]:size-8">
+      <div className="flex min-h-8 min-w-0 items-center gap-3 text-sm [&_.provider-icon]:size-14 [&_.provider-icon]:rounded-xl">
         <AppProviderIcon app={props.app} provider={requirement.definition} large />
         <div className="min-w-0">
           <p className="truncate font-medium">{requirement.definition.name}</p>
@@ -757,6 +818,7 @@ function AccountStatus({
   readonly account: AccountSummary;
   readonly reconnect?: ReactNode;
 }) {
+  const rechecks = useContext(Checking);
   if (accountNeedsSignIn(account))
     return (
       <span className="flex items-center gap-2 text-xs text-sign-in-warning">
@@ -765,11 +827,25 @@ function AccountStatus({
     );
   if (account.signIn?.state === "unavailable")
     return <span className="text-xs text-sign-in-warning">Unavailable</span>;
-  return <AppCheck health={account.health?.apps.find((entry) => entry.app === app.id)} />;
+  return (
+    <AppCheck
+      health={account.health?.apps.find((entry) => entry.app === app.id)}
+      checking={rechecks.running.has(account.id)}
+      retry={rechecks.failed.has(account.id) ? () => rechecks.retry(account.id) : undefined}
+    />
+  );
 }
 
 /** This app's check of a linked account; apps without a check show nothing. */
-function AppCheck({ health }: { readonly health: AccountAppHealth | undefined }) {
-  if (health === undefined || (!health.checkable && health.check === null)) return null;
-  return <AccountCheckResult health={health} />;
+function AppCheck({
+  health,
+  checking,
+  retry,
+}: {
+  readonly health: AccountAppHealth | undefined;
+  readonly checking: boolean;
+  readonly retry: (() => void) | undefined;
+}) {
+  if (health === undefined || !health.checkable) return null;
+  return <AccountCheckResult health={health} checking={checking} retry={retry} />;
 }
diff --git a/packages/ui/src/implementation/dashboard/app-detail.tsx b/packages/ui/src/implementation/dashboard/app-detail.tsx
index 7a9804d194..4ffca9a757 100644
--- a/packages/ui/src/implementation/dashboard/app-detail.tsx
+++ b/packages/ui/src/implementation/dashboard/app-detail.tsx
@@ -103,7 +103,7 @@ export function AppDetailLayout({
           {back}
         </div>
         <div className="flex flex-wrap items-center gap-x-6 gap-y-4 max-[740px]:min-w-0 max-[740px]:flex-1 max-[740px]:gap-y-2 max-[740px]:py-1.5">
-          <div className="flex min-w-0 flex-1 items-center gap-4 max-[740px]:gap-2.5 max-[740px]:[&_.provider-icon-large]:size-8 max-[740px]:[&_.provider-icon-large]:rounded-[7px] max-[740px]:[&_.provider-icon-large_img]:size-5">
+          <div className="flex min-w-0 flex-1 items-center gap-4 max-[740px]:gap-2.5 max-[740px]:[&_.provider-icon-large]:size-8 max-[740px]:[&_.provider-icon-large]:rounded-[7px]">
             <AppIcon app={app} large />
             <h1
               className="min-w-0 truncate text-2xl font-semibold tracking-tight max-[740px]:text-lg"
diff --git a/packages/ui/src/implementation/dashboard/assistant-logos.tsx b/packages/ui/src/implementation/dashboard/assistant-logos.tsx
index a89888c511..a00cb0f55a 100644
--- a/packages/ui/src/implementation/dashboard/assistant-logos.tsx
+++ b/packages/ui/src/implementation/dashboard/assistant-logos.tsx
@@ -30,12 +30,6 @@ export const CodexLogo: Logo = (props) => (
   </svg>
 );
 
-export const CursorLogo: Logo = (props) => (
-  <svg viewBox="0 0 466.73 532.09" fill="currentColor" aria-hidden {...props}>
-    <path d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z" />
-  </svg>
-);
-
 export const GrokLogo: Logo = (props) => (
   <svg viewBox="0 0 1024 1024" fill="currentColor" aria-hidden {...props}>
     <path d="M395.479 633.828L735.91 381.105C752.599 368.715 776.454 373.548 784.406 392.792C826.26 494.285 807.561 616.253 724.288 699.996C641.016 783.739 525.151 802.104 419.247 760.277L303.556 814.143C469.49 928.202 670.987 899.995 796.901 773.282C896.776 672.843 927.708 535.937 898.785 412.476L899.047 412.739C857.105 231.37 909.358 158.874 1016.4 10.6326C1018.93 7.11771 1021.47 3.60279 1024 0L883.144 141.651V141.212L395.392 633.916" />
@@ -43,6 +37,13 @@ export const GrokLogo: Logo = (props) => (
   </svg>
 );
 
+export const OpenCodeLogo: Logo = (props) => (
+  <svg viewBox="0 0 16 20" fill="currentColor" aria-hidden {...props}>
+    <path d="M12 16H4V8H12V16Z" opacity={0.4} />
+    <path d="M12 4H4V16H12V4ZM16 20H0V0H16V20Z" />
+  </svg>
+);
+
 export const DevinLogo: Logo = (props) => (
   <svg viewBox="50 30 326 366" fill="currentColor" aria-hidden {...props}>
     <path d="M70 159.333V91.3471C70 88.3592 71.594 85.5983 74.1816 84.1044L133.043 50.1205C135.631 48.6265 138.819 48.6265 141.407 50.1205L200.269 84.1044C202.856 85.5983 204.45 88.3592 204.45 91.3471V126.068C204.708 137.606 210.806 148.734 221.531 154.926C232.256 161.117 244.942 160.834 255.063 155.289L285.132 137.929C287.719 136.435 290.907 136.435 293.495 137.929L352.357 171.913C354.944 173.406 356.538 176.167 356.538 179.155V247.123C356.538 250.111 354.944 252.872 352.357 254.366L293.495 288.35C290.907 289.844 287.719 289.844 285.132 288.35L255.306 271.13C245.146 265.456 232.344 265.117 221.534 271.358C210.809 277.55 204.711 288.678 204.453 300.215V334.926C204.453 337.914 202.859 340.675 200.271 342.169L141.41 376.153C138.822 377.647 135.634 377.647 133.046 376.153L74.1845 342.169C71.5969 340.675 70.0028 337.914 70.0028 334.926V266.959C70.0029 263.971 71.5969 261.21 74.1845 259.716L133.046 225.732C135.634 224.238 138.822 224.238 141.41 225.732L171.547 243.132C181.656 248.638 194.306 248.906 205.005 242.729C215.815 236.488 221.922 225.231 222.088 213.595C221.83 202.057 215.732 189.737 205.008 183.545C194.283 177.353 181.597 177.636 171.476 183.181L141.269 200.72C138.67 202.229 135.461 202.228 132.864 200.716L74.1576 166.562C71.5835 165.065 70 162.311 70 159.333Z" />
diff --git a/packages/ui/src/implementation/dashboard/assistant-screenshots/cursor.webp b/packages/ui/src/implementation/dashboard/assistant-screenshots/cursor.webp
deleted file mode 100644
index 7af3d4d435..0000000000
Binary files a/packages/ui/src/implementation/dashboard/assistant-screenshots/cursor.webp and /dev/null differ
diff --git a/packages/ui/src/implementation/dashboard/catalog.tsx b/packages/ui/src/implementation/dashboard/catalog.tsx
index 24b3c4d5f4..5f5f80f16e 100644
--- a/packages/ui/src/implementation/dashboard/catalog.tsx
+++ b/packages/ui/src/implementation/dashboard/catalog.tsx
@@ -15,7 +15,8 @@ import type {
   Query,
   FailureProps,
 } from "../../contracts/dashboard.ts";
-import { Empty, LoadingRows, ProviderIcon, SearchInput } from "./common.tsx";
+import { Empty, ProviderIcon, SearchInput } from "./common.tsx";
+import { CatalogCountSkeleton, CatalogPageFrame, CatalogRowsSkeleton } from "./loading.tsx";
 import { Button } from "../components/button.tsx";
 import {
   Dialog,
@@ -80,6 +81,7 @@ export function CatalogPage<E, IE, P = never>({
   InstallFailure,
   back,
   action,
+  create,
   inventory,
   open,
 }: QueryProps<readonly CatalogEntry[], E> & {
@@ -87,7 +89,10 @@ export function CatalogPage<E, IE, P = never>({
   readonly mutation: (entry: string) => MutationProps<InstallApp, DeployedApp, IE>["mutation"];
   readonly InstallFailure: MutationProps<InstallApp, DeployedApp, IE>["Failure"];
   readonly back: ReactNode;
+  /** The heading's action, beside the title. */
   readonly action?: ReactNode;
+  /** Offers the ways to make an app when nothing here fits. */
+  readonly create?: ReactNode;
   /** The apps already installed; a failed read just leaves every row on Add. */
   readonly inventory: Query<Inventory, unknown>;
   /** A link to the installed app, rendered inside the row's Open button. */
@@ -151,23 +156,22 @@ export function CatalogPage<E, IE, P = never>({
     );
   const visible = useIncrementalList(entries.length, term, 50);
   return (
-    <div className="page w-full shrink-0 max-w-315 [padding:24px_24px_48px] my-0 mx-auto max-[1000px]:[padding:20px_20px_40px] max-[740px]:[padding:18px_max(16px,_env(safe-area-inset-right))_max(32px,_env(safe-area-inset-bottom))_max(16px,_env(safe-area-inset-left))]">
-      {back}
-      <div className="page-heading gap-4 flex justify-between items-center min-h-12 mb-4.5 [&_p]:text-muted-foreground [&_p]:text-[13px] [&_p]:mt-1.25 [&_>_div]:min-w-0 [&_>_div]:wrap-anywhere max-[740px]:items-start max-[740px]:mb-4.5 max-[740px]:[&_p]:leading-[1.6] max-[740px]:[&_>_[data-slot='button']]:mt-0.25 max-[740px]:[.setup-page_&]:min-h-0">
-        <div>
-          <h1 className="text-[22px] font-semibold tracking-[-0.035em] leading-[1.35] [&>span]:text-muted-foreground [&>span]:text-[13px] [&>span]:font-mono [&>span]:font-normal [&>span]:ml-[8px] [&>span]:align-middle">
-            Add app
-          </h1>
-          <p>Find a service to connect.</p>
-        </div>
-        {action}
-      </div>
-      <div className="list-toolbar flex flex-wrap items-center gap-[10px_16px] mb-4">
-        <SearchInput autoFocus value={search} onChange={setSearch} placeholder="Search apps…" />
-        <span className="muted text-muted-foreground">
-          {entries.length.toLocaleString("en-US")} apps
-        </span>
-      </div>
+    <CatalogPageFrame
+      back={back}
+      action={action}
+      toolbar={
+        <>
+          <SearchInput autoFocus value={search} onChange={setSearch} placeholder="Search apps…" />
+          {AsyncResult.isInitial(result) && !entries.length ? (
+            <CatalogCountSkeleton />
+          ) : (
+            <span className="muted min-w-20 text-muted-foreground tabular-nums">
+              {entries.length.toLocaleString("en-US")} apps
+            </span>
+          )}
+        </>
+      }
+    >
       {publications !== undefined && (
         <PublishedApps
           query={publications}
@@ -179,7 +183,7 @@ export function CatalogPage<E, IE, P = never>({
       {AsyncResult.isFailure(result) && <Failure cause={result.cause} retry={retry} />}
       {failure && conflict === undefined && <InstallFailure cause={failure} />}
       {!entries.length && AsyncResult.isInitial(result) ? (
-        <LoadingRows />
+        <CatalogRowsSkeleton />
       ) : !entries.length && AsyncResult.isFailure(result) ? null : !entries.length ? (
         <Empty
           title={search ? "No matching apps" : "No apps available"}
@@ -188,14 +192,10 @@ export function CatalogPage<E, IE, P = never>({
               <Button variant="outline" onClick={() => setSearch("")}>
                 Clear search
               </Button>
-            ) : (
-              action
-            )
+            ) : undefined
           }
         >
-          {search
-            ? "Try another name or connect your own service."
-            : "Connect your own service to get started."}
+          {create ? <MissingApp create={create} /> : "Try another name."}
         </Empty>
       ) : (
         <>
@@ -213,7 +213,7 @@ export function CatalogPage<E, IE, P = never>({
                 {(() => {
                   const installed = installedByPackage.get(entry.package);
                   return installed ? (
-                    <Button variant="outline" size="sm" asChild>
+                    <Button variant="outline" size="sm" className="min-w-21" asChild>
                       {open(installed)}
                     </Button>
                   ) : (
@@ -221,6 +221,7 @@ export function CatalogPage<E, IE, P = never>({
                       type="button"
                       variant="outline"
                       size="sm"
+                      className="min-w-21"
                       aria-label={`Add ${entry.name}`}
                       disabled={adding.has(entry.id)}
                       onClick={() => void add(entry, entry.name)}
@@ -233,6 +234,11 @@ export function CatalogPage<E, IE, P = never>({
             ))}
           </div>
           {visible.sentinel}
+          {create && (
+            <p className="mt-6 text-center text-[13px] text-muted-foreground">
+              <MissingApp create={create} />
+            </p>
+          )}
         </>
       )}
       <Dialog
@@ -289,10 +295,14 @@ export function CatalogPage<E, IE, P = never>({
           </form>
         </DialogContent>
       </Dialog>
-    </div>
+    </CatalogPageFrame>
   );
 }
 
+function MissingApp({ create }: { readonly create: ReactNode }) {
+  return <>Can’t find what you’re looking for? {create}</>;
+}
+
 /** Apps published inside this organization; selecting one opens the copy flow. */
 function PublishedApps<P>({
   query,
diff --git a/packages/ui/src/implementation/dashboard/common.tsx b/packages/ui/src/implementation/dashboard/common.tsx
index 31eeb46c36..3bbccb37ff 100644
--- a/packages/ui/src/implementation/dashboard/common.tsx
+++ b/packages/ui/src/implementation/dashboard/common.tsx
@@ -71,10 +71,11 @@ export function ProviderIcon({
   const catalogIcons = useCatalogIcons();
   const [failed, setFailed] = useState<readonly string[]>([]);
   const normalized = name.toLowerCase().trim();
-  const size = large ? 24 : 17;
+  // Fetched large enough to stay sharp in the biggest tile on a 2x screen.
+  const fetchSize = 64;
   const catalog = icons ?? catalogIcons.byName.get(normalized) ?? undefined;
   const domain = url ?? (/^[a-z\d-]+(?:\.[a-z\d-]+)+$/i.test(normalized) ? normalized : null);
-  const source = normalized === "executor" ? "/favicon.png" : faviconUrl(domain, size);
+  const source = normalized === "executor" ? "/favicon.png" : faviconUrl(domain, fetchSize);
   const sources = declared ?? catalogIconSources(catalog);
   const waiting = sources === null && (pending || (icons === undefined && !catalogIcons.settled));
   const own = sources !== null && !failed.includes(sources.light) ? sources : null;
@@ -85,9 +86,10 @@ export function ProviderIcon({
   return (
     <span
       className={cn(
-        "provider-icon w-8.5 h-8.5 border border-border rounded-[7px] inline-flex items-center justify-center bg-background shrink-0 [&_img]:w-4.25 [&_img]:h-4.25 [&_img]:object-contain [&_>_svg]:w-4.25 [&_>_svg]:h-4.25 [&_>_svg]:object-contain max-[740px]:[.catalog-row_>_&]:row-[1_/_3]",
-        large &&
-          "provider-icon-large w-11 h-11 rounded-[9px] [&_img]:w-6 [&_img]:h-6 [&_>_svg]:w-6 [&_>_svg]:h-6",
+        // Logos are bare marks or shaped badges, so every one sits padded on the page background.
+        // The mark scales with the tile, which keeps the padding even wherever a page resizes it.
+        "provider-icon inline-flex size-8.5 shrink-0 items-center justify-center overflow-hidden rounded-[8px] border border-border bg-background [&_img]:size-[70%] [&_img]:object-contain [&_>_svg]:size-1/2 max-[740px]:[.catalog-row_>_&]:row-[1_/_3]",
+        large && "provider-icon-large size-11 rounded-[10px]",
       )}
       aria-hidden
     >
@@ -104,8 +106,8 @@ export function ProviderIcon({
           <img
             src={own.light}
             alt=""
-            width={size}
-            height={size}
+            width={fetchSize}
+            height={fetchSize}
             referrerPolicy="no-referrer"
             data-icon="app"
             onError={fail(own.light)}
@@ -115,8 +117,8 @@ export function ProviderIcon({
         <img
           src={icon}
           alt=""
-          width={size}
-          height={size}
+          width={fetchSize}
+          height={fetchSize}
           referrerPolicy="no-referrer"
           onError={fail(icon)}
         />
diff --git a/packages/ui/src/implementation/dashboard/connect.tsx b/packages/ui/src/implementation/dashboard/connect.tsx
index 39cca43e8c..1324daee6d 100644
--- a/packages/ui/src/implementation/dashboard/connect.tsx
+++ b/packages/ui/src/implementation/dashboard/connect.tsx
@@ -12,10 +12,10 @@ import {
   ChatGptLogo,
   ClaudeLogo,
   CodexLogo,
-  CursorLogo,
   DevinLogo,
   GrokLogo,
   MuseLogo,
+  OpenCodeLogo,
 } from "./assistant-logos.tsx";
 
 import claudeScreenshot from "./assistant-screenshots/claude.webp";
@@ -23,7 +23,6 @@ import chatgptScreenshot from "./assistant-screenshots/chatgpt.webp";
 import devinScreenshot from "./assistant-screenshots/devin.webp";
 import grokScreenshot from "./assistant-screenshots/grok.webp";
 import museScreenshot from "./assistant-screenshots/muse.webp";
-import cursorScreenshot from "./assistant-screenshots/cursor.webp";
 
 /** The agent installs Executor itself; the prompt carries everything it needs to start. */
 export const mcpSetupPrompt = (endpoint: string, docs: string, next: string) =>
@@ -147,43 +146,6 @@ const signIn = (assistant: string) => (
   </>
 );
 
-const cursorGuide = (endpoint: string): AssistantGuide => ({
-  name: "Cursor",
-  logo: CursorLogo,
-  method: "Executor plugin",
-  link: {
-    href: "https://cursor.com/marketplace/usefulsoftwareco",
-    label: "Install Executor for Cursor",
-  },
-  steps: [
-    <>
-      Click <Ui>Add to Cursor</Ui> on the plugin page, or type{" "}
-      <Command>/add-plugin executor</Command> in Cursor.
-    </>,
-    <>
-      Choose <Ui>Connect</Ui> on the plugin&rsquo;s <Ui>executor</Ui> MCP server, then sign in and
-      approve access.
-    </>,
-    <>
-      Run <Command>/executor-setup</Command> to check the connection.
-    </>,
-  ],
-  screenshot: {
-    src: cursorScreenshot,
-    width: 780,
-    height: 668,
-    alt: "Executor plugin listing with Add to Cursor and /add-plugin executor",
-    caption: "The Executor plugin in the marketplace",
-  },
-  note: (
-    <>
-      Using a scoped connection or your own server? Set the plugin&rsquo;s executor MCP server URL
-      to:
-      <EndpointField endpoint={endpoint} />
-    </>
-  ),
-});
-
 /** The public plugin connects to Executor Cloud; custom endpoints keep their own setup. */
 const openAiPluginGuide = (name: "ChatGPT" | "Codex"): AssistantGuide => ({
   name,
@@ -316,7 +278,35 @@ const assistantGuides = (endpoint: string): Record<AssistantId, AssistantGuide>
             </>
           ),
         },
-  cursor: cursorGuide(endpoint),
+  opencode: {
+    name: "OpenCode",
+    logo: OpenCodeLogo,
+    method: "Terminal",
+    steps: [
+      <>
+        Add Executor from your terminal.
+        <CommandBlock
+          code={`opencode mcp add executor --url ${shellQuote(endpoint)}`}
+          path="install.sh"
+          label="Copy assistant setup"
+        />
+      </>,
+      <>
+        Open the sign-in page.
+        <CommandBlock
+          code="opencode mcp auth executor"
+          path="install.sh"
+          label="Copy sign-in command"
+        />
+      </>,
+      signIn("OpenCode"),
+    ],
+    note: (
+      <>
+        On OpenCode 2, add <Command>--global</Command> to use Executor in every project.
+      </>
+    ),
+  },
   "claude-code": {
     name: "Claude Code",
     logo: ClaudeLogo,
diff --git a/packages/ui/src/implementation/dashboard/connection-app-picker.tsx b/packages/ui/src/implementation/dashboard/connection-app-picker.tsx
index b4f79a9eaa..0001a47ff9 100644
--- a/packages/ui/src/implementation/dashboard/connection-app-picker.tsx
+++ b/packages/ui/src/implementation/dashboard/connection-app-picker.tsx
@@ -118,6 +118,7 @@ export function ConnectionAppRow({
   onExpandedChange,
   onChange,
   renderTools,
+  renderConnectAccount,
 }: {
   readonly choices: AppChoices;
   readonly selection: ConnectionApp | undefined;
@@ -125,6 +126,8 @@ export function ConnectionAppRow({
   readonly onExpandedChange: (expanded: boolean) => void;
   readonly onChange: (selection: ConnectionApp | undefined) => void;
   readonly renderTools: (props: ConnectionToolPickerProps) => ReactNode;
+  /** A host link to connect an account, shown when the app has none yet. */
+  readonly renderConnectAccount?: (app: App) => ReactNode;
 }) {
   const id = useId();
   const { app } = choices;
@@ -161,17 +164,27 @@ export function ConnectionAppRow({
                 issue === undefined ? "text-muted-foreground" : "text-amber-600 dark:text-amber-400"
               }`}
             >
-              {issue ??
-                (!choices.needsAccount
-                  ? "No account needed"
-                  : choices.options.length === 0
-                    ? "No connected accounts"
-                    : only !== undefined
-                      ? connectionTargetLabel(only.target)
-                      : `${choices.options.length} ways to run`)}
+              {renderConnectAccount !== undefined &&
+              choices.needsAccount &&
+              choices.options.length === 0
+                ? "No connected accounts"
+                : (issue ??
+                  (!choices.needsAccount
+                    ? "No account needed"
+                    : choices.options.length === 0
+                      ? "No connected accounts"
+                      : only !== undefined
+                        ? connectionTargetLabel(only.target)
+                        : `${choices.options.length} ways to run`))}
             </span>
           </span>
         </label>
+        {renderConnectAccount !== undefined &&
+          choices.needsAccount &&
+          choices.options.length === 0 && (
+            // Outside the label so following the link never toggles the app.
+            <span className="shrink-0">{renderConnectAccount(app)}</span>
+          )}
         {selection !== undefined && (
           <div className="flex w-full min-w-0 items-center gap-2 pl-7 sm:w-auto sm:pl-0">
             {choices.needsAccount && (
@@ -342,15 +355,8 @@ function AccountsPicker({
 }) {
   const selected = new Set(selection.targets.map(connectionTargetKey));
   const only = choices.options.length === 1 ? choices.options[0] : undefined;
-  if (only !== undefined && selected.has(connectionTargetKey(only.target)))
-    return (
-      <span
-        className="min-w-0 flex-1 truncate px-1 text-xs text-muted-foreground sm:w-40 sm:flex-none"
-        title={connectionTargetLabel(only.target)}
-      >
-        {connectionTargetLabel(only.target)}
-      </span>
-    );
+  // The row's subtitle already names the only way to run it.
+  if (only !== undefined && selected.has(connectionTargetKey(only.target))) return null;
   const label =
     selection.targets.length === 0
       ? "Runs as…"
diff --git a/packages/ui/src/implementation/dashboard/custom-app.tsx b/packages/ui/src/implementation/dashboard/custom-app.tsx
index 4c67cbf9b1..adffdac539 100644
--- a/packages/ui/src/implementation/dashboard/custom-app.tsx
+++ b/packages/ui/src/implementation/dashboard/custom-app.tsx
@@ -5,25 +5,21 @@ import type { DeployedApp } from "@executor-js/sdk";
 import { Exit, Option, Schema } from "effect";
 import { HugeiconsIcon } from "@hugeicons/react";
 import { Add01Icon } from "@hugeicons/core-free-icons";
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import type { MutationProps } from "../../contracts/dashboard.ts";
-import { AgentSetupPrompt, agentSetupPrompt } from "./agent-setup.tsx";
 import { Button } from "../components/button.tsx";
 import { Input } from "../components/input.tsx";
 
 /**
  * Add a remote MCP server by URL. Executor confirms whether it needs no sign-in or supports
- * OAuth; anything else, and every other kind of service, is set up with the user's agent.
+ * OAuth; anything else is set up with the user's agent.
  */
 export function CustomAppForm<E>({
   mutation,
   Failure,
   onInstalled,
-  endpoint,
 }: MutationProps<CustomAppInput, DeployedApp, E> & {
   readonly onInstalled: (app: DeployedApp) => void | Promise<void>;
-  /** This installation's MCP URL, included so an unconnected agent can connect first. */
-  readonly endpoint?: string;
 }) {
   const result = useAtomValue(mutation);
   const add = useAtomSet(mutation, { mode: "promiseExit" });
@@ -32,82 +28,81 @@ export function CustomAppForm<E>({
   const [pending, setPending] = useState(false);
   const [submitted, setSubmitted] = useState(false);
   const [error, setError] = useState<string>();
+  // Closing the dialog during an import must not navigate away once it finishes.
+  const mounted = useRef(false);
+  useEffect(() => {
+    mounted.current = true;
+    return () => {
+      mounted.current = false;
+    };
+  }, []);
   return (
-    <div className="flex flex-col gap-10 pt-7">
-      <form
-        className="setup-form custom-app-form max-w-145 flex flex-col gap-5.75 max-[740px]:gap-5.25"
-        onSubmit={(event) => {
-          event.preventDefault();
-          if (pending) return;
-          setError(undefined);
-          if (!Schema.is(ImportUrl)(url.trim())) {
-            setError(
-              "Use an HTTP or HTTPS URL without credentials, query parameters, or fragments.",
-            );
-            return;
-          }
-          const input = Schema.decodeUnknownOption(CustomAppInput)({
-            kind: "mcp",
-            name: name.trim(),
-            url: url.trim(),
-          });
-          if (Option.isNone(input)) {
-            setError("Check the app name and server URL, then try again.");
-            return;
-          }
-          setPending(true);
-          setSubmitted(true);
-          void add(input.value).then((exit) => {
-            setPending(false);
-            if (Exit.isSuccess(exit)) void onInstalled(exit.value);
-          });
-        }}
-      >
-        <fieldset disabled={pending} className="custom-app-fields flex flex-col gap-5.75 min-w-0">
-          <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium">
-            App name
-            <Input
-              value={name}
-              onChange={(event) => setName(event.target.value)}
-              placeholder="My app"
-              required
-              maxLength={120}
-            />
-          </label>
-          <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium">
-            MCP server URL
-            <Input
-              type="url"
-              value={url}
-              onChange={(event) => setUrl(event.target.value)}
-              placeholder="https://example.com/mcp"
-              required
-              autoCapitalize="none"
-              spellCheck={false}
-            />
-          </label>
-          <span className="field-hint text-muted-foreground text-[12px] font-normal leading-[1.5]">
-            Executor checks whether this server needs no sign-in or supports OAuth.
-          </span>
-        </fieldset>
-        {error && (
-          <p className="custom-app-error text-destructive text-[13px] leading-[1.5]" role="alert">
-            {error}
-          </p>
-        )}
-        {submitted && AsyncResult.isFailure(result) && <Failure cause={result.cause} />}
-        <div className="form-actions flex items-center gap-5 pt-1 text-[13px] max-[480px]:[&_>_button]:basis-full">
-          <Button disabled={pending} type="submit">
-            <HugeiconsIcon icon={Add01Icon} strokeWidth={2} aria-hidden size={14} />
-            {pending ? "Checking server…" : "Add app"}
-          </Button>
-        </div>
-      </form>
-      <AgentSetupPrompt
-        title="Any other service"
-        description="For OpenAPI, GraphQL, API keys, local tools, or anything else, send this prompt to your agent. It reads the service’s documentation and asks how you sign in."
-        prompt={agentSetupPrompt(endpoint)}
-      />
-    </div>
+    <form
+      className="setup-form custom-app-form max-w-145 flex flex-col gap-5.75 max-[740px]:gap-5.25"
+      onSubmit={(event) => {
+        event.preventDefault();
+        if (pending) return;
+        setError(undefined);
+        if (!Schema.is(ImportUrl)(url.trim())) {
+          setError("Use an HTTP or HTTPS URL without credentials, query parameters, or fragments.");
+          return;
+        }
+        const input = Schema.decodeUnknownOption(CustomAppInput)({
+          kind: "mcp",
+          name: name.trim(),
+          url: url.trim(),
+        });
+        if (Option.isNone(input)) {
+          setError("Check the app name and server URL, then try again.");
+          return;
+        }
+        setPending(true);
+        setSubmitted(true);
+        void add(input.value).then((exit) => {
+          setPending(false);
+          if (Exit.isSuccess(exit) && mounted.current) void onInstalled(exit.value);
+        });
+      }}
+    >
+      <fieldset disabled={pending} className="custom-app-fields flex flex-col gap-5.75 min-w-0">
+        <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium">
+          App name
+          <Input
+            value={name}
+            onChange={(event) => setName(event.target.value)}
+            placeholder="My app"
+            required
+            maxLength={120}
+          />
+        </label>
+        <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium">
+          MCP server URL
+          <Input
+            type="url"
+            value={url}
+            onChange={(event) => setUrl(event.target.value)}
+            placeholder="https://example.com/mcp"
+            required
+            autoCapitalize="none"
+            spellCheck={false}
+          />
+        </label>
+        <span className="field-hint text-muted-foreground text-[12px] font-normal leading-[1.5]">
+          Executor checks whether this server needs no sign-in or supports OAuth.
+        </span>
+      </fieldset>
+      {error && (
+        <p className="custom-app-error text-destructive text-[13px] leading-[1.5]" role="alert">
+          {error}
+        </p>
+      )}
+      {submitted && AsyncResult.isFailure(result) && <Failure cause={result.cause} />}
+      <div className="form-actions flex items-center gap-5 pt-1 text-[13px] max-[480px]:[&_>_button]:basis-full">
+        <Button disabled={pending} type="submit">
+          <HugeiconsIcon icon={Add01Icon} strokeWidth={2} aria-hidden size={14} />
+          {pending ? "Checking server…" : "Add app"}
+        </Button>
+      </div>
+    </form>
   );
 }
diff --git a/packages/ui/src/implementation/dashboard/loading.tsx b/packages/ui/src/implementation/dashboard/loading.tsx
index 6774f5a0a5..c7f015970e 100644
--- a/packages/ui/src/implementation/dashboard/loading.tsx
+++ b/packages/ui/src/implementation/dashboard/loading.tsx
@@ -151,6 +151,97 @@ export function InventoryPageSkeleton({
   );
 }
 
+/**
+ * Add app's back link, heading, action and search row. The page and its pending view share it, so
+ * the catalog replaces the pending view without moving.
+ */
+export function CatalogPageFrame({
+  back,
+  action,
+  toolbar,
+  children,
+}: {
+  readonly back: ReactNode;
+  readonly action?: ReactNode;
+  readonly toolbar: ReactNode;
+  readonly children: ReactNode;
+}) {
+  return (
+    <div className="page w-full shrink-0 max-w-315 [padding:24px_24px_48px] my-0 mx-auto max-[1000px]:[padding:20px_20px_40px] max-[740px]:[padding:18px_max(16px,_env(safe-area-inset-right))_max(32px,_env(safe-area-inset-bottom))_max(16px,_env(safe-area-inset-left))]">
+      {back}
+      <div className="page-heading gap-4 flex justify-between items-center min-h-12 mb-4.5 [&_p]:text-muted-foreground [&_p]:text-[13px] [&_p]:mt-1.25 [&_>_div]:min-w-0 [&_>_div]:wrap-anywhere max-[740px]:items-start max-[740px]:mb-4.5 max-[740px]:[&_p]:leading-[1.6] max-[740px]:[&_>_[data-slot='button']]:mt-0.25">
+        <div>
+          <h1 className="text-[22px] font-semibold tracking-[-0.035em] leading-[1.35]">
+            App catalog
+          </h1>
+          <p>Ready-made apps for the services you use.</p>
+        </div>
+        {action}
+      </div>
+      <div className="list-toolbar flex flex-wrap items-center gap-[10px_16px] mb-4">{toolbar}</div>
+      {children}
+    </div>
+  );
+}
+
+/** The catalog's app count before the feed arrives, as wide as the loaded count. */
+export function CatalogCountSkeleton() {
+  return (
+    <span aria-hidden className="inline-flex items-center">
+      <Skeleton className="h-4 w-20" />
+      {"\u200b"}
+    </span>
+  );
+}
+
+/** Placeholder catalog rows with the loaded rows' spacing, icon, text and button sizes. */
+export function CatalogRowsSkeleton({ count = 10 }: { readonly count?: number }) {
+  return (
+    <div role="status" aria-label="Loading apps" className="border-t border-t-border">
+      {Array.from({ length: count }, (_, index) => (
+        <div
+          key={index}
+          aria-hidden
+          className="flex min-h-18.5 w-full items-center gap-4 border-b border-b-border px-[12px] py-[15px] max-[740px]:grid max-[740px]:grid-cols-[34px_minmax(0,_1fr)_auto] max-[740px]:gap-[4px_12px] max-[740px]:px-0"
+        >
+          <Skeleton className="size-8.5 shrink-0 rounded-[7px] max-[740px]:row-[1_/_3]" />
+          <div className="flex min-w-0 flex-1 flex-col gap-1.25 max-[740px]:col-[2]">
+            <div className="flex h-[19.5px] items-center">
+              <Skeleton className="h-3.5 w-32 max-w-[60%]" />
+            </div>
+            <div className="flex h-4.5 items-center">
+              <Skeleton className="h-3 w-[min(420px,_80%)]" />
+            </div>
+          </div>
+          <Skeleton className="h-8 w-21 rounded-md max-[740px]:col-[3] max-[740px]:row-[1_/_3] max-[740px]:h-11" />
+        </div>
+      ))}
+      <span className="sr-only">Loading apps…</span>
+    </div>
+  );
+}
+
+/** The app catalog while its code or the catalog feed loads. */
+export function CatalogPageSkeleton({ back }: { readonly back: ReactNode }) {
+  return (
+    <CatalogPageFrame
+      back={back}
+      action={<Skeleton aria-hidden className="h-9 w-37 shrink-0 rounded-md" />}
+      toolbar={
+        <>
+          <Skeleton
+            aria-label="Loading app search"
+            className="h-8.75 w-[min(100%,_340px)] max-[740px]:h-11 max-[740px]:w-full"
+          />
+          <CatalogCountSkeleton />
+        </>
+      }
+    >
+      <CatalogRowsSkeleton />
+    </CatalogPageFrame>
+  );
+}
+
 export const approvalsTitle = "Approvals";
 export const approvalsDescription = "Review scheduled runs before they continue.";
 
diff --git a/packages/ui/src/implementation/dashboard/oauth-fields.tsx b/packages/ui/src/implementation/dashboard/oauth-fields.tsx
index b0777db054..6349daa60b 100644
--- a/packages/ui/src/implementation/dashboard/oauth-fields.tsx
+++ b/packages/ui/src/implementation/dashboard/oauth-fields.tsx
@@ -7,7 +7,6 @@ import type { OAuthSubmission } from "../../contracts/credentials.ts";
 import type { FailureProps, Query } from "../../contracts/dashboard.ts";
 import type { ComponentType, ReactNode } from "react";
 import { Button } from "../components/button.tsx";
-import { Checkbox } from "../components/checkbox.tsx";
 import { Input } from "../components/input.tsx";
 import {
   Select,
@@ -111,7 +110,8 @@ export function OAuthFields<A, E>({
   manualClient = false,
   setup: options,
   setupAction,
-  missingClient,
+  registerClient = false,
+  editClient,
   disabled = false,
 }: {
   readonly providerName: string;
@@ -132,14 +132,21 @@ export function OAuthFields<A, E>({
   /** Setup progress covers the Connect action and collapsed Advanced options. */
   readonly setupAction?: ReactNode;
   /**
-   * Hosts that register clients elsewhere supply the way to get one. When no client is available,
-   * the form says so, shows this instead of Connect, and keeps entering details under Advanced.
+   * Whether the person connecting may register an entered client for the organization. With no
+   * client to sign in with, the form then asks who can use the client it enters: everyone, by
+   * default, registered before sign-in, or only this account.
    */
-  readonly missingClient?: ReactNode;
+  readonly registerClient?: boolean;
+  /** A registered client whose details open prefilled; Connect updates it before signing in. */
+  readonly editClient?: OAuthClientId | undefined;
 }) {
   const choices = clientChoices(options, account !== undefined);
+  const editing =
+    editClient === undefined || options === "unresolved"
+      ? undefined
+      : options.clients.find((client) => client.id === editClient);
   const [picked, setPicked] = useState<ClientChoice | undefined>(
-    manualClient ? { kind: "manual" } : undefined,
+    manualClient || editClient !== undefined ? { kind: "manual" } : undefined,
   );
   // A pick that is no longer offered, such as a removed client, falls back to the first choice.
   const choice =
@@ -148,13 +155,15 @@ export function OAuthFields<A, E>({
       : choices.find((offered) => choiceKey(offered) === choiceKey(picked))) ?? choices[0];
   const setup = options;
   const machine = setup !== "unresolved" && setup.grant === "client_credentials";
-  // Without a client to sign in with, entering one is a deliberate choice rather than the default.
+  // Without a client to sign in with, the client entered here can become the organization's.
   const missing =
-    missingClient !== undefined &&
+    registerClient &&
     !machine &&
     choices.length > 0 &&
     choices.every((offered) => offered.kind === "manual");
-  const manual = choice?.kind === "manual" && (!missing || picked?.kind === "manual");
+  const manual = choice?.kind === "manual";
+  // Editing keeps the registered client's secret unless a new one is entered.
+  const updating = manual && editing !== undefined;
   const userScopes =
     setup !== "unresolved" && setup.grant === "authorization_code" ? (setup.userScopes ?? []) : [];
   const requested = setup === "unresolved" ? 0 : setup.scopes.length + userScopes.length;
@@ -173,17 +182,19 @@ export function OAuthFields<A, E>({
     : setup !== "unresolved" && setup.mode === "client-required"
       ? `Executor can’t set up sign-in for ${providerName} automatically. Create an OAuth app there with this redirect URL, then enter its ${details}.`
       : `Use an OAuth app in ${providerName} that allows this redirect URL, and enter its ${details}.`;
-  const [clientId, setClientId] = useState("");
+  const [enteredClientId, setClientId] = useState<string>();
+  const clientId = enteredClientId ?? (updating ? editing.clientId : "");
   const [clientSecret, setClientSecret] = useState("");
+  // Details reopened after a failed sign-in were kept to one account, so they stay that way.
+  const [shared, setShared] = useState(!manualClient);
   const [pending, setPending] = useState(false);
   const [error, setError] = useState<Cause.Cause<E>>();
   const blocked =
     disabled ||
     setupAction !== undefined ||
     choice === undefined ||
-    (missing && !manual) ||
     pending ||
-    (manual && (!clientId.trim() || (needsSecret && !clientSecret.trim())));
+    (manual && (!clientId.trim() || (needsSecret && !updating && !clientSecret.trim())));
   const label = (offered: ClientChoice): ReactNode => {
     switch (offered.kind) {
       case "current":
@@ -228,6 +239,7 @@ export function OAuthFields<A, E>({
                 ? { clientSecret: Redacted.make(clientSecret.trim()) }
                 : {}),
             },
+            ...(updating ? { update: editing.id } : missing && shared ? { register: true } : {}),
           }
         : choice.kind === "registered"
           ? { client: { id: choice.id } }
@@ -288,35 +300,15 @@ export function OAuthFields<A, E>({
     window.addEventListener("pageshow", restored);
     return () => window.removeEventListener("pageshow", restored);
   }, [onPendingChange]);
-  const enterDetails = missing && (
-    <label className="flex items-center gap-2 text-xs font-medium">
-      <Checkbox
-        checked={manual}
-        disabled={pending || disabled}
-        onCheckedChange={(checked) => {
-          setPicked(checked === true ? { kind: "manual" } : undefined);
-          setError(undefined);
-        }}
-      />
-      Enter client details for this account
-    </label>
-  );
   return (
     <>
       {prominent && clientSelect}
       {error ? (
         <Failure cause={error} layout="compact" />
       ) : (
-        <>
-          {missing && !manual && (
-            <p className="text-[13px] leading-5 text-pretty text-muted-foreground">
-              No OAuth client is registered for {providerName}, and Executor doesn’t provide one.
-            </p>
-          )}
-          {manual && (
-            <p className="text-[13px] leading-5 text-pretty text-muted-foreground">{guidance}</p>
-          )}
-        </>
+        manual && (
+          <p className="text-[13px] leading-5 text-pretty text-muted-foreground">{guidance}</p>
+        )
       )}
       {manual && !machine && (
         <div className="field-label flex flex-col gap-2.25 text-[13px] font-medium">
@@ -348,9 +340,10 @@ export function OAuthFields<A, E>({
           </label>
           {acceptsSecret && (
             <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium [&_[data-slot='select-trigger']]:w-full">
-              {needsSecret ? "Client secret" : "Client secret (optional)"}
+              {needsSecret && !updating ? "Client secret" : "Client secret (optional)"}
               <Input
                 type="password"
+                {...(updating ? { placeholder: "Unchanged" } : {})}
                 autoComplete="off"
                 value={clientSecret}
                 onChange={(event) => setClientSecret(event.target.value)}
@@ -360,25 +353,54 @@ export function OAuthFields<A, E>({
           )}
         </>
       )}
+      {manual && missing && setup !== "unresolved" && requested > 0 && (
+        // Creating the provider's OAuth app needs these, so they are part of setup here.
+        <div className="space-y-4">
+          <Permissions label="Permissions to add to the OAuth app" scopes={setup.scopes} />
+          <Permissions label="User token permissions" scopes={userScopes} />
+        </div>
+      )}
+      {manual && missing && (
+        <div className="flex flex-col gap-2.25">
+          <label className="field-label flex flex-col gap-2.25 text-[13px] font-medium [&_[data-slot='select-trigger']]:w-full">
+            Who can use this client
+            <Select
+              value={shared ? "everyone" : "account"}
+              disabled={pending || disabled}
+              onValueChange={(value) => setShared(value === "everyone")}
+            >
+              <SelectTrigger aria-label="Who can use this client">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="everyone">Everyone in the organization</SelectItem>
+                <SelectItem value="account">Only this account</SelectItem>
+              </SelectContent>
+            </Select>
+          </label>
+          <p className="text-xs text-muted-foreground">
+            {shared
+              ? "Registered for the organization before sign-in."
+              : "Used for this account only; nothing is saved for the organization."}
+          </p>
+        </div>
+      )}
       <div className="form-actions flex flex-col gap-3 pt-1">
         {access}
         <div role="group" aria-label="Connection options" className="relative flex flex-col gap-4">
           <div className="flex min-h-9 flex-col max-[740px]:min-h-11">
-            {setupAction ??
-              (missing && !manual ? (
-                missingClient
-              ) : (
-                <Button type="button" className="w-full" disabled={blocked} onClick={connect}>
-                  {pending
-                    ? machine
-                      ? "Connecting…"
-                      : "Preparing sign-in…"
-                    : `${account === undefined ? "Connect" : "Reconnect"} ${providerName}`}
-                </Button>
-              ))}
+            {setupAction ?? (
+              <Button type="button" className="w-full" disabled={blocked} onClick={connect}>
+                {pending
+                  ? machine
+                    ? "Connecting…"
+                    : "Preparing sign-in…"
+                  : `${account === undefined ? "Connect" : "Reconnect"} ${providerName}`}
+              </Button>
+            )}
           </div>
-          {setup !== "unresolved" &&
-          (requested > 0 || missing || (!prominent && clientSelect !== undefined)) ? (
+          {missing ? null : setup !== "unresolved" &&
+            (requested > 0 || (!prominent && clientSelect !== undefined)) ? (
             <details className="group/advanced min-w-0 border-t pt-3">
               <summary className="flex w-fit cursor-pointer list-none items-center gap-1.5 rounded-sm text-xs font-medium text-muted-foreground outline-none transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring [&::-webkit-details-marker]:hidden">
                 <HugeiconsIcon
@@ -395,7 +417,6 @@ export function OAuthFields<A, E>({
                 )}
               </summary>
               <div className="space-y-4 pt-4">
-                {enterDetails}
                 {!prominent && clientSelect}
                 <Permissions label="Requested permissions" scopes={setup.scopes} />
                 <Permissions label="User token permissions" scopes={userScopes} />
diff --git a/packages/ui/src/implementation/dashboard/schedules.tsx b/packages/ui/src/implementation/dashboard/schedules.tsx
index 5519732c68..ed7fdae829 100644
--- a/packages/ui/src/implementation/dashboard/schedules.tsx
+++ b/packages/ui/src/implementation/dashboard/schedules.tsx
@@ -19,7 +19,7 @@ import {
   type ScheduleControls,
   type ScheduleCopyControls,
 } from "../../contracts/schedules.ts";
-import { QueryView, useDashboard, useQuery } from "./context.tsx";
+import { QueryView, useDashboard, usePreload, useQuery } from "./context.tsx";
 import { Alert } from "../components/alert.tsx";
 import { DisabledTooltip } from "../components/disabled-tooltip.tsx";
 import { Button } from "../components/button.tsx";
@@ -105,6 +105,7 @@ type ListProps<E> = {
 };
 function LiveSchedules<E>(props: ListProps<E>) {
   const { bindings, Failure } = props;
+  usePreload(bindings.definitions, bindings.settings);
   const discovery = useQuery(bindings.definitions);
   return (
     <SchedulesLayout>
diff --git a/packages/ui/src/implementation/dashboard/scoped-connections.tsx b/packages/ui/src/implementation/dashboard/scoped-connections.tsx
index 7c16348b6e..660eb5b30c 100644
--- a/packages/ui/src/implementation/dashboard/scoped-connections.tsx
+++ b/packages/ui/src/implementation/dashboard/scoped-connections.tsx
@@ -1,3 +1,9 @@
+/**
+ * Connections the current user owns. The full-access URL reaches every app; each scoped
+ * connection issues its own MCP URL, and edits apply to connected agents immediately. The list
+ * shows every connection as a card, and each scoped connection has its own page, where its access
+ * is edited in place.
+ */
 import {
   useDeferredValue,
   useId,
@@ -17,10 +23,7 @@ import {
   type ConnectionDraft,
   type ConnectionTarget,
   connectionInput,
-  connectionTargetKey,
-  connectionTargetLabel,
-  connectionToolsLabel,
-  connectionEventsLabel,
+  defaultConnectionName,
   type ConnectionKeyBindings,
   type ConnectionKeyMint,
   type ConnectionKeyView,
@@ -30,10 +33,13 @@ import {
 import { HugeiconsIcon } from "@hugeicons/react";
 import {
   Add01Icon,
-  ArrowDown01Icon,
   ArrowLeft02Icon,
-  ArrowRight02Icon,
+  ConnectIcon,
+  Copy01Icon,
+  Delete02Icon,
+  MoreHorizontalIcon,
   Search01Icon,
+  Tick02Icon,
 } from "@hugeicons/core-free-icons";
 import { Button } from "../components/button.tsx";
 import { Input } from "../components/input.tsx";
@@ -46,11 +52,27 @@ import {
   DialogDescription,
   DialogFooter,
 } from "../components/dialog.tsx";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "../components/dropdown-menu.tsx";
 import { Popover, PopoverContent, PopoverTrigger } from "../components/popover.tsx";
 import { Skeleton } from "../components/skeleton.tsx";
 import { LocalTime, RelativeTime, shortMoment } from "../components/local-time.tsx";
-import { PageFrame, PageHeader } from "./page.tsx";
-import { QueryView } from "./context.tsx";
+import { cn } from "../lib/utils.ts";
+import { PageFrame } from "./page.tsx";
+import {
+  allResults,
+  LoadingRows,
+  QueryResult,
+  QueryView,
+  usePreload,
+  useQuery,
+} from "./context.tsx";
+import { Code } from "./code.tsx";
 import { AppIcon } from "./common.tsx";
 import {
   appChoices,
@@ -58,13 +80,9 @@ import {
   accountOption,
   initialSelection,
   selectionIssue,
-  declaresEvents,
   type AppChoices,
 } from "./connection-app-picker.tsx";
 import { useIncrementalList } from "./incremental-list.tsx";
-import { McpInstallInstructions } from "./connect.tsx";
-import { Code } from "./code.tsx";
-import { publicDocsBaseUrl } from "../../contracts/documentation.ts";
 
 /** Each host supplies its existing authorized catalog read of the app's tools. */
 export interface ConnectionToolPickerProps {
@@ -73,28 +91,275 @@ export interface ConnectionToolPickerProps {
   readonly onChange: (names: readonly ToolName[]) => void;
 }
 
-type View =
-  | { readonly kind: "list" }
-  | { readonly kind: "detail"; readonly connection: ConnectionId }
-  | { readonly kind: "editor"; readonly draft: ConnectionDraft; readonly existing: boolean };
+/** Host routing remains typed by that host's router. */
+export interface ConnectionLinkProps {
+  /** The connection's page, `new` for the page that creates one, or the list when omitted. */
+  readonly connection?: ConnectionId | "new";
+  readonly className?: string;
+  readonly children: ReactNode;
+}
+
+/** The URL an agent connects to; `apps` is undefined for the full-access URL. */
+export interface ConnectTarget {
+  readonly name: string;
+  readonly url: string;
+  readonly apps: readonly string[] | undefined;
+}
+
+/** What both connection pages read and render through the host. */
+interface ConnectionPageBindings<
+  E,
+  EL extends E,
+  ES extends E,
+  ER extends E,
+> extends ScopedConnectionBindings<EL, ES, ER> {
+  readonly query: Query<Inventory, E>;
+  /** Renders every failure: inventory, connection reads, saves and revocation. */
+  readonly Failure: ComponentType<FailureProps<E>>;
+  readonly ConnectionLink: ComponentType<ConnectionLinkProps>;
+  /** How an agent connects to a target's URL, shown in the Connect dialog. */
+  readonly renderInstallation: (target: ConnectTarget) => ReactNode;
+  /** Mints keys bound to one connection, when the host issues them. */
+  readonly mintKey?: ConnectionKeyMint<E>;
+  /** Lists and revokes one connection's keys, when the host issues them. */
+  readonly keys?: ConnectionKeyBindings<E>;
+}
 
 const plural = (count: number, one: string, many = `${one}s`) =>
   `${count.toLocaleString("en-US")} ${count === 1 ? one : many}`;
 
-/** Every account choice per app, computed once per inventory. */
-const inventoryChoices = (inventory: Inventory) =>
-  new Map<AppId, AppChoices>(
+/** The inventory and connections as one read, so both pages wait for and report them once. */
+function ConnectionReads<E, EL extends E>({
+  query,
+  connections,
+  Failure,
+  pending,
+  children,
+}: {
+  readonly query: Query<Inventory, E>;
+  readonly connections: Query<readonly ConnectionView[], EL>;
+  readonly Failure: ComponentType<FailureProps<E>>;
+  readonly pending: ReactNode;
+  readonly children: (inventory: Inventory, connections: readonly ConnectionView[]) => ReactNode;
+}) {
+  usePreload(query, connections);
+  const inventory = useQuery(query);
+  const stored = useQuery(connections);
+  return (
+    <QueryResult<{ inventory: Inventory; stored: readonly ConnectionView[] }, E>
+      result={allResults({ inventory: inventory.result, stored: stored.result })}
+      Failure={Failure}
+      retry={() => {
+        inventory.refresh();
+        stored.refresh();
+      }}
+      pending={pending}
+    >
+      {(value) => children(value.inventory, value.stored)}
+    </QueryResult>
+  );
+}
+
+interface ConnectionCardView {
+  readonly id: ConnectionId | undefined;
+  readonly name: string;
+  readonly url: string;
+  readonly apps: readonly { readonly app: App | undefined; readonly name: string }[];
+}
+
+/** The full-access URL first, then each scoped connection. */
+const connectionCards = (
+  endpoint: string,
+  connections: readonly ConnectionView[],
+  apps: readonly App[],
+): readonly ConnectionCardView[] => {
+  const byId = new Map<AppId, App>(apps.map((app) => [app.id, app]));
+  return [
+    {
+      id: undefined,
+      name: "Full access",
+      url: endpoint,
+      apps: apps.map((app) => ({ app, name: app.name })),
+    },
+    ...connections.map((connection) => ({
+      id: connection.id,
+      name: connection.name,
+      url: connection.url,
+      apps: connection.policy.apps.map((item) => {
+        const app = byId.get(item.app);
+        return { app, name: app?.name ?? "Unavailable app" };
+      }),
+    })),
+  ];
+};
+
+/** Every connection as a card; each opens the Connect dialog, and a scoped one opens its page. */
+export function ScopedConnectionsPage<E, EL extends E, ES extends E, ER extends E>({
+  endpoint,
+  agents,
+  ...bindings
+}: ConnectionPageBindings<E, EL, ES, ER> & {
+  /** The full-access URL. */
+  readonly endpoint: string;
+  /** The agents connected through these URLs, when the host lists them. */
+  readonly agents?: ReactNode;
+}) {
+  const { query, connections, Failure, ConnectionLink, renderInstallation } = bindings;
+  const [connecting, setConnecting] = useState<ConnectionCardView>();
+  return (
+    <PageFrame>
+      <header className="mb-6 flex flex-wrap items-start justify-between gap-4">
+        <div>
+          <h1 className="text-[22px] font-semibold tracking-[-0.035em]">Connections</h1>
+          <p className="mt-1 text-[13px] text-muted-foreground">
+            Each connection gives an agent its own MCP URL that reaches only the apps you pick.
+          </p>
+        </div>
+        <Button asChild>
+          <ConnectionLink connection="new">
+            <HugeiconsIcon icon={Add01Icon} strokeWidth={2} aria-hidden />
+            New connection
+          </ConnectionLink>
+        </Button>
+      </header>
+      <ConnectionReads
+        query={query}
+        connections={connections}
+        Failure={Failure}
+        pending={<LoadingRows count={4} />}
+      >
+        {(inventory, stored) => (
+          <div
+            role="list"
+            aria-label="Connections"
+            className="grid grid-cols-3 gap-4 max-[1100px]:grid-cols-2 max-[600px]:grid-cols-1"
+          >
+            {connectionCards(endpoint, stored, inventory.apps).map((card) => (
+              <ConnectionCard
+                key={card.id ?? "full"}
+                connection={card}
+                ConnectionLink={ConnectionLink}
+                onConnect={setConnecting}
+              />
+            ))}
+          </div>
+        )}
+      </ConnectionReads>
+      {agents}
+      <ConnectDialog
+        target={
+          connecting === undefined
+            ? undefined
+            : {
+                name: connecting.name,
+                url: connecting.url,
+                apps:
+                  connecting.id === undefined ? undefined : connecting.apps.map((app) => app.name),
+              }
+        }
+        renderInstallation={renderInstallation}
+        onClose={() => setConnecting(undefined)}
+      />
+    </PageFrame>
+  );
+}
+
+function ConnectDialog({
+  target,
+  renderInstallation,
+  onClose,
+}: {
+  readonly target: ConnectTarget | undefined;
+  readonly renderInstallation: (target: ConnectTarget) => ReactNode;
+  readonly onClose: () => void;
+}) {
+  return (
+    <Dialog open={target !== undefined} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="sm:max-w-xl">
+        <DialogHeader>
+          <DialogTitle>Connect {target?.name}</DialogTitle>
+          <DialogDescription>
+            {target?.apps === undefined
+              ? "This URL reaches every app. Make a new connection to limit what an agent sees."
+              : `This URL only reaches ${target.apps.join(", ")}.`}
+          </DialogDescription>
+        </DialogHeader>
+        {target && renderInstallation(target)}
+      </DialogContent>
+    </Dialog>
+  );
+}
+
+/** A scoped card opens its page; the stretched name link keeps Connect a separate button. */
+function ConnectionCard({
+  connection,
+  ConnectionLink,
+  onConnect,
+}: {
+  readonly connection: ConnectionCardView;
+  readonly ConnectionLink: ComponentType<ConnectionLinkProps>;
+  readonly onConnect: (connection: ConnectionCardView) => void;
+}) {
+  const shown = connection.apps.slice(0, 4);
+  return (
+    <div
+      role="listitem"
+      aria-label={connection.name}
+      className="relative flex min-h-56 flex-col rounded-xl border border-border p-4 transition-colors has-[a:hover]:border-muted-foreground/40 has-[a:hover]:bg-muted/60 has-[a:focus-visible]:ring-2 has-[a:focus-visible]:ring-ring max-[600px]:min-h-0"
+    >
+      <span className="flex items-center gap-2">
+        {connection.id === undefined ? (
+          <span className="text-[14px] font-medium">{connection.name}</span>
+        ) : (
+          <ConnectionLink
+            connection={connection.id}
+            className="text-[14px] font-medium after:absolute after:inset-0 after:rounded-xl"
+          >
+            {connection.name}
+          </ConnectionLink>
+        )}
+        {connection.id === undefined && (
+          <span className="rounded-md border border-border px-1.5 py-px text-[11px] text-muted-foreground">
+            Default
+          </span>
+        )}
+      </span>
+      <ul className="mt-4 grid gap-1.5">
+        {shown.map((item) => (
+          <li key={item.name} className="flex items-center gap-2.5 text-[13px]">
+            <AppIcon app={item.app} name={item.name} />
+            <span className="min-w-0 flex-1 truncate">{item.name}</span>
+          </li>
+        ))}
+        {connection.apps.length > shown.length && (
+          <li className="pl-11 text-[12px] text-muted-foreground">
+            and {connection.apps.length - shown.length} more
+          </li>
+        )}
+      </ul>
+      <div className="relative z-10 mt-auto pt-4">
+        <Button size="sm" variant="outline" onClick={() => onConnect(connection)}>
+          <HugeiconsIcon icon={ConnectIcon} strokeWidth={2} aria-hidden />
+          Connect
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+const choicesFor = (inventory: Inventory): ReadonlyMap<AppId, AppChoices> =>
+  new Map(
     inventory.apps.map((app) => [app.id, appChoices(app, inventory.links, inventory.accounts)]),
   );
 
-/** Show a stored connection with current names; removed apps and accounts stay visible as such. */
-const connectionDraft = (
+/** A stored connection as an editable draft, keeping removed apps and accounts visible. */
+const draftFrom = (
   connection: ConnectionView,
   choices: ReadonlyMap<AppId, AppChoices>,
 ): ConnectionDraft => ({
   id: connection.id,
   name: connection.name,
-  apps: connection.policy.apps.map((item) => {
+  apps: connection.policy.apps.map((item): ConnectionApp => {
     const choice = choices.get(item.app);
     return {
       id: item.app,
@@ -112,267 +377,469 @@ const connectionDraft = (
   }),
 });
 
-const newDraft = (): ConnectionDraft => ({
-  id: ConnectionId.make(crypto.randomUUID()),
-  name: "",
-  apps: [],
-});
-
 /**
- * Connections the current user owns. The default connection keeps every app; scoped
- * connections each issue their own MCP URL, and edits apply to connected agents immediately.
+ * One connection's page: its name, how to connect an agent, and which apps it reaches, edited in
+ * place. `new` creates one.
  */
-export function ScopedConnectionsPage<
-  E,
-  EL extends E,
-  ES extends E,
-  ER extends E,
-  EK extends E = never,
->({
-  query,
-  connections,
+export function ScopedConnectionPage<E, EL extends E, ES extends E, ER extends E>({
+  connectionId,
+  ...props
+}: ConnectionPageBindings<E, EL, ES, ER> &
+  ConnectionFormActions & {
+    readonly connectionId: string;
+  }) {
+  // Chosen once, so a retried create returns the same connection.
+  const [created] = useState(() => ConnectionId.make(crypto.randomUUID()));
+  return (
+    <PageFrame>
+      <ConnectionReads
+        query={props.query}
+        connections={props.connections}
+        Failure={props.Failure}
+        pending={<LoadingRows count={5} />}
+      >
+        {(inventory, connections) => {
+          const choices = choicesFor(inventory);
+          if (connectionId === "new")
+            return (
+              <ConnectionForm
+                {...props}
+                key="new"
+                choices={choices}
+                accounts={inventory.accounts}
+                stored={undefined}
+                initial={{ id: created, name: "", apps: [] }}
+              />
+            );
+          const stored = connections.find((item) => item.id === connectionId);
+          if (stored === undefined)
+            return (
+              <>
+                <BackLink ConnectionLink={props.ConnectionLink} />
+                <h1 className="text-[22px] font-semibold tracking-[-0.035em]">
+                  Connection unavailable
+                </h1>
+                <p className="mt-1 text-[13px] text-muted-foreground">
+                  It was revoked or no longer exists.
+                </p>
+              </>
+            );
+          return (
+            <ConnectionForm
+              {...props}
+              key={`${stored.id}:${stored.name}:${JSON.stringify(stored.policy)}`}
+              choices={choices}
+              accounts={inventory.accounts}
+              stored={stored}
+              initial={draftFrom(stored, choices)}
+            />
+          );
+        }}
+      </ConnectionReads>
+    </PageFrame>
+  );
+}
+
+/** Where the host goes after a write, and how an app without an account gets one. */
+interface ConnectionFormActions {
+  readonly onCreated: (connection: ConnectionId) => void;
+  readonly onRevoked: () => void;
+  readonly renderTools: (props: ConnectionToolPickerProps) => ReactNode;
+  readonly renderConnectAccount?: (app: App) => ReactNode;
+}
+
+function BackLink({
+  ConnectionLink,
+}: {
+  readonly ConnectionLink: ComponentType<ConnectionLinkProps>;
+}) {
+  return (
+    <Button variant="ghost" size="sm" className="mb-5 -ml-2 text-muted-foreground" asChild>
+      <ConnectionLink>
+        <HugeiconsIcon icon={ArrowLeft02Icon} size={15} />
+        Connections
+      </ConnectionLink>
+    </Button>
+  );
+}
+
+function ConnectionForm<E, EL extends E, ES extends E, ER extends E>({
+  choices,
+  accounts,
+  stored,
+  initial,
   save,
   revoke,
-  mintKey,
-  keys,
   Failure,
-  installation,
-  agents,
-  docs = publicDocsBaseUrl,
+  ConnectionLink,
+  renderInstallation,
   renderTools,
-}: ScopedConnectionBindings<EL, ES, ER> & {
-  /** Mints keys bound to one connection, when the host issues them. */
-  readonly mintKey?: ConnectionKeyMint<EK>;
-  /** Lists and revokes one connection's keys, when the host issues them. */
-  readonly keys?: ConnectionKeyBindings<EK>;
-  readonly query: Query<Inventory, E>;
-  /** Renders every failure: inventory, connection reads, saves and revocation. */
-  readonly Failure: ComponentType<FailureProps<E>>;
-  readonly installation: ReactNode;
-  /** The agents connected through these URLs, when the host lists them. */
-  readonly agents?: ReactNode;
-  /** Documentation the setup prompt points agents to. */
-  readonly docs?: string;
-  readonly renderTools: (props: ConnectionToolPickerProps) => ReactNode;
-}) {
-  const [view, setView] = useState<View>({ kind: "list" });
-  const [revoking, setRevoking] = useState<ConnectionView>();
-  const [minting, setMinting] = useState<ConnectionView>();
-  const submitRevoke = useAtomSet(revoke, { mode: "promiseExit" });
-  const revokeState = useAtomValue(revoke);
-  const back = () => setView({ kind: "list" });
-  const create = () => setView({ kind: "editor", draft: newDraft(), existing: false });
+  renderConnectAccount,
+  onCreated,
+  onRevoked,
+  mintKey,
+  keys,
+}: ConnectionPageBindings<E, EL, ES, ER> &
+  ConnectionFormActions & {
+    readonly choices: ReadonlyMap<AppId, AppChoices>;
+    readonly accounts: Inventory["accounts"];
+    /** Undefined while creating. */
+    readonly stored: ConnectionView | undefined;
+    readonly initial: ConnectionDraft;
+  }) {
+  const submit = useAtomSet(save, { mode: "promiseExit" });
+  const saving = useAtomValue(save);
+  const [draft, setDraft] = useState(initial);
+  const [expanded, setExpanded] = useState<AppId>();
+  const [connecting, setConnecting] = useState(false);
+  const [revoking, setRevoking] = useState(false);
+  const [minting, setMinting] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const [search, setSearch] = useState("");
+  const [needsSetupOnly, setNeedsSetupOnly] = useState(false);
+  const query = useDeferredValue(search.trim().toLowerCase());
+  const nameId = useId();
+  // Included apps stay on top in a fixed order so rows never jump while you toggle them.
+  const [pinned] = useState(() => new Set(initial.apps.map((app) => app.id)));
+  const ordered = useMemo(
+    () =>
+      [...choices.values()].toSorted(
+        (a, b) =>
+          Number(pinned.has(b.app.id)) - Number(pinned.has(a.app.id)) ||
+          a.app.name.localeCompare(b.app.name),
+      ),
+    [choices, pinned],
+  );
+  const selections = new Map(draft.apps.map((app) => [app.id, app]));
+  const unavailable = draft.apps.filter((app) => !choices.has(app.id));
+  const attention = new Set(
+    draft.apps.flatMap((selection) => {
+      const choice = choices.get(selection.id);
+      return choice !== undefined && selectionIssue(choice, selection) !== undefined
+        ? [selection.id]
+        : [];
+    }),
+  );
+  const blocked = attention.size + unavailable.length;
+  const visible = ordered.filter(
+    (choice) =>
+      (!needsSetupOnly || attention.has(choice.app.id)) &&
+      (query === "" || choice.app.name.toLowerCase().includes(query)),
+  );
+  const included = visible.filter((choice) => pinned.has(choice.app.id));
+  const others = visible.filter((choice) => !pinned.has(choice.app.id));
+  const { count, sentinel } = useIncrementalList(others.length, `${query}:${needsSetupOnly}`);
+  const addable = visible.filter((choice) => !selections.has(choice.app.id));
+  const unassigned = draft.apps.filter(
+    (app) => app.targets.length === 0 && (choices.get(app.id)?.options.length ?? 0) > 0,
+  );
+  const input = connectionInput(draft);
+  const creating = stored === undefined;
+  const dirty = creating || JSON.stringify(input) !== JSON.stringify(connectionInput(initial));
+  const valid = input !== undefined && draft.apps.length > 0 && blocked === 0;
+  const setSelection = (id: AppId, next: ConnectionApp | undefined) =>
+    setDraft((previous) => ({
+      ...previous,
+      apps:
+        next === undefined
+          ? previous.apps.filter((app) => app.id !== id)
+          : previous.apps.some((app) => app.id === id)
+            ? previous.apps.map((app) => (app.id === id ? next : app))
+            : [...previous.apps, next],
+    }));
+  const renderRow = (choice: AppChoices) => (
+    <ConnectionAppRow
+      key={choice.app.id}
+      choices={choice}
+      selection={selections.get(choice.app.id)}
+      expanded={expanded === choice.app.id}
+      onExpandedChange={(open) => setExpanded(open ? choice.app.id : undefined)}
+      onChange={(next) => setSelection(choice.app.id, next)}
+      {...(renderConnectAccount === undefined ? {} : { renderConnectAccount })}
+      renderTools={renderTools}
+    />
+  );
   return (
-    <PageFrame>
-      <div className="max-w-260">
-        {view.kind !== "list" && (
-          <Button
-            variant="ghost"
-            size="sm"
-            className="mb-5 -ml-2 text-muted-foreground"
-            onClick={back}
-          >
-            <HugeiconsIcon icon={ArrowLeft02Icon} size={15} />
-            Connections
-          </Button>
-        )}
-        {view.kind === "list" && (
-          <div className="max-w-190">
-            <PageHeader
-              title="Connect your agent"
-              description="Works with Claude Code, Cursor, Codex, or any MCP client."
-            />
-            <section
-              aria-label="Agent setup"
-              className="mt-2 rounded-xl border bg-muted/20 px-6 pt-5 pb-6 shadow-xs"
-            >
-              <div className="mb-4 flex flex-wrap items-center gap-2">
-                <h2 className="text-sm font-medium">Executor MCP server</h2>
-                <span className="rounded-md bg-muted px-1.5 py-0.5 text-[11px] text-muted-foreground">
-                  Every app you can use
-                </span>
-              </div>
-              {installation}
-            </section>
-            <QueryView<readonly ConnectionView[], E>
-              query={connections}
-              Failure={Failure}
-              pending={<ConnectionListSkeleton />}
-            >
-              {(items) =>
-                items.length === 0 ? (
-                  <p className="mt-8 text-[13px] text-muted-foreground">
-                    Want an agent limited to a few apps or tools?{" "}
-                    <button
-                      type="button"
-                      onClick={create}
-                      className="text-foreground underline decoration-muted-foreground/50 underline-offset-4 hover:decoration-foreground"
-                    >
-                      Create a scoped connection
-                    </button>
-                  </p>
-                ) : (
-                  <section aria-label="Scoped connections" className="mt-10">
-                    <div className="mb-2 flex items-center justify-between gap-3">
-                      <h2 className="text-xs font-medium text-muted-foreground">
-                        Scoped connections
-                      </h2>
-                      <Button
-                        variant="ghost"
-                        size="xs"
-                        className="text-muted-foreground"
-                        onClick={create}
-                      >
-                        <HugeiconsIcon icon={Add01Icon} size={13} />
-                        New scoped connection
-                      </Button>
-                    </div>
-                    <ConnectionList
-                      items={items}
-                      query={query}
-                      onOpen={(connection) => setView({ kind: "detail", connection })}
-                    />
-                  </section>
-                )
-              }
-            </QueryView>
-            {agents}
-          </div>
-        )}
-        {view.kind === "editor" && (
-          <>
-            <PageHeader
-              title={view.existing ? "Edit connection" : "New connection"}
-              description="Turn on the apps this agent needs. Everything else stays off. Approval rules come from each app’s code."
-            />
-            <QueryView query={query} Failure={Failure}>
-              {(inventory) => (
-                <ConnectionEditor
-                  key={view.draft.id}
-                  initial={view.draft}
-                  existing={view.existing}
-                  inventory={inventory}
-                  renderTools={renderTools}
-                  save={save}
-                  Failure={Failure}
-                  onCancel={back}
-                  onSaved={(saved) => setView({ kind: "detail", connection: saved.id })}
-                />
-              )}
-            </QueryView>
-          </>
-        )}
-        {view.kind === "detail" && (
-          <QueryView<readonly ConnectionView[], E> query={connections} Failure={Failure}>
-            {(items) => {
-              const connection = items.find((item) => item.id === view.connection);
-              if (connection === undefined)
-                return (
-                  <PageHeader
-                    title="Connection unavailable"
-                    description="This connection was revoked or no longer exists."
-                  />
-                );
-              return (
-                <QueryView query={query} Failure={Failure}>
-                  {(inventory) => {
-                    const draft = connectionDraft(connection, inventoryChoices(inventory));
-                    return (
-                      <>
-                        <PageHeader
-                          title={connection.name}
-                          description={`${plural(connection.policy.apps.length, "app")}. Every other app is excluded. Approval rules come from each app’s code.`}
-                        >
-                          <Button
-                            variant="outline"
-                            onClick={() => setView({ kind: "editor", draft, existing: true })}
-                          >
-                            Edit access
-                          </Button>
-                          {mintKey !== undefined && (
-                            <Button variant="outline" onClick={() => setMinting(connection)}>
-                              Create connection key
-                            </Button>
-                          )}
-                          <Button
-                            variant="ghost"
-                            className="text-destructive"
-                            onClick={() => setRevoking(connection)}
-                          >
-                            Revoke
-                          </Button>
-                        </PageHeader>
-                        <ConnectionAccessList apps={draft.apps} inventory={inventory} />
-                        {keys !== undefined && (
-                          <ConnectionKeys connection={connection} keys={keys} Failure={Failure} />
-                        )}
-                        <section className="mt-8 max-w-190">
-                          <h2 className="mb-3 text-sm font-medium">Connect your agent</h2>
-                          <McpInstallInstructions
-                            endpoint={connection.url}
-                            docs={docs}
-                            next="show me which apps and tools this connection can use"
-                          />
-                        </section>
-                      </>
-                    );
-                  }}
-                </QueryView>
-              );
-            }}
-          </QueryView>
-        )}
-      </div>
-      <Dialog
-        open={revoking !== undefined}
-        onOpenChange={(open) => {
-          if (!open && !revokeState.waiting) setRevoking(undefined);
+    <>
+      <form
+        className="max-w-220"
+        onSubmit={async (event) => {
+          event.preventDefault();
+          if (!valid || saving.waiting) return;
+          const saved = await submit({ existing: !creating, input });
+          if (Exit.isSuccess(saved) && creating) onCreated(saved.value.id);
         }}
       >
-        <DialogContent>
-          <DialogHeader>
-            <DialogTitle>Revoke {revoking?.name}?</DialogTitle>
-            <DialogDescription>
-              Agents using this connection lose access immediately. Its URL stops working.
-            </DialogDescription>
-          </DialogHeader>
-          {AsyncResult.isFailure(revokeState) && <Failure cause={revokeState.cause} />}
-          <DialogFooter>
+        <BackLink ConnectionLink={ConnectionLink} />
+        <header className="flex items-start justify-between gap-4 max-[600px]:flex-col">
+          <div className="min-w-0 flex-1">
+            <h1 className="truncate text-[22px] font-semibold tracking-[-0.035em]">
+              {stored?.name ?? "New connection"}
+            </h1>
+            <p className="mt-1 text-[13px] text-muted-foreground">
+              {creating
+                ? "Turn on the apps this agent needs. It can't see anything else."
+                : "Agents using this connection see only the apps turned on below. Changes apply right away."}
+            </p>
+          </div>
+          {stored !== undefined && (
+            <div className="flex items-center gap-2">
+              <Button type="button" variant="outline" onClick={() => setConnecting(true)}>
+                <HugeiconsIcon icon={ConnectIcon} strokeWidth={2} aria-hidden />
+                Connect
+              </Button>
+              {mintKey !== undefined && (
+                <Button type="button" variant="outline" onClick={() => setMinting(true)}>
+                  Create connection key
+                </Button>
+              )}
+              <DropdownMenu onOpenChange={(open) => !open && setCopied(false)}>
+                <DropdownMenuTrigger asChild>
+                  <Button type="button" variant="outline" size="icon" aria-label="More actions">
+                    <HugeiconsIcon icon={MoreHorizontalIcon} strokeWidth={2} />
+                  </Button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                  align="end"
+                  sideOffset={6}
+                  collisionPadding={16}
+                  className="w-52 p-1.5"
+                >
+                  <DropdownMenuItem
+                    className="gap-2.5 py-2"
+                    onSelect={(event) => {
+                      event.preventDefault();
+                      void navigator.clipboard.writeText(stored.url).then(() => setCopied(true));
+                    }}
+                  >
+                    <HugeiconsIcon icon={copied ? Tick02Icon : Copy01Icon} strokeWidth={2} />
+                    {copied ? "Copied" : "Copy MCP URL"}
+                  </DropdownMenuItem>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem
+                    variant="destructive"
+                    className="gap-2.5 py-2"
+                    onSelect={() => setRevoking(true)}
+                  >
+                    <HugeiconsIcon icon={Delete02Icon} strokeWidth={2} />
+                    Revoke connection
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </div>
+          )}
+        </header>
+
+        <div className="mt-6 max-w-md space-y-2">
+          <Label htmlFor={nameId}>Name</Label>
+          <Input
+            id={nameId}
+            maxLength={80}
+            // Unnamed, it is named for its apps; the placeholder shows that name.
+            placeholder={defaultConnectionName(draft.apps)}
+            value={draft.name}
+            onChange={(event) =>
+              setDraft((previous) => ({ ...previous, name: event.target.value }))
+            }
+          />
+        </div>
+
+        {unavailable.length > 0 && (
+          <div className="mt-6 flex flex-wrap items-center justify-between gap-2 rounded-lg border border-amber-500/40 px-4 py-3 text-[13px]">
+            <span>
+              {plural(unavailable.length, "app")} in this connection{" "}
+              {unavailable.length === 1 ? "no longer exists" : "no longer exist"}:{" "}
+              {unavailable.map((app) => app.name).join(", ")}
+            </span>
             <Button
+              type="button"
               variant="outline"
-              disabled={revokeState.waiting}
-              onClick={() => setRevoking(undefined)}
+              size="sm"
+              onClick={() =>
+                setDraft((previous) => ({
+                  ...previous,
+                  apps: previous.apps.filter((app) => choices.has(app.id)),
+                }))
+              }
             >
-              Cancel
+              Remove
             </Button>
+          </div>
+        )}
+
+        <div className="mt-8 flex flex-wrap items-center gap-2">
+          <SearchInput
+            label="Search apps"
+            placeholder={`Search ${plural(choices.size, "app")}…`}
+            value={search}
+            onChange={setSearch}
+          />
+          {query !== "" && addable.length > 1 && (
             <Button
-              variant="destructive"
-              loading={revokeState.waiting}
-              disabled={revokeState.waiting}
-              onClick={async () => {
-                if (revoking === undefined) return;
-                const result = await submitRevoke(revoking.id);
-                if (Exit.isSuccess(result)) {
-                  setRevoking(undefined);
-                  back();
-                }
-              }}
+              type="button"
+              variant="outline"
+              onClick={() =>
+                setDraft((previous) => ({
+                  ...previous,
+                  apps: [...previous.apps, ...addable.map(initialSelection)],
+                }))
+              }
+            >
+              Turn on {plural(addable.length, "match", "matches")}
+            </Button>
+          )}
+          {unassigned.length > 0 && (
+            <AssignAccount
+              apps={unassigned}
+              byId={choices}
+              accounts={accounts}
+              onAssign={(account) =>
+                setDraft((previous) => ({
+                  ...previous,
+                  apps: previous.apps.map((app) => {
+                    const choice = choices.get(app.id);
+                    const option =
+                      choice === undefined ? undefined : accountOption(choice, account);
+                    return app.targets.length === 0 && option !== undefined
+                      ? { ...app, targets: [option.target] }
+                      : app;
+                  }),
+                }))
+              }
+            />
+          )}
+        </div>
+        {needsSetupOnly && (
+          <p className="mt-3 text-xs text-muted-foreground">
+            Showing apps that need setup.{" "}
+            <button
+              type="button"
+              className="text-foreground underline underline-offset-2"
+              onClick={() => setNeedsSetupOnly(false)}
             >
-              Revoke connection
+              Show all
+            </button>
+          </p>
+        )}
+
+        {included.length > 0 && (
+          <AppSection
+            title="Can use"
+            count={draft.apps.filter((app) => pinned.has(app.id)).length}
+            hint={undefined}
+          >
+            {included.map(renderRow)}
+          </AppSection>
+        )}
+        {others.length > 0 && (
+          <AppSection
+            title={pinned.size > 0 ? "Other apps" : "Apps"}
+            count={undefined}
+            hint={
+              pinned.size > 0 && !others.some((choice) => selections.has(choice.app.id))
+                ? "Turn one on to give this agent access."
+                : undefined
+            }
+          >
+            {others.slice(0, count).map(renderRow)}
+          </AppSection>
+        )}
+        {sentinel}
+        {visible.length === 0 && (
+          <p className="mt-8 rounded-lg border px-4 py-10 text-center text-[13px] text-muted-foreground">
+            {query !== "" ? "No apps match your search." : "Every app that's on is ready."}
+          </p>
+        )}
+
+        <div
+          className={cn(
+            "sticky bottom-0 z-10 mt-6 flex flex-wrap items-center justify-between gap-3 border-t bg-background py-4",
+            !dirty && "invisible",
+          )}
+        >
+          <p className="text-xs text-muted-foreground">
+            {draft.apps.length === 0 ? (
+              "No apps turned on"
+            ) : blocked > 0 ? (
+              <button
+                type="button"
+                className="text-amber-600 underline underline-offset-2 dark:text-amber-400"
+                onClick={() => {
+                  setSearch("");
+                  setNeedsSetupOnly(true);
+                }}
+              >
+                {plural(blocked, "app")} {blocked === 1 ? "needs" : "need"} setup before saving
+              </button>
+            ) : creating ? (
+              `${plural(draft.apps.length, "app")} turned on`
+            ) : (
+              "Unsaved changes"
+            )}
+          </p>
+          <div className="flex gap-2">
+            {creating ? (
+              <Button type="button" variant="outline" asChild>
+                <ConnectionLink>Cancel</ConnectionLink>
+              </Button>
+            ) : (
+              <Button
+                type="button"
+                variant="outline"
+                disabled={saving.waiting}
+                onClick={() => setDraft(initial)}
+              >
+                Discard
+              </Button>
+            )}
+            <Button type="submit" disabled={!valid || saving.waiting} loading={saving.waiting}>
+              {creating ? "Create connection" : "Save changes"}
             </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
-      {mintKey !== undefined && minting !== undefined && (
-        <ConnectionKeyDialog
-          key={minting.id}
-          connection={minting}
-          mintKey={mintKey}
-          Failure={Failure}
-          onClose={() => setMinting(undefined)}
-        />
+          </div>
+          {AsyncResult.isFailure(saving) && (
+            <div className="w-full">
+              <Failure cause={saving.cause} />
+            </div>
+          )}
+        </div>
+      </form>
+      {stored !== undefined && keys !== undefined && (
+        <ConnectionKeys connection={stored} keys={keys} Failure={Failure} />
       )}
-    </PageFrame>
+      {stored !== undefined && (
+        <>
+          {mintKey !== undefined && minting && (
+            <ConnectionKeyDialog
+              key={stored.id}
+              connection={stored}
+              mintKey={mintKey}
+              Failure={Failure}
+              onClose={() => setMinting(false)}
+            />
+          )}
+          <ConnectDialog
+            target={
+              connecting
+                ? {
+                    name: stored.name,
+                    url: stored.url,
+                    apps: initial.apps.map((app) => app.name),
+                  }
+                : undefined
+            }
+            renderInstallation={renderInstallation}
+            onClose={() => setConnecting(false)}
+          />
+          <RevokeDialog
+            connection={revoking ? stored : undefined}
+            revoke={revoke}
+            Failure={Failure}
+            onClose={() => setRevoking(false)}
+            onRevoked={onRevoked}
+          />
+        </>
+      )}
+    </>
   );
 }
 
@@ -619,71 +1086,78 @@ function ConnectionKeys<E, EK extends E>({
   );
 }
 
-/** Shares the scoped list's heading and row rhythm so loading does not reflow the page. */
-function ConnectionListSkeleton() {
+function AppSection({
+  title,
+  count,
+  hint,
+  children,
+}: {
+  readonly title: string;
+  readonly count: number | undefined;
+  readonly hint: string | undefined;
+  readonly children: ReactNode;
+}) {
   return (
-    <section role="status" aria-label="Loading scoped connections" className="mt-10">
-      <div aria-hidden className="mb-2 flex h-6 items-center">
-        <Skeleton className="h-3 w-28" />
-      </div>
-      <div aria-hidden className="divide-y border-y">
-        {["w-36", "w-24"].map((width) => (
-          <div key={width} className="flex items-center gap-4 px-1 py-3">
-            <div className="min-w-0 flex-1 space-y-2 py-px">
-              <Skeleton className={`h-3 ${width}`} />
-              <Skeleton className="h-2.5 w-48 max-w-[60%]" />
-            </div>
-            <Skeleton className="h-2.5 w-10" />
-          </div>
-        ))}
+    <section aria-label={title} className="mt-8">
+      <div className="mb-2 flex items-baseline gap-2">
+        <h2 className="text-[13px] font-medium">{title}</h2>
+        {count !== undefined && (
+          <span className="text-xs tabular-nums text-muted-foreground">{count}</span>
+        )}
+        {hint && <span className="text-xs text-muted-foreground">{hint}</span>}
       </div>
-      <span className="sr-only">Loading scoped connections…</span>
+      <div className="divide-y overflow-hidden rounded-lg border">{children}</div>
     </section>
   );
 }
 
-/** Saved connections; app names come from the current inventory once it loads. */
-function ConnectionList<E>({
-  items,
-  query,
-  onOpen,
+function RevokeDialog<E, ER extends E>({
+  connection,
+  revoke,
+  Failure,
+  onClose,
+  onRevoked,
 }: {
-  readonly items: readonly ConnectionView[];
-  readonly query: Query<Inventory, E>;
-  readonly onOpen: (connection: ConnectionId) => void;
+  readonly connection: ConnectionView | undefined;
+  readonly revoke: ScopedConnectionBindings<never, never, ER>["revoke"];
+  readonly Failure: ComponentType<FailureProps<E>>;
+  readonly onClose: () => void;
+  readonly onRevoked: () => void;
 }) {
-  const inventory = useAtomValue(query);
-  const names = new Map<AppId, string>(
-    AsyncResult.isSuccess(inventory) ? inventory.value.apps.map((app) => [app.id, app.name]) : [],
-  );
+  const submit = useAtomSet(revoke, { mode: "promiseExit" });
+  const state = useAtomValue(revoke);
   return (
-    <div className="divide-y border-y">
-      {items.map((item) => {
-        const apps = item.policy.apps.map((app) => names.get(app.app) ?? "Unavailable app");
-        return (
-          <button
-            key={item.id}
-            type="button"
-            onClick={() => onOpen(item.id)}
-            className="flex w-full items-center gap-4 px-1 py-3 text-left transition-colors hover:bg-muted/40"
+    <Dialog
+      open={connection !== undefined}
+      onOpenChange={(open) => !open && !state.waiting && onClose()}
+    >
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Revoke {connection?.name}?</DialogTitle>
+          <DialogDescription>
+            Agents using this connection lose access immediately. Its URL stops working.
+          </DialogDescription>
+        </DialogHeader>
+        {AsyncResult.isFailure(state) && <Failure cause={state.cause} />}
+        <DialogFooter>
+          <Button variant="outline" disabled={state.waiting} onClick={onClose}>
+            Cancel
+          </Button>
+          <Button
+            variant="destructive"
+            loading={state.waiting}
+            disabled={state.waiting}
+            onClick={async () => {
+              if (connection === undefined) return;
+              const result = await submit(connection.id);
+              if (Exit.isSuccess(result)) onRevoked();
+            }}
           >
-            <span className="min-w-0 flex-1">
-              <span className="block truncate text-[13px] font-medium">{item.name}</span>
-              <span className="mt-0.5 block truncate text-xs text-muted-foreground">
-                {AsyncResult.isSuccess(inventory) && apps.slice(0, 4).join(", ")}
-                {AsyncResult.isSuccess(inventory) &&
-                  apps.length > 4 &&
-                  ` and ${plural(apps.length - 4, "more", "more")}`}
-              </span>
-            </span>
-            <span className="shrink-0 text-xs text-muted-foreground">
-              {plural(item.policy.apps.length, "app")}
-            </span>
-            <HugeiconsIcon icon={ArrowRight02Icon} size={15} className="text-muted-foreground" />
-          </button>
-        );
-      })}
-    </div>
+            Revoke connection
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
   );
 }
 
@@ -717,46 +1191,6 @@ function SearchInput({
   );
 }
 
-function Tabs<T extends string>({
-  value,
-  options,
-  onChange,
-  label,
-}: {
-  readonly value: T;
-  readonly options: readonly {
-    readonly value: T;
-    readonly label: string;
-    readonly count: number;
-  }[];
-  readonly onChange: (value: T) => void;
-  readonly label: string;
-}) {
-  return (
-    <div role="radiogroup" aria-label={label} className="flex shrink-0 rounded-md border p-0.5">
-      {options.map((option) => (
-        <button
-          key={option.value}
-          type="button"
-          role="radio"
-          aria-checked={value === option.value}
-          onClick={() => onChange(option.value)}
-          className={`rounded px-2.5 py-1 text-xs transition-colors ${
-            value === option.value
-              ? "bg-muted font-medium text-foreground"
-              : "text-muted-foreground hover:text-foreground"
-          }`}
-        >
-          {option.label}
-          <span className="ml-1.5 font-mono text-[10px] text-muted-foreground">
-            {option.count.toLocaleString("en-US")}
-          </span>
-        </button>
-      ))}
-    </div>
-  );
-}
-
 /** Bulk-including apps leaves each waiting for an account; assign one account to all that accept it. */
 function AssignAccount({
   apps,
@@ -828,363 +1262,3 @@ function AssignAccount({
     </Popover>
   );
 }
-
-type Filter = "all" | "selected" | "attention";
-
-function ConnectionEditor<E, ES extends E>({
-  initial,
-  existing,
-  inventory,
-  renderTools,
-  save,
-  Failure,
-  onCancel,
-  onSaved,
-}: {
-  readonly initial: ConnectionDraft;
-  readonly existing: boolean;
-  readonly inventory: Inventory;
-  readonly renderTools: (props: ConnectionToolPickerProps) => ReactNode;
-  readonly save: ScopedConnectionBindings<never, ES, never>["save"];
-  readonly Failure: ComponentType<FailureProps<E>>;
-  readonly onCancel: () => void;
-  readonly onSaved: (connection: ConnectionView) => void;
-}) {
-  const submit = useAtomSet(save, { mode: "promiseExit" });
-  const saving = useAtomValue(save);
-  const [draft, setDraft] = useState(initial);
-  const [search, setSearch] = useState("");
-  const [filter, setFilter] = useState<Filter>(initial.apps.length > 0 ? "selected" : "all");
-  const [expanded, setExpanded] = useState<AppId>();
-  const query = useDeferredValue(search.trim().toLowerCase());
-  const nameId = useId();
-  // Apps already in the connection come first; the order is fixed so rows never jump on toggle.
-  const [pinned] = useState(() => new Set(initial.apps.map((app) => app.id)));
-  const choices = useMemo(() => {
-    return inventory.apps
-      .map((app) => appChoices(app, inventory.links, inventory.accounts))
-      .toSorted(
-        (a, b) =>
-          Number(pinned.has(b.app.id)) - Number(pinned.has(a.app.id)) ||
-          a.app.name.localeCompare(b.app.name),
-      );
-  }, [inventory, pinned]);
-  const byId = useMemo(
-    () => new Map<AppId, AppChoices>(choices.map((choice) => [choice.app.id, choice])),
-    [choices],
-  );
-  const selections = new Map<AppId, ConnectionApp>(draft.apps.map((app) => [app.id, app]));
-  const unavailable = draft.apps.filter((app) => !byId.has(app.id));
-  const attention = new Set<AppId>(
-    draft.apps.flatMap((selection) => {
-      const choice = byId.get(selection.id);
-      return choice !== undefined && selectionIssue(choice, selection) !== undefined
-        ? [selection.id]
-        : [];
-    }),
-  );
-  const visible = choices.filter(
-    (choice) =>
-      (filter === "all" ||
-        (filter === "selected" && selections.has(choice.app.id)) ||
-        (filter === "attention" && attention.has(choice.app.id))) &&
-      (query === "" || choice.app.name.toLowerCase().includes(query)),
-  );
-  const addable = visible.filter((choice) => !selections.has(choice.app.id));
-  const unassigned = draft.apps.filter(
-    (app) => app.targets.length === 0 && (byId.get(app.id)?.options.length ?? 0) > 0,
-  );
-  const { count, sentinel } = useIncrementalList(visible.length, `${query}:${filter}`);
-  const setSelection = (id: AppId, next: ConnectionApp | undefined) =>
-    setDraft((previous) => ({
-      ...previous,
-      apps:
-        next === undefined
-          ? previous.apps.filter((app) => app.id !== id)
-          : previous.apps.some((app) => app.id === id)
-            ? previous.apps.map((app) => (app.id === id ? next : app))
-            : [...previous.apps, next],
-    }));
-  const accountCount = new Set(
-    draft.apps.flatMap((app) =>
-      app.targets.flatMap((target) => (target.kind === "app" ? [] : [connectionTargetKey(target)])),
-    ),
-  ).size;
-  const blocked = attention.size + unavailable.length;
-  const input = connectionInput(draft);
-  const valid =
-    input !== undefined && input.name.length > 0 && draft.apps.length > 0 && blocked === 0;
-  return (
-    <form
-      onSubmit={async (event) => {
-        event.preventDefault();
-        if (!valid || saving.waiting) return;
-        const saved = await submit({ existing, input });
-        if (Exit.isSuccess(saved)) onSaved(saved.value);
-      }}
-    >
-      <div className="mt-6 max-w-md space-y-2">
-        <div className="flex items-center gap-2">
-          <Label htmlFor={nameId}>Name</Label>
-          <span className="rounded-md bg-amber-500/10 px-1.5 py-0.5 text-[11px] font-medium text-amber-700 dark:text-amber-400">
-            Required
-          </span>
-        </div>
-        <Input
-          id={nameId}
-          autoFocus={initial.name.length === 0}
-          placeholder="e.g. Support assistant"
-          required
-          maxLength={80}
-          value={draft.name}
-          onChange={(event) => setDraft((previous) => ({ ...previous, name: event.target.value }))}
-        />
-      </div>
-      {unavailable.length > 0 && (
-        <div className="mt-5 flex flex-wrap items-center justify-between gap-2 rounded-lg border border-amber-500/40 px-4 py-3 text-sm">
-          <span>
-            {plural(unavailable.length, "app")} in this connection{" "}
-            {unavailable.length === 1 ? "is" : "are"} no longer available:{" "}
-            {unavailable.map((app) => app.name).join(", ")}
-          </span>
-          <Button
-            type="button"
-            variant="outline"
-            size="sm"
-            onClick={() =>
-              setDraft((previous) => ({
-                ...previous,
-                apps: previous.apps.filter((app) => byId.has(app.id)),
-              }))
-            }
-          >
-            Remove
-          </Button>
-        </div>
-      )}
-      <section aria-label="Apps" className="mt-6 rounded-lg border">
-        <div className="sticky top-0 z-10 flex flex-wrap items-center gap-2 rounded-t-lg border-b bg-background px-4 py-3">
-          <SearchInput
-            label="Search apps"
-            placeholder={`Search ${plural(choices.length, "app")}…`}
-            value={search}
-            onChange={setSearch}
-          />
-          <Tabs
-            label="Filter apps"
-            value={filter}
-            onChange={setFilter}
-            options={[
-              { value: "all", label: "All", count: choices.length },
-              { value: "selected", label: "Included", count: draft.apps.length },
-              ...(attention.size > 0 || filter === "attention"
-                ? [{ value: "attention" as const, label: "Needs setup", count: attention.size }]
-                : []),
-            ]}
-          />
-          {query !== "" && addable.length > 1 && (
-            <Button
-              type="button"
-              variant="outline"
-              size="sm"
-              onClick={() =>
-                setDraft((previous) => ({
-                  ...previous,
-                  apps: [...previous.apps, ...addable.map(initialSelection)],
-                }))
-              }
-            >
-              Include {plural(addable.length, "match", "matches")}
-            </Button>
-          )}
-          {unassigned.length > 0 && (
-            <AssignAccount
-              apps={unassigned}
-              byId={byId}
-              accounts={inventory.accounts}
-              onAssign={(account) =>
-                setDraft((previous) => ({
-                  ...previous,
-                  apps: previous.apps.map((app) => {
-                    const choices = byId.get(app.id);
-                    const option =
-                      choices === undefined ? undefined : accountOption(choices, account);
-                    return app.targets.length === 0 && option !== undefined
-                      ? { ...app, targets: [option.target] }
-                      : app;
-                  }),
-                }))
-              }
-            />
-          )}
-        </div>
-        <div className="divide-y">
-          {visible.slice(0, count).map((choice) => (
-            <ConnectionAppRow
-              key={choice.app.id}
-              choices={choice}
-              selection={selections.get(choice.app.id)}
-              expanded={expanded === choice.app.id}
-              onExpandedChange={(open) => setExpanded(open ? choice.app.id : undefined)}
-              onChange={(next) => setSelection(choice.app.id, next)}
-              renderTools={renderTools}
-            />
-          ))}
-        </div>
-        {sentinel}
-        {visible.length === 0 && (
-          <div className="px-4 py-10 text-center text-sm text-muted-foreground">
-            {query !== ""
-              ? "No apps match your search."
-              : filter === "selected"
-                ? "No apps included yet. Switch to All to turn some on."
-                : filter === "attention"
-                  ? "Every included app is ready."
-                  : "No apps are available."}
-          </div>
-        )}
-      </section>
-      <div className="sticky bottom-0 z-10 mt-4 flex flex-wrap items-center justify-between gap-3 border-t bg-background py-4">
-        <p className="text-xs text-muted-foreground">
-          {draft.apps.length === 0 ? (
-            "No apps included"
-          ) : (
-            <>
-              {plural(draft.apps.length, "app")}
-              {accountCount > 0 && ` · ${plural(accountCount, "account")}`}
-              {blocked > 0 && (
-                <>
-                  {" · "}
-                  <button
-                    type="button"
-                    className="text-amber-600 underline underline-offset-2 dark:text-amber-400"
-                    onClick={() => setFilter("attention")}
-                  >
-                    {plural(blocked, "app")} {blocked === 1 ? "needs" : "need"} setup
-                  </button>
-                </>
-              )}
-            </>
-          )}
-        </p>
-        <div className="flex gap-2">
-          <Button type="button" variant="outline" disabled={saving.waiting} onClick={onCancel}>
-            Cancel
-          </Button>
-          <Button type="submit" disabled={!valid || saving.waiting} loading={saving.waiting}>
-            {existing ? "Save changes" : "Create connection"}
-          </Button>
-        </div>
-        {AsyncResult.isFailure(saving) && (
-          <div className="w-full">
-            <Failure cause={saving.cause} />
-          </div>
-        )}
-      </div>
-    </form>
-  );
-}
-
-/** Read-only view of a saved connection; long app lists and tool lists render in slices. */
-function ConnectionAccessList({
-  apps,
-  inventory,
-}: {
-  readonly apps: readonly ConnectionApp[];
-  readonly inventory: Inventory;
-}) {
-  const [search, setSearch] = useState("");
-  const [open, setOpen] = useState<AppId>();
-  const query = useDeferredValue(search.trim().toLowerCase());
-  const byId = useMemo(
-    () => new Map<AppId, App>(inventory.apps.map((app) => [app.id, app])),
-    [inventory],
-  );
-  const visible = apps
-    .filter((app) => query === "" || app.name.toLowerCase().includes(query))
-    .toSorted((a, b) => a.name.localeCompare(b.name));
-  const { count, sentinel } = useIncrementalList(visible.length, query);
-  return (
-    <section aria-label="App access" className="mt-6 rounded-lg border">
-      {apps.length > 8 && (
-        <div className="border-b px-4 py-3">
-          <SearchInput
-            label="Search included apps"
-            placeholder={`Search ${plural(apps.length, "included app")}…`}
-            value={search}
-            onChange={setSearch}
-          />
-        </div>
-      )}
-      <div className="divide-y">
-        {visible.slice(0, count).map((selection) => {
-          const app = byId.get(selection.id);
-          const names = selection.tools.kind === "selected" ? selection.tools.names : [];
-          return (
-            <div key={selection.id}>
-              <div className="flex min-h-14 flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2">
-                <AppIcon app={app} name={selection.name} />
-                <span className="min-w-0 flex-1 basis-48">
-                  <span className="block truncate text-[13px] font-medium">{selection.name}</span>
-                  <span className="block truncate text-xs text-muted-foreground">
-                    {app === undefined
-                      ? "No longer available"
-                      : selection.targets.map(connectionTargetLabel).join(", ")}
-                  </span>
-                </span>
-                {selection.tools.kind === "selected" ? (
-                  <Button
-                    type="button"
-                    variant="ghost"
-                    size="sm"
-                    className="text-xs"
-                    aria-expanded={open === selection.id}
-                    onClick={() => setOpen(open === selection.id ? undefined : selection.id)}
-                  >
-                    {connectionToolsLabel(selection.tools)}
-                    <HugeiconsIcon
-                      icon={ArrowDown01Icon}
-                      size={14}
-                      className={open === selection.id ? "rotate-180" : ""}
-                    />
-                  </Button>
-                ) : (
-                  <span className="px-3 text-xs text-muted-foreground">
-                    {connectionToolsLabel(selection.tools)}, including new ones
-                  </span>
-                )}
-                {declaresEvents(app) && (
-                  <span className="px-3 text-xs text-muted-foreground">
-                    {connectionEventsLabel(selection.events)}
-                  </span>
-                )}
-              </div>
-              {open === selection.id && <ToolNames names={names} />}
-            </div>
-          );
-        })}
-      </div>
-      {sentinel}
-      {visible.length === 0 && (
-        <p className="px-4 py-8 text-center text-sm text-muted-foreground">No apps match.</p>
-      )}
-    </section>
-  );
-}
-
-function ToolNames({ names }: { readonly names: readonly string[] }) {
-  const sorted = useMemo(() => names.toSorted(), [names]);
-  const { count, sentinel } = useIncrementalList(sorted.length, "", 200);
-  return (
-    <div className="mx-4 mb-3 max-h-60 overflow-y-auto rounded-md border bg-background p-3 sm:ml-12">
-      <div className="flex flex-wrap gap-1.5">
-        {sorted.slice(0, count).map((name) => (
-          <span key={name} className="rounded border bg-muted/30 px-2 py-0.5 font-mono text-[11px]">
-            {name}
-          </span>
-        ))}
-      </div>
-      {sentinel}
-    </div>
-  );
-}
diff --git a/packages/ui/src/implementation/dashboard/webhook-setup.tsx b/packages/ui/src/implementation/dashboard/webhook-setup.tsx
index 23c386fe25..07162d61c9 100644
--- a/packages/ui/src/implementation/dashboard/webhook-setup.tsx
+++ b/packages/ui/src/implementation/dashboard/webhook-setup.tsx
@@ -11,11 +11,10 @@ import {
   credentialValues,
   credentialsComplete,
 } from "../../contracts/credentials.ts";
-import { CredentialFields } from "../components/credential-fields.tsx";
+import { CredentialFields, CredentialInput } from "../components/credential-fields.tsx";
 import { Button } from "../components/button.tsx";
 import { Card, CardContent } from "../components/card.tsx";
 import { Checkbox } from "../components/checkbox.tsx";
-import { Input } from "../components/input.tsx";
 import { Textarea } from "../components/textarea.tsx";
 import { CopyButton } from "./code.tsx";
 
@@ -205,11 +204,9 @@ function SetupForm<E>({
           ) : (
             <label className="field-label">
               Provider signing secret
-              <Input
-                type="password"
+              <CredentialInput
                 value={secret}
-                onChange={(event) => setSecret(event.target.value)}
-                autoComplete="off"
+                onValueChange={setSecret}
                 required
                 disabled={pending}
               />
diff --git a/patches/@alchemy.run%2Fcloudflare-runtime@2.0.0-beta.80.patch b/patches/@alchemy.run%2Fcloudflare-runtime@2.0.0-beta.80.patch
index 8ca82d270b..f67cec5e9f 100644
--- a/patches/@alchemy.run%2Fcloudflare-runtime@2.0.0-beta.80.patch
+++ b/patches/@alchemy.run%2Fcloudflare-runtime@2.0.0-beta.80.patch
@@ -114,6 +114,30 @@ index ef34e17191b3f93e3d3f11058d4a7d414e662cd3..55e25efbab1b58aca6f31f1b2bd360b8
  import { platform_proxy_exports } from "./platform-proxy/index.mjs";
 -export { ApiError, ConfigError, platform_proxy_exports as PlatformProxy, PluginContext, Runtime, RuntimeError, RuntimeLive, SystemError, isRuntimeError, layerLocalBindings, layerLoopback, layerProxy, layerRegistry, layerRemoteBindings, layerRuntime, layerStorage, make, pickPluginsFromContext, registerHttpServer, use, useSync };
 +export { ApiError, ConfigError, platform_proxy_exports as PlatformProxy, PluginContext, Runtime, RuntimeError, RuntimeLive, SystemError, isRuntimeError, layerLocalRuntime, layerLocalBindings, layerLoopback, layerProxy, layerRegistry, layerRemoteBindings, layerRuntime, layerStorage, make, pickPluginsFromContext, registerHttpServer, use, useSync };
+diff --git a/dist/core/node/workerd/Workerd.mjs b/dist/core/node/workerd/Workerd.mjs
+index 3c74fb382403ee1a908216dfd7915c97e27725c7..c48e1561f42961dbeffd9616e798c4b7f8bb9ea6 100644
+--- a/dist/core/node/workerd/Workerd.mjs
++++ b/dist/core/node/workerd/Workerd.mjs
+@@ -145,7 +145,8 @@ const makeBun = () => make((command, args, config, configuredAddresses) => Effec
+ 		"pipe",
+ 		"pipe"
+ 	],
+-	killSignal: "SIGKILL"
++	killSignal: "SIGKILL",
++	windowsHide: true
+ })).pipe(Effect.map((child) => {
+ 	const stdout = makeStreamPump(child.stdout, (chunk) => {
+ 		process.stdout.write(chunk);
+@@ -203,7 +204,8 @@ const makeNode = () => make((command, args, config, configuredAddresses) => {
+ 				"pipe",
+ 				"pipe"
+ 			],
+-			killSignal: "SIGKILL"
++			killSignal: "SIGKILL",
++			windowsHide: true
+ 		}),
+ 		catch: (error) => new SystemError({
+ 			subtag: "WorkerdSpawn",
 diff --git a/dist/core/workers/bindings/workflows/binding.worker.mjs b/dist/core/workers/bindings/workflows/binding.worker.mjs
 index 9bbe4bf38f7da2d553cb2d006dc4bafab21e726d..adb318093c33026343ae49b58772c0494eb041b0 100644
 --- a/dist/core/workers/bindings/workflows/binding.worker.mjs
@@ -263,6 +287,29 @@ index 0e5d93a1e1fa9888eb99a14046700dea6d8c41fc..e319db77152f7d8c2954e257d79652ca
        },
      ],
      durableObjectStorage: {
+diff --git a/src/core/workerd/Workerd.ts b/src/core/workerd/Workerd.ts
+index 065c7171802d3a22028f6d07280ea59144e11072..491b61ca3cf3aa264e4471e2b88dc6ff724ce01f 100644
+--- a/src/core/workerd/Workerd.ts
++++ b/src/core/workerd/Workerd.ts
+@@ -294,6 +294,8 @@ const makeBun = () =>
+         env: externalEnv(),
+         stdio: [config, "pipe", "pipe", "pipe"],
+         killSignal: "SIGKILL",
++        // Hidden as in makeNode, which Windows uses.
++        windowsHide: true,
+       }),
+     ).pipe(
+       Effect.map((child) => {
+@@ -387,6 +389,9 @@ const makeNode = () =>
+           env: externalEnv(),
+           stdio: ["pipe", "pipe", "pipe", "pipe"],
+           killSignal: "SIGKILL",
++          // workerd is a console program. Started by a process without a console, as a detached
++          // server on Windows is, it would otherwise open a visible console window of its own.
++          windowsHide: true,
+         }),
+       catch: (error) =>
+         new SystemError({
 diff --git a/src/internal/workflows-shared/context.ts b/src/internal/workflows-shared/context.ts
 index f59744211f92960f3be05ef4097dd44996fb7be0..7df77b0b22d239fa37ab073d86b48731cb2862b3 100644
 --- a/src/internal/workflows-shared/context.ts
diff --git a/patches/@better-auth%2Fcore@1.7.5.patch b/patches/@better-auth%2Fcore@1.7.5.patch
new file mode 100644
index 0000000000..fe861273c5
--- /dev/null
+++ b/patches/@better-auth%2Fcore@1.7.5.patch
@@ -0,0 +1,179 @@
+diff --git a/dist/social-providers/apple.mjs b/dist/social-providers/apple.mjs
+index 9f4c8e610bc1806b67f82a44800e259116588161..b3dea9e8bc39b334995b36caa47b280f46fd90f8 100644
+--- a/dist/social-providers/apple.mjs
++++ b/dist/social-providers/apple.mjs
+@@ -4,8 +4,8 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { decodeJwt, importJWK } from "jose";
+-import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/apple.ts
+ const apple = (options) => {
+ 	const tokenEndpoint = "https://appleid.apple.com/auth/token";
+@@ -85,7 +85,7 @@ const apple = (options) => {
+ 	};
+ };
+ const getApplePublicKey = async (kid) => {
+-	const { data } = await betterFetch(`https://appleid.apple.com/auth/keys`);
++	const { data } = await fetchRefusingRedirects(`https://appleid.apple.com/auth/keys`);
+ 	if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
+ 	const jwk = data.keys.find((key) => key.kid === kid);
+ 	if (!jwk) throw new Error(`JWK with kid ${kid} not found`);
+diff --git a/dist/social-providers/cognito.mjs b/dist/social-providers/cognito.mjs
+index 5b5c070b048408d8eec7f543e322f0f41c8d88df..9404e2635278b2be2755b7ea0ac346a5417864d2 100644
+--- a/dist/social-providers/cognito.mjs
++++ b/dist/social-providers/cognito.mjs
+@@ -4,6 +4,7 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { decodeJwt, importJWK } from "jose";
+ import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/cognito.ts
+@@ -136,7 +137,7 @@ const cognito = (options) => {
+ const getCognitoPublicKey = async (kid, region, userPoolId) => {
+ 	const COGNITO_JWKS_URI = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`;
+ 	try {
+-		const { data } = await betterFetch(COGNITO_JWKS_URI);
++		const { data } = await fetchRefusingRedirects(COGNITO_JWKS_URI);
+ 		if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
+ 		const jwk = data.keys.find((key) => key.kid === kid);
+ 		if (!jwk) throw new Error(`JWK with kid ${kid} not found`);
+diff --git a/dist/social-providers/facebook.mjs b/dist/social-providers/facebook.mjs
+index cba8ca1b45f3811189bf130b1f12de4346381947..a71363cbe28cc5d1465609d66cd49a3cef7cfca9 100644
+--- a/dist/social-providers/facebook.mjs
++++ b/dist/social-providers/facebook.mjs
+@@ -4,6 +4,7 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { createRemoteJWKSet, decodeJwt } from "jose";
+ import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/facebook.ts
+@@ -26,7 +27,7 @@ async function verifyFacebookAccessToken(accessToken, options) {
+ 	const primaryClientId = getPrimaryClientId(options.clientId);
+ 	if (!primaryClientId || !options.clientSecret) return null;
+ 	const clientIds = Array.isArray(options.clientId) ? options.clientId : [options.clientId];
+-	const { data, error } = await betterFetch("https://graph.facebook.com/debug_token", { query: {
++	const { data, error } = await fetchRefusingRedirects("https://graph.facebook.com/debug_token", { query: {
+ 		input_token: accessToken,
+ 		access_token: `${primaryClientId}|${options.clientSecret}`
+ 	} });
+diff --git a/dist/social-providers/github.mjs b/dist/social-providers/github.mjs
+index b65f4eb43c9eb3dc3737eff381a222d747cedf7e..c20b904036530f7863d66a872962c125ce2d1beb 100644
+--- a/dist/social-providers/github.mjs
++++ b/dist/social-providers/github.mjs
+@@ -3,6 +3,7 @@ import { getOAuth2Tokens } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { authorizationCodeRequest } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/github.ts
+ const github = (options) => {
+@@ -35,7 +36,7 @@ const github = (options) => {
+ 				redirectURI,
+ 				options
+ 			});
+-			const { data, error } = await betterFetch(tokenEndpoint, {
++			const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
+ 				method: "POST",
+ 				body,
+ 				headers: requestHeaders
+diff --git a/dist/social-providers/google.mjs b/dist/social-providers/google.mjs
+index 0c40ed6650cbd93bdfd5e2d8292e3a26b61e636b..687b1dcdefcac4eef899099c1b592ca532be6bb3 100644
+--- a/dist/social-providers/google.mjs
++++ b/dist/social-providers/google.mjs
+@@ -4,8 +4,8 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+-import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/google.ts
+ const GOOGLE_ID_TOKEN_MAX_AGE = "1h";
+ const GOOGLE_ID_TOKEN_ALGORITHM = "RS256";
+@@ -142,7 +142,7 @@ const getGooglePublicKey = async (kid) => {
+ 	return publicKey;
+ };
+ const getGooglePublicKeys = async (kid) => {
+-	const { data } = await betterFetch("https://www.googleapis.com/oauth2/v3/certs");
++	const { data } = await fetchRefusingRedirects("https://www.googleapis.com/oauth2/v3/certs");
+ 	if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
+ 	const jwks = kid ? data.keys.filter((key) => key.kid === kid) : data.keys;
+ 	if (!jwks.length) throw new Error(`JWK with kid ${kid} not found`);
+diff --git a/dist/social-providers/line.mjs b/dist/social-providers/line.mjs
+index 031dcecaab32a7fa3897c733811f08e0dfa4db91..fee623c638ee4f18bcc367262f16e9d97d95b89c 100644
+--- a/dist/social-providers/line.mjs
++++ b/dist/social-providers/line.mjs
+@@ -1,6 +1,7 @@
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { decodeJwt } from "jose";
+ import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/line.ts
+@@ -66,7 +67,7 @@ const line = (options) => {
+ 			body.set("id_token", token);
+ 			body.set("client_id", options.clientId);
+ 			if (nonce) body.set("nonce", nonce);
+-			const { data, error } = await betterFetch(verifyIdTokenEndpoint, {
++			const { data, error } = await fetchRefusingRedirects(verifyIdTokenEndpoint, {
+ 				method: "POST",
+ 				headers: { "content-type": "application/x-www-form-urlencoded" },
+ 				body
+diff --git a/dist/social-providers/microsoft-entra-id.mjs b/dist/social-providers/microsoft-entra-id.mjs
+index 67a197c8967d9922b5c34a70c2c0ea59b067b7aa..a4557936b6b8dfb9e4e73f1f3f40a8b269e9b2c9 100644
+--- a/dist/social-providers/microsoft-entra-id.mjs
++++ b/dist/social-providers/microsoft-entra-id.mjs
+@@ -4,6 +4,7 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
+ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+ import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+ import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { base64 } from "@better-auth/utils/base64";
+ import { decodeJwt, importJWK } from "jose";
+ import { betterFetch } from "@better-fetch/fetch";
+@@ -152,7 +153,7 @@ const microsoft = (options) => {
+ 	};
+ };
+ const getMicrosoftPublicKey = async (kid, tenant, authority) => {
+-	const { data } = await betterFetch(`${authority}/${tenant}/discovery/v2.0/keys`);
++	const { data } = await fetchRefusingRedirects(`${authority}/${tenant}/discovery/v2.0/keys`);
+ 	if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
+ 	const jwk = data.keys.find((key) => key.kid === kid);
+ 	if (!jwk) throw new Error(`JWK with kid ${kid} not found`);
+diff --git a/dist/social-providers/wechat.mjs b/dist/social-providers/wechat.mjs
+index 78b99de5cb5d2d5dc8c183c7b38a00fce2af0d14..f13bc2cc095dc5648319c16bee7b1de01fbc9b60 100644
+--- a/dist/social-providers/wechat.mjs
++++ b/dist/social-providers/wechat.mjs
+@@ -1,4 +1,5 @@
+ import { RESERVED_AUTHORIZATION_PARAMS_SET } from "../oauth2/create-authorization-url.mjs";
++import { fetchRefusingRedirects } from "../oauth2/reject-redirects.mjs";
+ import { createPlaceholderEmail } from "../utils/email.mjs";
+ import { betterFetch } from "@better-fetch/fetch";
+ //#region src/social-providers/wechat.ts
+@@ -27,7 +28,7 @@ const wechat = (options) => {
+ 			return url;
+ 		},
+ 		validateAuthorizationCode: async ({ code }) => {
+-			const { data: tokenData, error } = await betterFetch("https://api.weixin.qq.com/sns/oauth2/access_token?" + new URLSearchParams({
++			const { data: tokenData, error } = await fetchRefusingRedirects("https://api.weixin.qq.com/sns/oauth2/access_token?" + new URLSearchParams({
+ 				appid: options.clientId,
+ 				secret: options.clientSecret,
+ 				code,
+@@ -45,7 +46,7 @@ const wechat = (options) => {
+ 			};
+ 		},
+ 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+-			const { data: tokenData, error } = await betterFetch("https://api.weixin.qq.com/sns/oauth2/refresh_token?" + new URLSearchParams({
++			const { data: tokenData, error } = await fetchRefusingRedirects("https://api.weixin.qq.com/sns/oauth2/refresh_token?" + new URLSearchParams({
+ 				appid: options.clientId,
+ 				grant_type: "refresh_token",
+ 				refresh_token: refreshToken
diff --git a/patches/@effect%2Fsql-pg@4.0.1.patch b/patches/@effect%2Fsql-pg@4.0.1.patch
index 51e419c0da..d6b369421a 100644
--- a/patches/@effect%2Fsql-pg@4.0.1.patch
+++ b/patches/@effect%2Fsql-pg@4.0.1.patch
@@ -49,7 +49,7 @@ index 69086dea397ba44c2ba726c913a2b5dbf1cac136..ca72f3fe76c0d76de25b119d47a604f1
   * Creates a scoped PostgreSQL client backed by one connection.
   *
 diff --git a/dist/PgConnection.d.ts b/dist/PgConnection.d.ts
-index 20ffe147c475deec24664641d4e76fb99764c838..7aa4f0128c543d82513159f077895f223d582a09 100644
+index 20ffe147c475deec24664641d4e76fb99764c838..7eff435377a27cb0a0872e64aa89771b82327bd4 100644
 --- a/dist/PgConnection.d.ts
 +++ b/dist/PgConnection.d.ts
 @@ -66,6 +66,13 @@ export interface Config {
@@ -91,7 +91,7 @@ index 20ffe147c475deec24664641d4e76fb99764c838..7aa4f0128c543d82513159f077895f22
  /**
   * Connects and authenticates a single PostgreSQL session.
   *
-@@ -207,7 +232,10 @@ export declare const PgConnection: Context.Service<PgConnection, PgConnection>;
+@@ -207,7 +232,12 @@ export declare const PgConnection: Context.Service<PgConnection, PgConnection>;
   * Password resolution, transport, optional `SSLRequest`, startup, and
   * authentication run under `connectTimeout` (5 seconds by default). The effect
   * resolves when the backend sends `ReadyForQuery`. Closing the scope sends
@@ -99,23 +99,26 @@ index 20ffe147c475deec24664641d4e76fb99764c838..7aa4f0128c543d82513159f077895f22
 + * `Terminate` and ends the socket. A retryable failure is retried up to
 + * `connectRetries` times; each attempt's `sql.connect` span records its
 + * `db.connect.attempt`, and a retry records the previous failure as
-+ * `db.connect.retry_reason`.
++ * `db.connect.retry_reason`. A failed attempt, including one that reaches
++ * `connectTimeout`, fails its span and records why as `db.connect.failure`:
++ * `timeout`, `refused`, `auth` or `other`.
   *
   * Use `sslmode=require` or explicit `ssl: true` to require encryption.
   * Unix sockets and custom streams should set `ssl.servername` explicitly.
 diff --git a/dist/PgConnection.js b/dist/PgConnection.js
-index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df4cf131aa 100644
+index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..43fc7e49072be686170950de746e0f2f0468c8a1 100644
 --- a/dist/PgConnection.js
 +++ b/dist/PgConnection.js
-@@ -5,6 +5,7 @@ import * as Deferred from "effect/Deferred";
+@@ -5,6 +5,8 @@ import * as Deferred from "effect/Deferred";
  import * as Duration from "effect/Duration";
  import * as Effect from "effect/Effect";
  import * as Exit from "effect/Exit";
 +import * as Fiber from "effect/Fiber";
++import * as Option from "effect/Option";
  import * as Queue from "effect/Queue";
  import * as Redacted from "effect/Redacted";
  import * as EffectResult from "effect/Result";
-@@ -45,6 +46,167 @@ const preparedCacheFor = config => {
+@@ -45,6 +47,167 @@ const preparedCacheFor = config => {
   * @since 4.0.0
   */
  export const PgConnection = /*#__PURE__*/Context.Service("@effect/sql-pg/PgConnection");
@@ -283,7 +286,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
  /**
   * Connects and authenticates a single PostgreSQL session.
   *
-@@ -61,22 +223,46 @@ export const PgConnection = /*#__PURE__*/Context.Service("@effect/sql-pg/PgConne
+@@ -61,22 +224,49 @@ export const PgConnection = /*#__PURE__*/Context.Service("@effect/sql-pg/PgConne
   * @category constructors
   * @since 4.0.0
   */
@@ -297,38 +300,38 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
 -  duration: config.connectTimeout,
 -  orElse: () => Effect.fail(new SqlError({
 -    reason: new ConnectionError({
--      cause: new Error("Connection timed out"),
--      message: "PgConnection: Connection timed out",
--      operation: "connect"
--    })
--  }))
--})));
 +export const make = options => Effect.flatMap(resolveConfig(options), config => {
 +  const retries = options.connectRetries ?? 0;
++  // The span holds the timeout, so an attempt that reaches it fails the span instead of ending
++  // it interrupted. The timeout covers the same work as before, and the release keeps the
++  // caller's context.
 +  const attempt = (number, previous) => Effect.acquireRelease(Effect.gen(function* () {
 +    const password = yield* PasswordInternal.resolve(config.password);
-+    const session = yield* connect(config, password).pipe(Effect.withSpan("sql.connect", {
-+      kind: "client",
-+      attributes: previous === undefined ? {
-+        "db.connect.attempt": number
-+      } : {
-+        "db.connect.attempt": number,
-+        "db.connect.retry_reason": previous.message
-+      }
-+    }));
++    const session = yield* connect(config, password);
 +    return new PgConnectionImpl(options, config, session, options.types);
-+  }), connection => connection.close, {
-+    interruptible: true
 +  }).pipe(Effect.timeoutOrElse({
 +    duration: config.connectTimeout,
-+    orElse: () => Effect.fail(new SqlError({
-+      reason: new ConnectionError({
-+        cause: new Error("Connection timed out"),
-+        message: "PgConnection: Connection timed out",
-+        operation: "connect"
-+      })
++    orElse: () => connectFailed("timeout", new ConnectionError({
+       cause: new Error("Connection timed out"),
+       message: "PgConnection: Connection timed out",
+       operation: "connect"
+-    })
+-  }))
+-})));
 +    }))
-+  }));
++  }),
++  // A defect, such as a password provider that dies, still records why the attempt failed.
++  Effect.tapDefect(() => Effect.annotateCurrentSpan("db.connect.failure", "other")), Effect.withSpan("sql.connect", {
++    kind: "client",
++    attributes: previous === undefined ? {
++      "db.connect.attempt": number
++    } : {
++      "db.connect.attempt": number,
++      "db.connect.retry_reason": previous.message
++    }
++  })), connection => connection.close, {
++    interruptible: true
++  });
 +  // An attempt that failed sent no statement, so making it again cannot repeat any work.
 +  const attempts = (number, previous) => number > retries ? attempt(number, previous) : Effect.catchIf(attempt(number, previous), error => error.isRetryable, error => attempts(number + 1, error));
 +  return attempts(1, undefined);
@@ -346,7 +349,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
  const abortDrainTimeoutMillis = 5000;
  const abortDrainGraceMillis = 10;
  /** PostgreSQL `query_canceled` SQLSTATE. */
-@@ -106,6 +292,7 @@ class PgConnectionImpl {
+@@ -106,6 +296,7 @@ class PgConnectionImpl {
    deadWith;
    closed = false;
    cancelPending = false;
@@ -354,7 +357,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    channels = /*#__PURE__*/new Map();
    retireHooks = /*#__PURE__*/new Set();
    /** Queued but not yet written; drained into `pipelineInFlight` on flush. */
-@@ -114,7 +301,18 @@ class PgConnectionImpl {
+@@ -114,7 +305,18 @@ class PgConnectionImpl {
    pipelineInFlight = [];
    pipelineHead = 0;
    pipelineFlushScheduled = false;
@@ -373,7 +376,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    pinnedView;
    [internalsKey];
    constructor(config, resolved, session, registry) {
-@@ -130,7 +328,24 @@ class PgConnectionImpl {
+@@ -130,7 +332,24 @@ class PgConnectionImpl {
      this[internalsKey] = {
        base: this,
        deadError: () => this.deadWith,
@@ -399,7 +402,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
      };
      this.pinnedView = new PinnedPgConnection(this);
      session.socket.on("data", this.onData);
-@@ -205,6 +420,7 @@ class PgConnectionImpl {
+@@ -205,6 +424,7 @@ class PgConnectionImpl {
      }
    }
    retire() {
@@ -407,7 +410,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
      if (this.closed) return;
      for (const hook of this.retireHooks) hook();
    }
-@@ -260,7 +476,20 @@ class PgConnectionImpl {
+@@ -260,7 +480,20 @@ class PgConnectionImpl {
    };
    pipelineDepth = () => this.pipelineInFlight.length - this.pipelineHead;
    pipelineIsIdle = () => this.pipelineDepth() === 0 && this.pipelinePending.length === 0;
@@ -428,7 +431,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
      if (!this.pipelineIsIdle()) return;
      this.consumer = undefined;
      this.session.parser.readField = undefined;
-@@ -288,6 +517,7 @@ class PgConnectionImpl {
+@@ -288,6 +521,7 @@ class PgConnectionImpl {
        this.pipelineInFlight.length = 0;
        this.pipelineHead = 0;
      }
@@ -436,7 +439,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    };
    /** Writes everything queued since the last flush as one batch. */
    flushPipeline = () => {
-@@ -317,6 +547,8 @@ class PgConnectionImpl {
+@@ -317,6 +551,8 @@ class PgConnectionImpl {
      }
      if (wasEmpty) this.session.parser.readField = batch[0].machine.readField;
      const frame = batch.length === 1 ? batch[0].plan.frame : concat(batch.map(entry => entry.plan.frame));
@@ -445,7 +448,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
      try {
        this.session.socket.write(frame);
      } catch (cause) {
-@@ -329,13 +561,88 @@ class PgConnectionImpl {
+@@ -329,13 +565,88 @@ class PgConnectionImpl {
      // A microtask is what lets fibers submitted in the same tick share a write.
      queueMicrotask(this.flushPipeline);
    };
@@ -535,7 +538,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
      let plan;
      try {
        plan = this.encodeQuery(sql, params, cache);
-@@ -352,15 +659,14 @@ class PgConnectionImpl {
+@@ -352,15 +663,14 @@ class PgConnectionImpl {
        abandoned: false
      };
      this.pipelinePending.push(entry);
@@ -554,7 +557,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    });
    /**
     * One extended-query cycle for a caller that shares the session with others:
-@@ -372,7 +678,10 @@ class PgConnectionImpl {
+@@ -372,7 +682,10 @@ class PgConnectionImpl {
     * Runs one cycle for a caller that owns the session. No wire permit is needed
     * because competing pinned work and streams must acquire `owner` first.
     */
@@ -566,7 +569,7 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    /**
     * Runs one cycle. A reused statement the backend has since dropped, or whose
     * plan no longer matches its columns, is parsed again on a second attempt;
-@@ -414,6 +723,73 @@ class PgConnectionImpl {
+@@ -414,6 +727,73 @@ class PgConnectionImpl {
      const cache = prepare ? this.prepared : undefined;
      return this.multiplex ? this.pipelineCycle(sql, params, wantRows, cache) : this.owner.withPermit(this.cycleOwned(sql, params, wantRows, cache));
    };
@@ -640,16 +643,23 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    query = (sql, params, prepare = true) => Effect.map(this.run(sql, params ?? emptyParams, true, prepare), takeResult);
    queryValues = (sql, params, prepare = true) => Effect.map(this.run(sql, params ?? emptyParams, false, prepare), takeValues);
    stream = (sql, params) => streamRows(this, this.pin, sql, params ?? emptyParams);
-@@ -1051,7 +1427,7 @@ const drainAborted = (conn, timeoutMessage, abort) => {
+@@ -1050,8 +1430,13 @@ const drainAborted = (conn, timeoutMessage, abort) => {
+   const cancelAndDrain = Effect.andThen(conn.cancel, Deferred.await(drained));
    return Effect.andThen(Effect.raceFirst(Deferred.await(drained), grace), Effect.suspend(() => Deferred.isDoneUnsafe(drained) ? Effect.void : cancelAndDrain));
  };
- /** One cycle on a connection that carries a single statement at a time. */
+-/** One cycle on a connection that carries a single statement at a time. */
 -const runQuery = (conn, plan, wantRows) => Effect.callback(resume => {
-+const runQuery = (conn, plan, wantRows) => Effect.useSpan("sql.wire", { kind: "client" }, span => Effect.callback(resume => {
++/**
++ * One cycle on a connection that carries a single statement at a time. A statement running
++ * under its own `sql.execute` span records its wire timing there; a statement without one,
++ * such as transaction control, records it on a `sql.wire` span of its own.
++ */
++const runQuery = (conn, plan, wantRows) => Effect.flatMap(Effect.option(Effect.currentSpan), current => Option.isSome(current) && current.value.name === "sql.execute" ? wireCycle(conn, plan, wantRows, current.value) : Effect.useSpan("sql.wire", { kind: "client" }, span => wireCycle(conn, plan, wantRows, span)));
++const wireCycle = (conn, plan, wantRows, span) => Effect.callback(resume => {
    if (conn.deadWith !== undefined) {
      resume(Effect.fail(conn.deadWith));
      return;
-@@ -1060,12 +1436,30 @@ const runQuery = (conn, plan, wantRows) => Effect.callback(resume => {
+@@ -1060,12 +1445,30 @@ const runQuery = (conn, plan, wantRows) => Effect.callback(resume => {
      conn.consumer = undefined;
      resume(effect);
    });
@@ -682,15 +692,115 @@ index 2cb7481bd2ef827ea48f69fa8d8b28aeeb255114..525606550c6193125fb28b3add12a3df
    } catch (cause) {
      conn.fatal(connectionQueryError(cause, "PgConnection: Failed to write query"));
    }
-@@ -1076,7 +1470,7 @@ const runQuery = (conn, plan, wantRows) => Effect.callback(resume => {
-       onDrained();
-     }));
-   });
--});
-+}));
- const emptyFields = [];
- /** Derives the per-column readers and the row constructor for a description. */
- const describe = (fields, registry) => {
+@@ -1408,33 +1811,55 @@ const sendCancelRequest = (config, session) => Effect.callback(resume => {
+   if (config.stream !== undefined) begin();else socket.once("connect", begin);
+   return Effect.sync(finish);
+ });
++/**
++ * Fail a connection attempt, recording why on the current span, the attempt's `sql.connect`, as
++ * `db.connect.failure`:
++ *
++ * - `timeout`: the attempt reached `connectTimeout`.
++ * - `refused`: the connection was not accepted. The transport failed before it connected (a
++ *   refused, unreachable or unresolvable host), or the server answered the startup with an error
++ *   that is not about authentication, such as too many connections.
++ * - `auth`: authentication failed: the server rejected the credentials (SQLSTATE class 28), no
++ *   password was configured, or the exchange could not complete.
++ * - `other`: anything else, such as a password provider that dies, a connected socket that failed
++ *   or closed during startup, TLS negotiation, or a server response the driver could not read.
++ */
++const connectFailed = (failure, reason) => Effect.andThen(Effect.annotateCurrentSpan("db.connect.failure", failure), Effect.fail(new SqlError({
++  reason
++})));
++/** One connection attempt's transport and startup, run under its `sql.connect` span. */
+ const connect = (config, resolvedPassword) => Effect.callback(resume => {
+   let done = false;
+   let socket;
++  // A transport that fails before it connects did not accept the connection.
++  let connected = config.stream !== undefined;
+   let encrypted = false;
+   let parser;
+   let sslErrorParser;
+   let scram;
+   let processId = 0;
+   let secretKey = 0;
+-  const fail = reason => {
++  const fail = (reason, failure) => {
+     if (done) return;
+     done = true;
+     socket?.destroy();
+-    resume(Effect.fail(new SqlError({
+-      reason
+-    })));
++    resume(connectFailed(failure, reason));
+   };
+   const failConnect = (cause, message) => fail(new ConnectionError({
+     cause,
+     message,
+     operation: "connect"
+-  }));
++  }), connected ? "other" : "refused");
+   const failAuth = (cause, message) => fail(new AuthenticationError({
+     cause,
+     message,
+     operation: "connect"
+-  }));
++  }), "auth");
++  // The server's own answer to the startup: a refusal, unless it rejected the credentials.
++  const failServer = (fields, message) => {
++    const reason = classifyFields(fields, message, "connect");
++    fail(reason, reason._tag === "AuthenticationError" ? "auth" : "refused");
++  };
+   const onError = cause => failConnect(cause, "PgConnection: Failed to connect");
+   const onClose = () => failConnect(new Error("Connection closed unexpectedly"), "PgConnection: Connection closed during startup");
+   const password = () => {
+@@ -1532,7 +1957,7 @@ const connect = (config, resolvedPassword) => Effect.callback(resume => {
+         secretKey = message.secret;
+         return;
+       case "ErrorResponse":
+-        return fail(classifyFields(message.fields, "PgConnection: Failed to connect", "connect"));
++        return failServer(message.fields, "PgConnection: Failed to connect");
+       case "ReadyForQuery":
+         if (scram !== undefined) {
+           return failAuth(new Error("The server completed authentication without proving its identity"), "PgConnection: SCRAM exchange did not complete");
+@@ -1591,7 +2016,7 @@ const connect = (config, resolvedPassword) => Effect.callback(resume => {
+       if (messages.length !== 1 || message._tag !== "ErrorResponse") {
+         return failConnect(new Error("Expected one ErrorResponse after SSLRequest"), "PgConnection: Invalid SSLRequest response");
+       }
+-      return fail(classifyFields(message.fields, "PgConnection: Failed to negotiate TLS", "connect"));
++      return failServer(message.fields, "PgConnection: Failed to negotiate TLS");
+     }
+     socket.off("data", onSslResponse);
+     if (chunk.length !== 1) {
+@@ -1638,12 +2063,10 @@ const connect = (config, resolvedPassword) => Effect.callback(resume => {
+       noDelay: true
+     });
+   } catch (cause) {
+-    resume(Effect.fail(new SqlError({
+-      reason: new ConnectionError({
+-        cause,
+-        message: "PgConnection: Failed to connect",
+-        operation: "connect"
+-      })
++    resume(connectFailed("refused", new ConnectionError({
++      cause,
++      message: "PgConnection: Failed to connect",
++      operation: "connect"
+     })));
+     return;
+   }
+@@ -1652,7 +2075,10 @@ const connect = (config, resolvedPassword) => Effect.callback(resume => {
+   if (config.stream !== undefined) {
+     begin();
+   } else {
+-    socket.once("connect", begin);
++    socket.once("connect", () => {
++      connected = true;
++      begin();
++    });
+   }
+   return Effect.sync(() => {
+     if (done) return;
 diff --git a/dist/PgPool.d.ts b/dist/PgPool.d.ts
 index 5a13d373d1b5a6f3a7e754b6970e5a8c5f122b89..172fc397947d89fdfd86d1a71039526e7adde410 100644
 --- a/dist/PgPool.d.ts
@@ -1065,18 +1175,27 @@ index 458df7fb428d6851d307da883dca050df145f92b..6b3e66c7b95be450d1165bfdd53d3d88
  /**
   * Creates a scoped PostgreSQL client backed by one connection.
 diff --git a/src/PgConnection.ts b/src/PgConnection.ts
-index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458fbc81f9b 100644
+index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..2f362a487502f225acebd8fdaf5f4e4b0d0addb3 100644
 --- a/src/PgConnection.ts
 +++ b/src/PgConnection.ts
-@@ -16,6 +16,7 @@ import * as Deferred from "effect/Deferred"
+@@ -16,6 +16,8 @@ import * as Deferred from "effect/Deferred"
  import * as Duration from "effect/Duration"
  import * as Effect from "effect/Effect"
  import * as Exit from "effect/Exit"
 +import * as Fiber from "effect/Fiber"
++import * as Option from "effect/Option"
  import * as Queue from "effect/Queue"
  import * as Redacted from "effect/Redacted"
  import * as EffectResult from "effect/Result"
-@@ -95,6 +96,13 @@ export interface Config {
+@@ -23,6 +25,7 @@ import * as Scope from "effect/Scope"
+ import * as Semaphore from "effect/Semaphore"
+ import { AuthenticationError, ConnectionError, SqlError, type SqlErrorReason, UnknownError } from "effect/sql/SqlError"
+ import * as Stream from "effect/Stream"
++import type * as Tracer from "effect/Tracer"
+ import { Buffer } from "node:buffer"
+ import { randomBytes } from "node:crypto"
+ import * as Net from "node:net"
+@@ -95,6 +98,13 @@ export interface Config {
     */
    readonly password?: Redacted.Redacted | Effect.Effect<Redacted.Redacted> | undefined
    readonly connectTimeout?: Duration.Input | undefined
@@ -1090,7 +1209,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    /**
     * Overrides `startupParameters.application_name`, the URL's `application_name`,
     * and the default `"@effect/sql-pg"`, in that order.
-@@ -258,6 +266,263 @@ export interface PgConnection {
+@@ -258,6 +268,263 @@ export interface PgConnection {
   */
  export const PgConnection = Context.Service<PgConnection>("@effect/sql-pg/PgConnection")
  
@@ -1354,7 +1473,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
  /**
   * Connects and authenticates a single PostgreSQL session.
   *
-@@ -266,7 +531,10 @@ export const PgConnection = Context.Service<PgConnection>("@effect/sql-pg/PgConn
+@@ -266,7 +533,12 @@ export const PgConnection = Context.Service<PgConnection>("@effect/sql-pg/PgConn
   * Password resolution, transport, optional `SSLRequest`, startup, and
   * authentication run under `connectTimeout` (5 seconds by default). The effect
   * resolves when the backend sends `ReadyForQuery`. Closing the scope sends
@@ -1362,11 +1481,13 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
 + * `Terminate` and ends the socket. A retryable failure is retried up to
 + * `connectRetries` times; each attempt's `sql.connect` span records its
 + * `db.connect.attempt`, and a retry records the previous failure as
-+ * `db.connect.retry_reason`.
++ * `db.connect.retry_reason`. A failed attempt, including one that reaches
++ * `connectTimeout`, fails its span and records why as `db.connect.failure`
++ * (see {@link ConnectFailure}).
   *
   * Use `sslmode=require` or explicit `ssl: true` to require encryption.
   * Unix sockets and custom streams should set `ssl.servername` explicitly.
-@@ -275,30 +543,48 @@ export const PgConnection = Context.Service<PgConnection>("@effect/sql-pg/PgConn
+@@ -275,30 +547,53 @@ export const PgConnection = Context.Service<PgConnection>("@effect/sql-pg/PgConn
   * @since 4.0.0
   */
  export const make = (options: Config): Effect.Effect<PgConnection, SqlError, Scope.Scope> =>
@@ -1389,40 +1510,46 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
 -                cause: new Error("Connection timed out"),
 -                message: "PgConnection: Connection timed out",
 -                operation: "connect"
+-              })
+-            })
+-          )
+-      })
+-    ))
 +  Effect.flatMap(resolveConfig(options), (config) => {
 +    const retries = options.connectRetries ?? 0
++    // The span holds the timeout, so an attempt that reaches it fails the span instead of ending
++    // it interrupted. The timeout covers the same work as before, and the release keeps the
++    // caller's context.
 +    const attempt = (number: number, previous: SqlError | undefined) =>
 +      Effect.acquireRelease(
 +        Effect.gen(function*() {
 +          const password = yield* PasswordInternal.resolve(config.password)
-+          const session = yield* connect(config, password).pipe(Effect.withSpan("sql.connect", {
++          const session = yield* connect(config, password)
++          return new PgConnectionImpl(options, config, session, options.types)
++        }).pipe(
++          Effect.timeoutOrElse({
++            duration: config.connectTimeout,
++            orElse: () =>
++              connectFailed(
++                "timeout",
++                new ConnectionError({
++                  cause: new Error("Connection timed out"),
++                  message: "PgConnection: Connection timed out",
++                  operation: "connect"
++                })
++              )
++          }),
++          // A defect, such as a password provider that dies, still records why the attempt failed.
++          Effect.tapDefect(() => Effect.annotateCurrentSpan("db.connect.failure", "other" satisfies ConnectFailure)),
++          Effect.withSpan("sql.connect", {
 +            kind: "client",
 +            attributes: previous === undefined
 +              ? { "db.connect.attempt": number }
 +              : { "db.connect.attempt": number, "db.connect.retry_reason": previous.message }
-+          }))
-+          return new PgConnectionImpl(options, config, session, options.types)
-+        }),
++          })
++        ),
 +        (connection) => connection.close,
 +        { interruptible: true }
-+      ).pipe(
-+        Effect.timeoutOrElse({
-+          duration: config.connectTimeout,
-+          orElse: () =>
-+            Effect.fail(
-+              new SqlError({
-+                reason: new ConnectionError({
-+                  cause: new Error("Connection timed out"),
-+                  message: "PgConnection: Connection timed out",
-+                  operation: "connect"
-+                })
-               })
--            })
--          )
--      })
--    ))
-+            )
-+        })
 +      )
 +    // An attempt that failed sent no statement, so making it again cannot repeat any work.
 +    const attempts = (number: number, previous: SqlError | undefined): Effect.Effect<PgConnection, SqlError, Scope.Scope> =>
@@ -1438,7 +1565,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
  
  interface Session {
    readonly socket: Duplex
-@@ -324,8 +610,20 @@ interface PipelineEntry {
+@@ -324,8 +619,20 @@ interface PipelineEntry {
    readonly deferred: Deferred.Deferred<QueryOutput, SqlError>
    readonly machine: QueryMachine
    abandoned: boolean
@@ -1459,7 +1586,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
  const abortDrainTimeoutMillis = 5000
  const abortDrainGraceMillis = 10
  /** PostgreSQL `query_canceled` SQLSTATE. */
-@@ -356,6 +654,7 @@ class PgConnectionImpl implements PgConnection {
+@@ -356,6 +663,7 @@ class PgConnectionImpl implements PgConnection {
    deadWith: SqlError | undefined
    closed = false
    cancelPending = false
@@ -1467,7 +1594,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    readonly channels = new Map<string, Set<Queue.Queue<Notification, SqlError>>>()
    readonly retireHooks = new Set<() => void>()
    /** Queued but not yet written; drained into `pipelineInFlight` on flush. */
-@@ -364,7 +663,18 @@ class PgConnectionImpl implements PgConnection {
+@@ -364,7 +672,18 @@ class PgConnectionImpl implements PgConnection {
    readonly pipelineInFlight: Array<PipelineEntry> = []
    pipelineHead = 0
    pipelineFlushScheduled = false
@@ -1486,7 +1613,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    readonly pinnedView: PgConnection
    readonly [internalsKey]: ConnectionInternals
  
-@@ -381,7 +691,24 @@ class PgConnectionImpl implements PgConnection {
+@@ -381,7 +700,24 @@ class PgConnectionImpl implements PgConnection {
      this[internalsKey] = {
        base: this,
        deadError: () => this.deadWith,
@@ -1512,7 +1639,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
      }
      this.pinnedView = new PinnedPgConnection(this)
      session.socket.on("data", this.onData)
-@@ -474,6 +801,7 @@ class PgConnectionImpl implements PgConnection {
+@@ -474,6 +810,7 @@ class PgConnectionImpl implements PgConnection {
    }
  
    private retire(): void {
@@ -1520,7 +1647,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
      if (this.closed) return
      for (const hook of this.retireHooks) hook()
    }
-@@ -548,7 +876,22 @@ class PgConnectionImpl implements PgConnection {
+@@ -548,7 +885,22 @@ class PgConnectionImpl implements PgConnection {
  
    private readonly pipelineIsIdle = (): boolean => this.pipelineDepth() === 0 && this.pipelinePending.length === 0
  
@@ -1543,7 +1670,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
      if (!this.pipelineIsIdle()) return
      this.consumer = undefined
      this.session.parser.readField = undefined
-@@ -584,6 +927,7 @@ class PgConnectionImpl implements PgConnection {
+@@ -584,6 +936,7 @@ class PgConnectionImpl implements PgConnection {
        this.pipelineInFlight.length = 0
        this.pipelineHead = 0
      }
@@ -1551,7 +1678,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    }
  
    /** Writes everything queued since the last flush as one batch. */
-@@ -616,6 +960,8 @@ class PgConnectionImpl implements PgConnection {
+@@ -616,6 +969,8 @@ class PgConnectionImpl implements PgConnection {
      const frame = batch.length === 1
        ? batch[0].plan.frame
        : concat(batch.map((entry) => entry.plan.frame))
@@ -1560,7 +1687,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
      try {
        this.session.socket.write(frame)
      } catch (cause) {
-@@ -630,6 +976,128 @@ class PgConnectionImpl implements PgConnection {
+@@ -630,6 +985,128 @@ class PgConnectionImpl implements PgConnection {
      queueMicrotask(this.flushPipeline)
    }
  
@@ -1689,7 +1816,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    /**
     * One cycle on a multiplexed connection. The `owner` permit is only taken to
     * queue the statement, so a pin still orders against submissions without
-@@ -640,10 +1108,22 @@ class PgConnectionImpl implements PgConnection {
+@@ -640,10 +1117,22 @@ class PgConnectionImpl implements PgConnection {
      params: ReadonlyArray<unknown>,
      wantRows: boolean,
      cache: PreparedCache | undefined
@@ -1712,7 +1839,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
          let plan: Plan
          try {
            plan = this.encodeQuery(sql, params, cache)
-@@ -655,20 +1135,17 @@ class PgConnectionImpl implements PgConnection {
+@@ -655,20 +1144,17 @@ class PgConnectionImpl implements PgConnection {
          const machine = new QueryMachine(this, plan, wantRows, (result) => this.finishPipelineEntry(entry, result))
          entry = { plan, deferred, machine, abandoned: false }
          this.pipelinePending.push(entry)
@@ -1736,7 +1863,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
        }
      )
  
-@@ -693,7 +1170,11 @@ class PgConnectionImpl implements PgConnection {
+@@ -693,7 +1179,11 @@ class PgConnectionImpl implements PgConnection {
      params: ReadonlyArray<unknown>,
      wantRows: boolean,
      cache: PreparedCache | undefined
@@ -1749,7 +1876,7 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
  
    /**
     * Runs one cycle. A reused statement the backend has since dropped, or whose
-@@ -764,6 +1245,104 @@ class PgConnectionImpl implements PgConnection {
+@@ -764,6 +1254,104 @@ class PgConnectionImpl implements PgConnection {
        : this.owner.withPermit(this.cycleOwned(sql, params, wantRows, cache))
    }
  
@@ -1854,16 +1981,35 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
    readonly query = (sql: string, params?: ReadonlyArray<unknown>, prepare = true): Effect.Effect<Result, SqlError> =>
      Effect.map(this.run(sql, params ?? emptyParams, true, prepare), takeResult)
  
-@@ -1518,7 +2097,7 @@ const runQuery = (
+@@ -1512,11 +2100,26 @@ const drainAborted = (
+   )
+ }
+ 
+-/** One cycle on a connection that carries a single statement at a time. */
++/**
++ * One cycle on a connection that carries a single statement at a time. A statement running
++ * under its own `sql.execute` span records its wire timing there; a statement without one,
++ * such as transaction control, records it on a `sql.wire` span of its own.
++ */
+ const runQuery = (
+   conn: PgConnectionImpl,
    plan: Plan,
    wantRows: boolean
++): Effect.Effect<QueryOutput, SqlError> =>
++  Effect.flatMap(Effect.option(Effect.currentSpan), (current) =>
++    Option.isSome(current) && current.value.name === "sql.execute"
++      ? wireCycle(conn, plan, wantRows, current.value)
++      : Effect.useSpan("sql.wire", { kind: "client" }, (span) => wireCycle(conn, plan, wantRows, span)))
++
++const wireCycle = (
++  conn: PgConnectionImpl,
++  plan: Plan,
++  wantRows: boolean,
++  span: Tracer.Span
  ): Effect.Effect<QueryOutput, SqlError> =>
--  Effect.callback<QueryOutput, SqlError>((resume) => {
-+  Effect.useSpan("sql.wire", { kind: "client" }, (span) => Effect.callback<QueryOutput, SqlError>((resume) => {
+   Effect.callback<QueryOutput, SqlError>((resume) => {
      if (conn.deadWith !== undefined) {
-       resume(Effect.fail(conn.deadWith))
-       return
-@@ -1527,12 +2106,30 @@ const runQuery = (
+@@ -1527,12 +2130,30 @@ const runQuery = (
        conn.consumer = undefined
        resume(effect)
      })
@@ -1896,15 +2042,111 @@ index 1b01a1d07dba9c258f69fb7b9ee56c9c2dd66894..d15162b49793c768c3f26a4459055458
      } catch (cause) {
        conn.fatal(connectionQueryError(cause, "PgConnection: Failed to write query"))
      }
-@@ -1545,7 +2142,7 @@ const runQuery = (
-           onDrained()
-         }))
-     })
--  })
-+  }))
+@@ -1924,10 +2545,34 @@ const sendCancelRequest = (config: ResolvedConfig, session: Session): Effect.Eff
+     return Effect.sync(finish)
+   })
+ 
++/**
++ * Why a connection attempt failed, recorded on its `sql.connect` span as `db.connect.failure`:
++ *
++ * - `timeout`: the attempt reached `connectTimeout`.
++ * - `refused`: the connection was not accepted. The transport failed before it connected (a
++ *   refused, unreachable or unresolvable host), or the server answered the startup with an error
++ *   that is not about authentication, such as too many connections.
++ * - `auth`: authentication failed: the server rejected the credentials (SQLSTATE class 28), no
++ *   password was configured, or the exchange could not complete.
++ * - `other`: anything else, such as a password provider that dies, a connected socket that failed
++ *   or closed during startup, TLS negotiation, or a server response the driver could not read.
++ */
++type ConnectFailure = "timeout" | "refused" | "auth" | "other"
++
++/** Fail a connection attempt, recording why on the current span, the attempt's `sql.connect`. */
++const connectFailed = (failure: ConnectFailure, reason: SqlErrorReason): Effect.Effect<never, SqlError> =>
++  Effect.andThen(
++    Effect.annotateCurrentSpan("db.connect.failure", failure),
++    Effect.fail(new SqlError({ reason }))
++  )
++
++/** One connection attempt's transport and startup, run under its `sql.connect` span. */
+ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined): Effect.Effect<Session, SqlError> =>
+   Effect.callback<Session, SqlError>((resume) => {
+     let done = false
+     let socket: Duplex
++    // A transport that fails before it connects did not accept the connection.
++    let connected = config.stream !== undefined
+     let encrypted = false
+     let parser: PgProtocol.Parser<unknown> | undefined
+     let sslErrorParser: PgProtocol.Parser | undefined
+@@ -1935,16 +2580,21 @@ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined):
+     let processId = 0
+     let secretKey = 0
+ 
+-    const fail = (reason: SqlErrorReason): void => {
++    const fail = (reason: SqlErrorReason, failure: ConnectFailure): void => {
+       if (done) return
+       done = true
+       socket?.destroy()
+-      resume(Effect.fail(new SqlError({ reason })))
++      resume(connectFailed(failure, reason))
+     }
+     const failConnect = (cause: unknown, message: string): void =>
+-      fail(new ConnectionError({ cause, message, operation: "connect" }))
++      fail(new ConnectionError({ cause, message, operation: "connect" }), connected ? "other" : "refused")
+     const failAuth = (cause: unknown, message: string): void =>
+-      fail(new AuthenticationError({ cause, message, operation: "connect" }))
++      fail(new AuthenticationError({ cause, message, operation: "connect" }), "auth")
++    // The server's own answer to the startup: a refusal, unless it rejected the credentials.
++    const failServer = (fields: PgProtocol.ErrorFields, message: string): void => {
++      const reason = classifyFields(fields, message, "connect")
++      fail(reason, reason._tag === "AuthenticationError" ? "auth" : "refused")
++    }
+ 
+     const onError = (cause: Error) => failConnect(cause, "PgConnection: Failed to connect")
+     const onClose = () =>
+@@ -2037,7 +2687,7 @@ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined):
+           secretKey = message.secret
+           return
+         case "ErrorResponse":
+-          return fail(classifyFields(message.fields, "PgConnection: Failed to connect", "connect"))
++          return failServer(message.fields, "PgConnection: Failed to connect")
+         case "ReadyForQuery":
+           if (scram !== undefined) {
+             return failAuth(
+@@ -2098,7 +2748,7 @@ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined):
+             "PgConnection: Invalid SSLRequest response"
+           )
+         }
+-        return fail(classifyFields(message.fields, "PgConnection: Failed to negotiate TLS", "connect"))
++        return failServer(message.fields, "PgConnection: Failed to negotiate TLS")
+       }
+       socket.off("data", onSslResponse)
+       if (chunk.length !== 1) {
+@@ -2147,10 +2797,9 @@ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined):
+         // nothing to coalesce and only holds the write back.
+         : Net.connect({ host: config.host, port: config.port, noDelay: true })
+     } catch (cause) {
+-      resume(Effect.fail(
+-        new SqlError({
+-          reason: new ConnectionError({ cause, message: "PgConnection: Failed to connect", operation: "connect" })
+-        })
++      resume(connectFailed(
++        "refused",
++        new ConnectionError({ cause, message: "PgConnection: Failed to connect", operation: "connect" })
+       ))
+       return
+     }
+@@ -2159,7 +2808,10 @@ const connect = (config: ResolvedConfig, resolvedPassword: string | undefined):
+     if (config.stream !== undefined) {
+       begin()
+     } else {
+-      socket.once("connect", begin)
++      socket.once("connect", () => {
++        connected = true
++        begin()
++      })
+     }
  
- /** Turns one decoded row into an object keyed by column name. */
- type RowBuilder = (rowValues: ReadonlyArray<unknown>) => Row
+     return Effect.sync(() => {
 diff --git a/src/PgPool.ts b/src/PgPool.ts
 index c3d75942c1c1e8a03b3876160a2830983af9113e..72200f290aeef967b4b38f65d014b2d4724f1840 100644
 --- a/src/PgPool.ts
diff --git a/patches/better-auth@1.7.5.patch b/patches/better-auth@1.7.5.patch
index d4fc6cc9e4..68086a4e4a 100644
--- a/patches/better-auth@1.7.5.patch
+++ b/patches/better-auth@1.7.5.patch
@@ -127,3 +127,94 @@ index f0e2b9c..5229800 100644
  		if (field?.required === false) schema = schema.nullish();
  		if (!isClientSide && field?.returned === false) return acc;
  		return {
+diff --git a/dist/plugins/admin/admin.d.mts b/dist/plugins/admin/admin.d.mts
+index 03e33f2..7f69af7 100644
+--- a/dist/plugins/admin/admin.d.mts
++++ b/dist/plugins/admin/admin.d.mts
+@@ -868,6 +868,7 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
+     INVALID_ROLE_TYPE: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
++    USER_ID_CANNOT_BE_UPDATED: _$_better_auth_core_utils_error_codes0.RawError<"USER_ID_CANNOT_BE_UPDATED">;
+   };
+   schema: {
+     user: {
+diff --git a/dist/plugins/admin/admin.mjs b/dist/plugins/admin/admin.mjs
+index b27646d..49ad91a 100644
+--- a/dist/plugins/admin/admin.mjs
++++ b/dist/plugins/admin/admin.mjs
+@@ -22,7 +22,7 @@ const admin = (options) => {
+ 	return {
+ 		id: "admin",
+ 		version: PACKAGE_VERSION,
+-		init() {
++		init(authContext) {
+ 			return { options: { databaseHooks: {
+ 				user: { create: { async before(user) {
+ 					return { data: {
+@@ -31,11 +31,11 @@ const admin = (options) => {
+ 					} };
+ 				} } },
+ 				session: { create: { async before(session, ctx) {
+-					if (!ctx) return;
+-					const user = await ctx.context.internalAdapter.findUserById(session.userId);
++					const internalAdapter = ctx?.context.internalAdapter ?? authContext.internalAdapter;
++					const user = await internalAdapter.findUserById(session.userId);
+ 					if (user?.banned) {
+ 						if (user.banExpires && new Date(user.banExpires).getTime() < Date.now()) {
+-							await ctx.context.internalAdapter.updateUser(session.userId, {
++							await internalAdapter.updateUser(session.userId, {
+ 								banned: false,
+ 								banReason: null,
+ 								banExpires: null
+diff --git a/dist/plugins/admin/client.d.mts b/dist/plugins/admin/client.d.mts
+index 921bb02..c0b1eb9 100644
+--- a/dist/plugins/admin/client.d.mts
++++ b/dist/plugins/admin/client.d.mts
+@@ -75,6 +75,7 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
+     INVALID_ROLE_TYPE: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
++    USER_ID_CANNOT_BE_UPDATED: _$_better_auth_core_utils_error_codes0.RawError<"USER_ID_CANNOT_BE_UPDATED">;
+   };
+ };
+ //#endregion
+diff --git a/dist/plugins/admin/error-codes.d.mts b/dist/plugins/admin/error-codes.d.mts
+index 0906710..18b1d9c 100644
+--- a/dist/plugins/admin/error-codes.d.mts
++++ b/dist/plugins/admin/error-codes.d.mts
+@@ -25,6 +25,7 @@ declare const ADMIN_ERROR_CODES: {
+   INVALID_ROLE_TYPE: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+   YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _$_better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+   PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
++  USER_ID_CANNOT_BE_UPDATED: _$_better_auth_core_utils_error_codes0.RawError<"USER_ID_CANNOT_BE_UPDATED">;
+ };
+ //#endregion
+ export { ADMIN_ERROR_CODES };
+\ No newline at end of file
+diff --git a/dist/plugins/admin/error-codes.mjs b/dist/plugins/admin/error-codes.mjs
+index 6f2639d..6f55147 100644
+--- a/dist/plugins/admin/error-codes.mjs
++++ b/dist/plugins/admin/error-codes.mjs
+@@ -23,7 +23,8 @@ const ADMIN_ERROR_CODES = defineErrorCodes({
+ 	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
+ 	INVALID_ROLE_TYPE: "Invalid role type",
+ 	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
+-	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
++	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead",
++	USER_ID_CANNOT_BE_UPDATED: "User id cannot be updated"
+ });
+ //#endregion
+ export { ADMIN_ERROR_CODES };
+diff --git a/dist/plugins/admin/routes.mjs b/dist/plugins/admin/routes.mjs
+index 126a99b..eb4859b 100644
+--- a/dist/plugins/admin/routes.mjs
++++ b/dist/plugins/admin/routes.mjs
+@@ -255,6 +255,7 @@ const adminUpdateUser = (opts) => createAuthEndpoint("/admin/update-user", {
+ 	const updateData = ctx.body.data;
+ 	const hasDataKey = (key) => Object.prototype.hasOwnProperty.call(updateData, key);
+ 	if (hasDataKey("password")) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER);
++	if (hasDataKey("id")) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ID_CANNOT_BE_UPDATED);
+ 	if (Object.prototype.hasOwnProperty.call(ctx.body.data, "role")) {
+ 		if (!hasPermission({
+ 			userId: ctx.context.session.user.id,
diff --git a/patches/effect-sql-pg-tracing.md b/patches/effect-sql-pg-tracing.md
index 18326ec76e..254c7faad1 100644
--- a/patches/effect-sql-pg-tracing.md
+++ b/patches/effect-sql-pg-tracing.md
@@ -4,13 +4,33 @@
 but its physical PostgreSQL connection acquisition has no span. A slow first
 transaction therefore includes an unexplained interval before its first query.
 
-`@effect%2Fsql-pg@4.0.1.patch` adds a client `sql.connect` span around the
-driver's existing network connection and authentication effect. It ends when
+`@effect%2Fsql-pg@4.0.1.patch` adds a client `sql.connect` span around one
+connection attempt: password resolution, the driver's existing network
+connection and authentication effect, and `connectTimeout`. It ends when
 PostgreSQL sends `ReadyForQuery`, or on failure or interruption. It adds no URL,
-credentials, query text, or connection attributes. Password/config resolution
-and later query execution are outside this span. The span records its
+credentials, query text, or connection attributes. Config resolution and later
+query execution are outside this span. The span records its
 `db.connect.attempt`, starting at 1.
 
+A failed attempt fails its span and records why as `db.connect.failure`, one of:
+
+- `timeout`: the attempt reached `connectTimeout`. The timeout runs inside the
+  span, so the attempt fails it; before late October 2026 the timeout
+  interrupted the span from outside and it ended with status OK.
+- `refused`: the connection was not accepted. The transport failed before its
+  socket connected (a refused, unreachable or unresolvable host), or the server
+  answered the startup with an error that is not about authentication, such as
+  too many connections. Classified by when it failed, not by the socket error's
+  text or code: workerd's `node:net` gives a refused connection no code.
+- `auth`: authentication failed: SQLSTATE class 28, no password configured, or
+  an exchange that could not complete.
+- `other`: anything else, such as a password provider that dies, a connected
+  socket that failed or closed during startup, TLS negotiation, or a response
+  the driver could not read.
+
+An attempt its caller interrupts records none and still ends interrupted. The
+attribute changes no error, retry or timeout.
+
 The patch changes both source and distributed JavaScript. It preserves lazy
 pool acquisition, reuse, dead-connection replacement, idle release, and scoped
 socket cleanup. It does not open a connection to measure it. The existing
@@ -35,7 +55,7 @@ caller per connection, `PgPool.held`, settling abandoned and unawaited statement
 The patch also adds a `connectRetries` option (default `0`) to `PgConnection`
 and `PgClient` configuration. A connection attempt that fails with a retryable
 reason, such as a transport error or `connectTimeout`, is made again up to that
-many times. Each attempt has its own `connectTimeout`. Nothing has been sent on
+many times. Each attempt has its own `connectTimeout` and `sql.connect` span. Nothing has been sent on
 a connection before `ReadyForQuery`, so this never repeats a statement; query
 failures are not retried. Authentication failures are not retryable. A retried
 attempt's span also records the previous failure's fixed driver message as
@@ -46,12 +66,15 @@ Object pools set one retry (see `cloudDatabasePool` in
 
 ## Statement wire timing
 
-The patch also adds `sql.wire` for the driver's single-statement path, including
-pinned transaction queries. It records frame byte count and elapsed milliseconds
+The patch also records wire timing for the driver's single-statement path,
+including pinned transaction queries: frame byte count and elapsed milliseconds
 from socket write to its callback, the first decoded PostgreSQL message,
 `CommandComplete`, and `ReadyForQuery`. Cloud enables Effect's
-`Statement.SpanPropagationEnabled` so the executing SQL span becomes the wire
-span's parent. The driver patch alone does not enable that upstream option.
+`Statement.SpanPropagationEnabled`, so the statement's `sql.execute` span is
+current while it runs; the timings are recorded on that span as `db.wire.*`
+attributes. A statement without its own `sql.execute`, such as transaction
+control, or any statement when propagation is off, records them on a `sql.wire`
+span of its own. The driver patch alone does not enable that upstream option.
 It does not log parameters, bytes, rows, SQL text, hostnames, or credentials.
 
 `db.wire.clock = date-now` identifies the clock. In Cloudflare, it advances on
diff --git a/playground/sdk/storage.ts b/playground/sdk/storage.ts
index a2d7f741f9..fbb182d3b2 100644
--- a/playground/sdk/storage.ts
+++ b/playground/sdk/storage.ts
@@ -10,7 +10,7 @@ export const storageWalkthrough = () =>
       Effect.gen(function* () {
         const storage = yield* makeExecutorStorage({ provider: "postgresql" });
         yield* storage.migrate;
-        const orm = storage.orm("4.0.15");
+        const orm = storage.orm("4.0.16");
         const createdAt = new Date("2026-01-01T00:00:00.000Z");
         const version = yield* Schema.decodeUnknownEffect(StoredVersion)({
           id: "dpl_example",
diff --git a/scripts/e2e-npm-packages.ts b/scripts/e2e-npm-packages.ts
index e740ff4966..7064ff9aa8 100644
--- a/scripts/e2e-npm-packages.ts
+++ b/scripts/e2e-npm-packages.ts
@@ -53,7 +53,7 @@ const roots: ReadonlyArray<Root> = [
   dependency("zod", "3.25.76"),
   // The compiler installs Tailwind at the version the host bundles for `@import "tailwindcss"`.
   alone("tailwindcss", tailwind.version),
-  ...[0, 1, 2, 4, 5, 9, 10, 14, 22, 33, 35, 59, 84].map((beta) =>
+  ...[0, 1, 2, 4, 5, 9, 10, 14, 22, 33, 35, 59, 84, 95].map((beta) =>
     alone("apps", `0.0.1-beta.${beta}`),
   ),
 ];
diff --git a/scripts/local-dev.ts b/scripts/local-dev.ts
index a16d4a14af..966ab82ba8 100644
--- a/scripts/local-dev.ts
+++ b/scripts/local-dev.ts
@@ -4,7 +4,8 @@
  * already set wins, except the two served-address values below; this only fills gaps.
  *
  * - Data lives in this checkout's `.local/dev/`, apart from older directories
- *   that may be tied to other keys.
+ *   that may be tied to other keys. The CLI and the development desktop share
+ *   `.local/dev/local` and its background server.
  * - The dev directories use one development key pair saved in
  *   `.local/dev/keys.json` (mode 0600). A checkout copy carries its data and keys
  *   together, headless agents need no OS keychain, and throwaway copies leave no
@@ -75,7 +76,6 @@ const chosenDirectory =
   env.EXECUTOR_DATA_DIR !== undefined || env.EXECUTOR_DESKTOP_DATA_DIR !== undefined;
 const chosenKeys = env.EXECUTOR_API_KEY !== undefined || env.EXECUTOR_ENCRYPTION_KEY !== undefined;
 env.EXECUTOR_DATA_DIR ??= join(developmentDirectory, "local");
-env.EXECUTOR_DESKTOP_DATA_DIR ??= join(developmentDirectory, "desktop");
 if (!chosenDirectory && !chosenKeys) {
   const keys = developmentKeys();
   env.EXECUTOR_API_KEY = keys.apiKey;
diff --git a/scripts/releases/README.md b/scripts/releases/README.md
index bbebcfb913..3b4162248e 100644
--- a/scripts/releases/README.md
+++ b/scripts/releases/README.md
@@ -4,13 +4,20 @@ Install with npm, `npm i -g executor@beta --include=optional`, on Node 14.18
 or newer. Without Node, run `curl -fsSL https://executor.sh/docs/install.sh | sh`
 on macOS or Linux, or `irm https://executor.sh/docs/install.ps1 | iex` in
 PowerShell on Windows. Each release also attaches its archives and `SHA256SUMS`.
-Run `executor` to start the server and open the dashboard. It checks npm daily
-for a newer release and suggests `executor upgrade`; set `EXECUTOR_NO_UPDATE_CHECK=1` to skip it. Use `executor serve`
-for headless operation and `executor pair` to get a new browser connection link.
+Run `executor` to start the background Executor, or join the one already
+running, and open the dashboard. The background Executor keeps running until
+`executor service stop`; nothing starts it with the OS. `executor` checks npm
+daily for a newer release and suggests `executor upgrade`; set
+`EXECUTOR_NO_UPDATE_CHECK=1` to skip it. Use `executor service start` to start it
+without a browser, `executor serve` to run it in the foreground, and
+`executor pair` to get a new browser connection link.
 `executor upgrade` installs the newest release on your channel the way Executor
 was installed: an install-script copy downloads and checks the release and keeps
 the previous version for `executor upgrade --rollback`; an npm, pnpm, Bun or
-Yarn install runs its package manager. Restart a running server afterwards.
+Yarn install runs its package manager. Either way it stops the background
+Executor before replacing its files and starts it again on the new version; a
+release from before the background service, which a rollback can return to, has
+no `executor service`, so run `executor serve` there instead.
 
 Executor is one executable, built with Bun, with the files it runs or reads
 beside it: the dashboard, the app framework and compiler references, workerd,
@@ -22,9 +29,15 @@ installs as an optional dependency, for macOS (Apple Silicon and Intel), Linux
 download the install scripts and Homebrew use.
 
 Beta uses `~/.executor/v2/cli` for its data. This path stays the same at the
-stable release. It is separate from Executor 1 data. Do not run two servers
-against the same directory. `EXECUTOR_DATA_DIR` selects another directory and
-`EXECUTOR_PORT` changes the default port of 4312.
+stable release. It is separate from Executor 1 data. One server runs per data
+directory; its `.server.lock` stops a second. `EXECUTOR_DATA_DIR` selects another
+directory, and `EXECUTOR_PORT` or `executor service set port` changes the default
+port of 4312. The desktop app uses the same directory and background Executor.
+Its first launch moves the data of a desktop release from before the background
+service into that directory, once. CLI data already there moves to
+`~/.executor/v2/backups/cli-data-<time>`, which the desktop app names; nothing
+is merged or deleted. The CLI's settings carry over, except its port and the
+`env` variables that belong to its data.
 
 On first launch, Executor saves its API and encryption keys in the OS credential
 store: macOS Keychain, Windows Credential Manager, or Linux Secret Service.
@@ -76,9 +89,11 @@ The npm launcher is under `.local/releases/<version>/wrapper/` and uses exact
 native version aliases. These build commands do not publish anything.
 The app compiler and framework are prepared for workerd at build time. No
 runtime download is needed. Each compressed native archive must fit within
-180 MiB before publication. This is a release budget with margin, not a
-documented npm registry limit. External source maps stay in the separate CI
-artifact for release diagnostics.
+178 MiB before publication (`npmArchiveBudgetBytes` in `config.ts`). npm
+documents no limit; the budget stays below the largest archive it has accepted
+from Executor. Most of each archive is the executable, workerd and the bundled
+Git, which keeps only what the runtime runs (`keptGit` in `runtime-bundle.ts`).
+External source maps stay in the separate CI artifact for release diagnostics.
 
 Stock Bun lets any local process run its own code inside a compiled executable,
 through `BUN_OPTIONS`, `BUN_BE_BUN`, `BUN_INSPECT` and similar variables that
diff --git a/scripts/releases/bun-runtime/README.md b/scripts/releases/bun-runtime/README.md
index 3dd0830ae8..61b3b67b0c 100644
--- a/scripts/releases/bun-runtime/README.md
+++ b/scripts/releases/bun-runtime/README.md
@@ -7,23 +7,23 @@ process that can start the CLI could use them to run its own code inside our
 signed binary. We therefore compile the CLI with a Bun runtime that we patch
 and build ourselves.
 
-`lockdown.patch` applies to Bun `bun-v1.4.2` (commit `744846f8`) with
+`lockdown.patch` applies to Bun `bun-v1.4.4` (commit `38afee6c`) with
 `git apply`. At startup, `main` checks once whether the executable embeds a
 standalone module graph and stores the answer in a process-wide flag. Rust reads
 it through `bun_core::is_standalone_executable()` and C++ through
 `Bun__isStandaloneExecutable()`. When the flag is set, Bun ignores the
 following:
 
-| Vector                                                                                                   | Effect in stock Bun                                                                                                              | Where the patch closes it                                                             |
-| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| `BUN_BE_BUN`                                                                                             | The executable becomes the full `bun` CLI (`-e`, `run`, `x`, ...)                                                                | `src/runtime/cli/mod.rs`, graph dispatch                                              |
-| `BUN_INTERNAL_WEBVIEW_HOST`                                                                              | Before the graph is checked, the process becomes a WebView host that talks to an inherited fd (macOS)                            | `src/runtime/cli/mod.rs`                                                              |
-| `BUN_OPTIONS`                                                                                            | Spliced into argv: `--preload`, `--require`, `--import`, `--config`, `--cwd`, `--env-file`, `--inspect`, ...                     | `src/bun_core/util.rs`, `argv_view_init`                                              |
-| `BUN_INSPECT`, `BUN_INSPECT_CONNECT_TO`                                                                  | Starts the inspector, either listening or connecting out, which gives full JS control                                            | `src/runtime/jsc_hooks.rs`, `configure_debugger`                                      |
-| `BUN_INSPECT_PRELOAD`                                                                                    | Preloads a module                                                                                                                | `src/runtime/cli/Arguments.rs`                                                        |
-| `BUN_JSC_*`                                                                                              | Sets any JavaScriptCore option, including JIT, memory-safety and internal-API switches                                           | `src/jsc/bindings/ZigGlobalObject.cpp`, `JSCInitialize`                               |
-| `NODE_PATH`                                                                                              | Adds module search roots, which can satisfy optional `require()`s in packages loaded from disk (for example `ws` → `bufferutil`) | `src/resolver/resolver.rs`                                                            |
-| Runtime transpiler cache (`BUN_RUNTIME_TRANSPILER_CACHE_PATH`, `XDG_CACHE_HOME`, `~/Library/Caches/bun`) | Transpiled output for files loaded from disk is read from a user-writable cache                                                  | `src/jsc/RuntimeTranspilerCache.rs`, `src/bundler/cache.rs`: always off when compiled |
+| Vector                                                                                                   | Effect in stock Bun                                                                                                              | Where the patch closes it                                                                   |
+| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `BUN_BE_BUN`                                                                                             | The executable becomes the full `bun` CLI (`-e`, `run`, `x`, ...)                                                                | `src/runtime/cli/mod.rs`, graph dispatch                                                    |
+| `BUN_INTERNAL_WEBVIEW_HOST`                                                                              | Before the graph is checked, the process becomes a WebView host that talks to an inherited fd (macOS)                            | `src/runtime/cli/mod.rs`                                                                    |
+| `BUN_OPTIONS`                                                                                            | Spliced into argv: `--preload`, `--require`, `--import`, `--config`, `--cwd`, `--env-file`, `--inspect`, ...                     | `src/bun_core/util.rs`, `argv_view_init`                                                    |
+| `BUN_INSPECT`, `BUN_INSPECT_CONNECT_TO`                                                                  | Starts the inspector, either listening or connecting out, which gives full JS control                                            | `src/runtime/jsc_hooks.rs`, `configure_debugger`                                            |
+| `BUN_INSPECT_PRELOAD`                                                                                    | Preloads a module                                                                                                                | `src/runtime/cli/Arguments.rs`                                                              |
+| `BUN_JSC_*`                                                                                              | Sets any JavaScriptCore option, including JIT, memory-safety and internal-API switches                                           | `src/jsc/bindings/ZigGlobalObject.cpp`, `JSCInitialize` and `JSC__useOptionsForVMPerThread` |
+| `NODE_PATH`                                                                                              | Adds module search roots, which can satisfy optional `require()`s in packages loaded from disk (for example `ws` → `bufferutil`) | `src/resolver/resolver.rs`                                                                  |
+| Runtime transpiler cache (`BUN_RUNTIME_TRANSPILER_CACHE_PATH`, `XDG_CACHE_HOME`, `~/Library/Caches/bun`) | Transpiled output for files loaded from disk is read from a user-writable cache                                                  | `src/jsc/RuntimeTranspilerCache.rs`, `src/bundler/cache.rs`: always off when compiled       |
 
 Plain `bun`, without an embedded graph, behaves exactly as upstream.
 
@@ -58,15 +58,16 @@ same build model as Bun's release CI:
   `darwin-x64` runs under Rosetta on Apple silicon.
 
 The binaries and a `SHA256SUMS` file are published to the release
-`bun-runtime-1.4.2-<first 12 hex of sha256(lockdown.patch + build.patch)>`. An existing
+`bun-runtime-1.4.4-<first 12 hex of sha256(lockdown.patch)>`. An existing
 release is never overwritten.
 
-To build locally on macOS (arm64), use LLVM 21, rustup and Bun 1.4.2:
+To build locally on macOS (arm64), use LLVM 23, rustup and Bun 1.4.2, the Bun
+that Bun 1.4.4's build scripts pin:
 
 ```sh
-git clone --depth 1 --branch bun-v1.4.2 https://github.com/oven-sh/bun.git bun-src
-cd bun-src && git apply ../scripts/releases/bun-runtime/lockdown.patch ../scripts/releases/bun-runtime/build.patch
-export PATH="$(brew --prefix llvm@21)/bin:$PATH"
+git clone --depth 1 --branch bun-v1.4.4 https://github.com/oven-sh/bun.git bun-src
+cd bun-src && git apply ../scripts/releases/bun-runtime/lockdown.patch
+export PATH="$(brew --prefix llvm@23)/bin:$PATH"
 # clang 21 rejects headers in newer SDKs (Xcode betas); the 26.5 CLT SDK works.
 export DEVELOPER_DIR=/Library/Developer/CommandLineTools
 bun scripts/build.ts --profile=release --canary=off   # -> build/release/bun
@@ -75,7 +76,9 @@ bash ../scripts/releases/bun-runtime/smoke.sh build/release/bun
 
 ## Updating Bun
 
-1. Change `BUN_VERSION`, `BUN_TAG` and `BUN_COMMIT` in the workflow.
+1. Change `BUN_VERSION`, `BUN_TAG` and `BUN_COMMIT` in the workflow, and set
+   `BUILD_BUN_VERSION` to the Bun the new tag's `scripts/build/ci-images/spec.ts`
+   pins. Check that `setup-linux.sh` installs the LLVM series it pins.
 2. Check out the new tag and run `git apply --3way lockdown.patch`. Resolve any
    conflicts.
 3. Audit the new version again. Search for new environment variables
@@ -86,8 +89,3 @@ bash ../scripts/releases/bun-runtime/smoke.sh build/release/bun
 4. Regenerate the patch with `git diff > lockdown.patch`, build, and run
    `smoke.sh`.
 5. Merge to `main`. The new patch hash produces a new release name.
-
-`build.patch` changes only Bun's build scripts. Release CI builds with `--ci=on`, which sets the
-macOS deployment target, fetches the Windows sysroot and strips checkout paths, but upstream
-also skips the precompiled header in that mode, which its own pipeline never uses, and the C++
-sources then miss declarations the header provides. The patch keeps the precompiled header on.
diff --git a/scripts/releases/bun-runtime/build.patch b/scripts/releases/bun-runtime/build.patch
deleted file mode 100644
index 62daf94d35..0000000000
--- a/scripts/releases/bun-runtime/build.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/scripts/build/bun.ts b/scripts/build/bun.ts
-index fc1a7481..3b06562d 100644
---- a/scripts/build/bun.ts
-+++ b/scripts/build/bun.ts
-@@ -277,8 +277,9 @@ export function emitBun(n: Ninja, cfg: Config, sources: Sources): BunOutput {
-   const cFlagsFull = [...flags.cflags, ...includeFlags, ...defineFlags];
- 
-   // ─── Step 4: PCH ───
--  // CI full mode (unused by the pipeline) skips the PCH; cpp-only/archive-link use it.
--  const usePch = !cfg.ci || cfg.mode !== "full";
-+  // CI full mode skips the PCH upstream, but that mode is unused by Bun's pipeline and its
-+  // headers rely on the PCH for declarations (Bun::createClassStructure), so always use it.
-+  const usePch = true;
-   let pchOut: { pch: string; wrapperHeader: string } | undefined;
- 
-   if (usePch) {
diff --git a/scripts/releases/bun-runtime/lockdown.patch b/scripts/releases/bun-runtime/lockdown.patch
index 9e79954324..3ca47d63cb 100644
--- a/scripts/releases/bun-runtime/lockdown.patch
+++ b/scripts/releases/bun-runtime/lockdown.patch
@@ -1,8 +1,8 @@
 diff --git a/src/bun_core/util.rs b/src/bun_core/util.rs
-index 28006517..160c80d2 100644
+index 2ceeb185..263ced96 100644
 --- a/src/bun_core/util.rs
 +++ b/src/bun_core/util.rs
-@@ -3796,14 +3796,45 @@ fn argv_storage() -> &'static [ZBox] {
+@@ -3765,14 +3765,45 @@ fn argv_storage() -> &'static [ZBox] {
      })
  }
  
@@ -63,10 +63,10 @@ index fb867d89..22904c63 100644
                  .get()
                  .map(|v| v.is_empty() || v == b"0")
 diff --git a/src/jsc/RuntimeTranspilerCache.rs b/src/jsc/RuntimeTranspilerCache.rs
-index 6ad49e14..28aebab2 100644
+index 8d40a1bc..6ccf2e05 100644
 --- a/src/jsc/RuntimeTranspilerCache.rs
 +++ b/src/jsc/RuntimeTranspilerCache.rs
-@@ -611,6 +611,12 @@ impl RuntimeTranspilerCache {
+@@ -645,6 +645,12 @@ impl RuntimeTranspilerCache {
              );
          }
  
@@ -79,7 +79,7 @@ index 6ad49e14..28aebab2 100644
          if let Some(dir) = env_var::BUN_RUNTIME_TRANSPILER_CACHE_PATH.get() {
              if dir.is_empty() || (dir.len() == 1 && dir[0] == b'0') {
                  return 0;
-@@ -842,7 +848,7 @@ impl RuntimeTranspilerCache {
+@@ -877,7 +883,7 @@ impl RuntimeTranspilerCache {
          parser_options: &ParserOptions<'_>,
          used_jsx: bool,
      ) -> bool {
@@ -89,12 +89,12 @@ index 6ad49e14..28aebab2 100644
          }
  
 diff --git a/src/jsc/bindings/ZigGlobalObject.cpp b/src/jsc/bindings/ZigGlobalObject.cpp
-index 1bcd27a1..60b26cab 100644
+index 7f4ae0c3..0f85ea65 100644
 --- a/src/jsc/bindings/ZigGlobalObject.cpp
 +++ b/src/jsc/bindings/ZigGlobalObject.cpp
-@@ -280,6 +280,9 @@ extern "C" long Bun__crashHandlerFromJSCFrame(void*, void*, void*, void*);
- // bun_icu_default_locale.cpp
- extern "C" void Bun__ensureICUDefaultLocale();
+@@ -296,6 +296,9 @@ extern "C" void Bun__VirtualMachine__setSamplingProfilerDirectory(void* bunVM, c
+ // reporter, which crashes if fopen fails. VirtualMachine::write_profiles writes the report instead.
+ static const char8_t* s_samplingProfilerDirectory = nullptr;
  
 +// bun_core::is_standalone_executable(): true for `bun build --compile` output.
 +extern "C" bool Bun__isStandaloneExecutable();
@@ -102,7 +102,7 @@ index 1bcd27a1..60b26cab 100644
  extern "C" void JSCInitialize(const char* envp[], size_t envc, void (*onCrash)(const char* ptr, size_t length), bool evalMode, bool oneShotStartup, bool shortLivedGlobals)
  {
      static std::once_flag jsc_init_flag;
-@@ -360,7 +363,9 @@ extern "C" void JSCInitialize(const char* envp[], size_t envc, void (*onCrash)(c
+@@ -382,7 +385,9 @@ extern "C" void JSCInitialize(const char* envp[], size_t envc, void (*onCrash)(c
                  JSC::Options::thresholdForFTLOptimizeAfterWarmUp() = 1000000;
              }
  
@@ -113,11 +113,22 @@ index 1bcd27a1..60b26cab 100644
                  auto envc_copy = envc;
                  while (envc_copy--) {
                      const char* env = (const char*)envp[envc_copy];
+@@ -440,7 +445,9 @@ extern "C" void JSC__useOptionsForVMPerThread(const char* envp[], size_t envc)
+ {
+     RELEASE_ASSERT(!g_jscConfig.isPermanentlyFrozen());
+     JSC::Options::useConcurrentJIT() = false;
+-    // BUN_JSC_useConcurrentJIT wins, as in JSCInitialize.
++    // BUN_JSC_useConcurrentJIT wins, as in JSCInitialize. Compiled executables ignore it, as they ignore every BUN_JSC_*.
++    if (Bun__isStandaloneExecutable())
++        return;
+     for (size_t i = 0; i < envc; i++) {
+         if (WTF::StringView::fromLatin1(envp[i]).startsWithIgnoringASCIICase("BUN_JSC_useConcurrentJIT="_s))
+             JSC::Options::setOption(envp[i] + 8, false);
 diff --git a/src/resolver/resolver.rs b/src/resolver/resolver.rs
-index 24f019f6..99e9bcf8 100644
+index 5e63425e..0c447b32 100644
 --- a/src/resolver/resolver.rs
 +++ b/src/resolver/resolver.rs
-@@ -2794,8 +2794,11 @@ impl<'a> Resolver<'a> {
+@@ -2877,8 +2877,11 @@ impl<'a> Resolver<'a> {
  
          // try resolve from `NODE_PATH`
          // https://nodejs.org/api/modules.html#loading-from-the-global-folders
@@ -130,12 +141,12 @@ index 24f019f6..99e9bcf8 100644
              .unwrap_or(b"");
          if !node_path.is_empty() {
 diff --git a/src/runtime/bin_entry/mod.rs b/src/runtime/bin_entry/mod.rs
-index 098d8c73..1a6a9058 100644
+index 2169092d..b42bdbb3 100644
 --- a/src/runtime/bin_entry/mod.rs
 +++ b/src/runtime/bin_entry/mod.rs
-@@ -154,6 +154,10 @@ pub(crate) unsafe extern "C" fn main(argc: c_int, argv: *const *const c_char) ->
-     //    for the entire process.
-     unsafe { bun_core::init_argv(argc, argv) };
+@@ -168,6 +168,10 @@ pub(crate) unsafe extern "C" fn main(argc: c_int, argv: *const *const c_char) ->
+         bun_abort_missing_simd();
+     }
  
 +    // 0b. Decide once whether this is a `bun build --compile` executable,
 +    //     before argv (BUN_OPTIONS) or any other environment variable is read.
@@ -145,10 +156,10 @@ index 098d8c73..1a6a9058 100644
      bun_crash_handler::init();
  
 diff --git a/src/runtime/cli/Arguments.rs b/src/runtime/cli/Arguments.rs
-index 8ed18c92..7ced2bf4 100644
+index d2a10546..18c1b69e 100644
 --- a/src/runtime/cli/Arguments.rs
 +++ b/src/runtime/cli/Arguments.rs
-@@ -1013,7 +1013,9 @@ pub(crate) fn parse(cmd: CommandTag, ctx: Context<'_>) -> crate::Result<api::Tra
+@@ -1056,7 +1056,9 @@ pub(crate) fn parse(cmd: CommandTag, ctx: Context<'_>) -> crate::Result<api::Tra
              let preloads = args.options(b"--preload");
              let preloads2 = args.options(b"--require");
              let preloads3 = args.options(b"--import");
@@ -160,10 +171,10 @@ index 8ed18c92..7ced2bf4 100644
              let total_preloads = ctx.preloads.len()
                  + preloads.len()
 diff --git a/src/runtime/cli/mod.rs b/src/runtime/cli/mod.rs
-index b1046329..c47e3174 100644
+index 9be3a69c..1c8fe8fe 100644
 --- a/src/runtime/cli/mod.rs
 +++ b/src/runtime/cli/mod.rs
-@@ -1168,9 +1168,13 @@ pub mod command {
+@@ -1009,9 +1009,13 @@ pub(crate) mod command {
          // WebView host subprocess entry. Must be before StandaloneModuleGraph,
          // before JSC init, before anything that touches a JS engine. The child
          // runs CFRunLoopRun() as its real main loop — no Bun runtime past this.
@@ -178,7 +189,7 @@ index b1046329..c47e3174 100644
                  // Parse base-10 directly
                  // from bytes; env var values are `&[u8]`, not assumed UTF-8.
                  let fd: u32 = match bun_core::parse_int::<u32>(fd_str, 10).ok() {
-@@ -1189,13 +1193,18 @@ pub mod command {
+@@ -1030,13 +1034,18 @@ pub(crate) mod command {
              }
          }
  
@@ -200,10 +211,10 @@ index b1046329..c47e3174 100644
  
          // Fast path: `bun -v` / `bun --version` / `bun --revision`, the
 diff --git a/src/runtime/jsc_hooks.rs b/src/runtime/jsc_hooks.rs
-index 029b3568..cd76cb4f 100644
+index 920f9c46..dc9bcb4d 100644
 --- a/src/runtime/jsc_hooks.rs
 +++ b/src/runtime/jsc_hooks.rs
-@@ -591,8 +591,19 @@ unsafe fn configure_debugger(
+@@ -558,8 +558,19 @@ unsafe fn configure_debugger(
          return;
      }
  
@@ -226,10 +237,10 @@ index 029b3568..cd76cb4f 100644
      let set_breakpoint_on_first_line = !unix.is_empty() && unix.ends_with(b"?break=1");
      let wait_for_debugger = !unix.is_empty() && unix.ends_with(b"?wait=1");
 diff --git a/src/standalone_graph/StandaloneModuleGraph.rs b/src/standalone_graph/StandaloneModuleGraph.rs
-index 9ab6dbbf..550cd4c5 100644
+index 91c73cb9..23ea99f2 100644
 --- a/src/standalone_graph/StandaloneModuleGraph.rs
 +++ b/src/standalone_graph/StandaloneModuleGraph.rs
-@@ -2710,6 +2710,31 @@ impl StandaloneModuleGraph {
+@@ -3106,6 +3106,31 @@ impl StandaloneModuleGraph {
      /// Loads the standalone module graph from the executable, allocates it on the heap,
      /// sets it globally, and returns the pointer.
      pub fn from_executable() -> crate::Result<Option<*mut StandaloneModuleGraph>> {
@@ -261,7 +272,7 @@ index 9ab6dbbf..550cd4c5 100644
          #[cfg(target_os = "macos")]
          let data = macho::get_data();
          #[cfg(windows)]
-@@ -2724,30 +2749,21 @@ impl StandaloneModuleGraph {
+@@ -3120,30 +3145,21 @@ impl StandaloneModuleGraph {
              target_os = "freebsd"
          )))]
          let data: Option<(*mut u8, usize)> = None;
diff --git a/scripts/releases/bun-runtime/setup-linux.sh b/scripts/releases/bun-runtime/setup-linux.sh
index f2ff91de64..1f970099f2 100755
--- a/scripts/releases/bun-runtime/setup-linux.sh
+++ b/scripts/releases/bun-runtime/setup-linux.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # Prepares a GitHub-hosted Ubuntu 24.04 runner to build the patched Bun
 # runtime for one target, the way Bun's own release CI does:
-#   - LLVM 21 from apt.llvm.org (scripts/bootstrap.sh install_llvm)
+#   - LLVM 23.1 from apt.llvm.org (the series scripts/build/ci-images/spec.ts pins)
 #   - the pinned nightly Rust toolchain plus the target's std
 #   - for linux targets, the ubuntu:20.04 glibc sysroot with gcc-13
-#     libstdc++ (scripts/bootstrap.sh install_linux_glibc_sysroot), so the
+#     libstdc++ (spec.ts glibcSysroot), so the
 #     binary needs glibc 2.17 like the official release, not the runner's
 #     glibc
 # darwin targets fetch the macOS SDK from Apple's CDN and windows targets
@@ -34,13 +34,13 @@ sudo apt-get install -y --no-install-recommends \
   automake autoconf libtool nasm xz-utils unzip zip jq skopeo \
   binutils-x86-64-linux-gnu binutils-aarch64-linux-gnu
 
-# LLVM 21 (clang, lld incl. ld64.lld and lld-link, llvm-strip, dsymutil).
+# LLVM 23 (clang, lld incl. ld64.lld and lld-link, llvm-strip, dsymutil).
 llvm_script="$(mktemp)"
 curl -fsSL https://apt.llvm.org/llvm.sh -o "$llvm_script"
-sudo bash "$llvm_script" 21 all
-sudo apt-get install -y --no-install-recommends llvm-21-tools
-echo "/usr/lib/llvm-21/bin" >> "$GITHUB_PATH"
-/usr/lib/llvm-21/bin/clang --version | head -1
+sudo bash "$llvm_script" 23 all
+sudo apt-get install -y --no-install-recommends llvm-23-tools
+echo "/usr/lib/llvm-23/bin" >> "$GITHUB_PATH"
+/usr/lib/llvm-23/bin/clang --version | head -1
 
 # Rust: the toolchain pinned in the Bun checkout's rust-toolchain.toml.
 if ! command -v rustup >/dev/null 2>&1; then
diff --git a/scripts/releases/config.ts b/scripts/releases/config.ts
index 5b955634ee..a41d494b14 100644
--- a/scripts/releases/config.ts
+++ b/scripts/releases/config.ts
@@ -13,8 +13,14 @@ export {
   type ReleaseChannel,
 } from "@executor-js/utils/release-version";
 
-/** Conservative compressed archive budget, checked before npm receives any upload. */
-export const npmArchiveBudgetBytes = 180 * 1024 * 1024;
+/**
+ * The compressed archive budget, checked before npm receives any upload. npm documents no size
+ * limit. It refused a 298.9 MB archive with HTTP 413, and others report refusals from about
+ * 185 MB; the largest Executor archive it has accepted is 187,186,037 bytes. The budget stays
+ * below that.
+ */
+export const npmArchiveBudgetMiB = 178;
+export const npmArchiveBudgetBytes = npmArchiveBudgetMiB * 1024 * 1024;
 
 /**
  * Native platforms supported by the packaged runtime. The full CLI suite runs against the packaged
diff --git a/scripts/releases/desktop.ts b/scripts/releases/desktop.ts
index 284f5fed9b..482c39bf32 100644
--- a/scripts/releases/desktop.ts
+++ b/scripts/releases/desktop.ts
@@ -2,11 +2,15 @@
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { Hex } from "effect/encoding";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { desktopUpdateFeed, desktopUpdateFile, nativePlatform, release } from "./config.ts";
 import { developerIdMac, unsignedMac } from "./macos-signing.ts";
 import { installNodeRuntime } from "./node-runtime.ts";
-import { launcherAnalytics } from "./analytics.ts";
+import {
+  DesktopRuntimeBuild,
+  desktopRuntimeBuildFile,
+} from "../../apps/local/desktop/src/contracts/desktop.ts";
 
 const build = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
@@ -26,10 +30,10 @@ const build = Effect.gen(function* () {
   const stage = path.join(output, "desktop");
   const artifacts = path.join(output, "desktop-artifacts");
   const runtime = path.join(stage, "runtime");
-  // The desktop runs the packaged runtime with its own Node; the npm archive holds the CLI's
+  // The desktop runs the packaged CLI runtime with its own Node; the npm archive holds the CLI's
   // executable instead.
   const packaged = path.join(output, "package");
-  if (!(yield* fs.exists(path.join(packaged, "runtime/desktop.mjs"))))
+  if (!(yield* fs.exists(path.join(packaged, "bin.mjs"))))
     return yield* Effect.die(new Error("Build the matching CLI runtime before the desktop."));
   const run = (
     command: string,
@@ -69,26 +73,19 @@ const build = Effect.gen(function* () {
   yield* fs.makeDirectory(runtime, { recursive: true });
   yield* fs.copy(packaged, runtime, { overwrite: true });
   yield* installNodeRuntime(runtime);
-  // The backend restarts with each launch; Node's compile cache spares it recompiling the runtime.
-  // Node writes the cache only on an orderly exit, and on Windows the desktop's stop terminates
-  // the backend outright, so it is written once the runtime has loaded.
+  // The desktop copies this runtime out of the app once per build and runs the background server
+  // from that copy with `node bin.mjs`, so the server outlives an update or an unmounted AppImage.
   yield* fs.writeFileString(
-    path.join(runtime, "desktop-server.mjs"),
-    `import { flushCompileCache } from "node:module";
-import { enablePrivateCompileCache } from "./compile-cache.mjs";
-import { packagedRuntimeEnvironment } from "./runtime-env.mjs";
-Object.assign(process.env, packagedRuntimeEnvironment(process.env));
-process.env.EXECUTOR_BUILD_VERSION = ${JSON.stringify(version)};
-${yield* launcherAnalytics}enablePrivateCompileCache();
-await import("./runtime/desktop.mjs");
-flushCompileCache();
-`,
+    path.join(runtime, desktopRuntimeBuildFile),
+    yield* Schema.encodeEffect(Schema.fromJsonString(DesktopRuntimeBuild))({
+      version,
+      build: Hex.encode(crypto.getRandomValues(new Uint8Array(6))),
+    }),
   );
   yield* run("node", ["apps/local/desktop/scripts/build.mjs"], root);
-  yield* fs.copyFile(
-    path.join(root, "apps/local/desktop/dist/main.cjs"),
-    path.join(stage, "main.cjs"),
-  );
+  // The main entry and the server starter it runs in a utility process.
+  for (const entry of ["main.cjs", "starter.cjs"])
+    yield* fs.copyFile(path.join(root, "apps/local/desktop/dist", entry), path.join(stage, entry));
   yield* fs.writeFileString(
     path.join(stage, "package.json"),
     JSON.stringify({
@@ -120,7 +117,7 @@ flushCompileCache();
     electronVersion: electron.devDependencies.electron,
     asar: true,
     npmRebuild: false,
-    files: ["main.cjs", "package.json"],
+    files: ["main.cjs", "starter.cjs", "package.json"],
     extraResources: [
       { from: runtime, to: "runtime" },
       // electron-builder deliberately omits a matcher's root node_modules.
diff --git a/scripts/releases/licenses/git-sources.md b/scripts/releases/licenses/git-sources.md
index 26c4def92f..6b673ac969 100644
--- a/scripts/releases/licenses/git-sources.md
+++ b/scripts/releases/licenses/git-sources.md
@@ -25,9 +25,12 @@ Git source tree and the binary package includes `licenses/git-GPL-2.0.txt`.
 
 The native project also bundles Git LFS and Git Credential Manager. Their
 versions and binary checksums are recorded in its `dependencies.json`.
-`git-lfs-notices.txt` adds Git LFS's license, Go runtime license and the notices
-from its pinned Go modules. Git Credential Manager's license and third-party
-notices remain in the distributed Git tree.
+Executor's binaries leave both out, with the network transports and scripted
+tools: they keep only the `git` executable, `git http-backend`, the libraries
+those load and `git init`'s templates (`keptGit` in
+`scripts/releases/runtime-bundle.ts`). `git-lfs-notices.txt` adds Git LFS's
+license, Go runtime license and the notices from its pinned Go modules, for
+releases that shipped it.
 
 Windows is a separate build: dugite repackages MinGit rather than compiling the
 POSIX source. Its source packages retain upstream code, patches, `PKGBUILD` recipes
diff --git a/scripts/releases/package.ts b/scripts/releases/package.ts
index b8eff75344..8bda78acc5 100644
--- a/scripts/releases/package.ts
+++ b/scripts/releases/package.ts
@@ -1,12 +1,13 @@
 /** Build the platform's release install and its npm package. Nothing is published. */
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { Config, Console, Effect, FileSystem, Path } from "effect";
+import { Config, Console, Effect, FileSystem, Path, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { bundleLocalRuntime } from "./runtime-bundle.ts";
 import {
   nativePlatform,
   npmArchiveBudgetBytes,
+  npmArchiveBudgetMiB,
   platformArchive,
   platformVersion,
   release,
@@ -14,6 +15,7 @@ import {
 import { installWindowsGitHttpBackend } from "./windows-git.ts";
 import { launcherAnalytics } from "./analytics.ts";
 import { buildStandalone } from "./standalone.ts";
+import { bundledGit } from "../../packages/app-source/src/node.ts";
 
 const build = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
@@ -102,38 +104,58 @@ const build = Effect.gen(function* () {
   // launch after the first skips recompiling the bundled server (about 150 ms).
   yield* fs.writeFileString(
     path.join(stage, "bin.mjs"),
-    `#!/usr/bin/env node\nimport { flushCompileCache } from "node:module";\nimport { homedir } from "node:os";\nimport { join } from "node:path";\nimport { enablePrivateCompileCache } from "./compile-cache.mjs";\nimport { packagedRuntimeEnvironment } from "./runtime-env.mjs";\nObject.assign(process.env, packagedRuntimeEnvironment(process.env));\nprocess.env.EXECUTOR_DATA_DIR ??= join(homedir(), ".executor", "v2", "cli");\nprocess.env.EXECUTOR_BUILD_VERSION = ${JSON.stringify(version)};\n${yield* launcherAnalytics}enablePrivateCompileCache();\nawait import("./runtime/cli.mjs");\nflushCompileCache();\n`,
+    `#!/usr/bin/env node\nimport { flushCompileCache } from "node:module";\nimport { homedir } from "node:os";\nimport { join } from "node:path";\nimport { enablePrivateCompileCache } from "./compile-cache.mjs";\nimport { useBundledGit } from "./runtime-env.mjs";\nuseBundledGit();\nprocess.env.EXECUTOR_DATA_DIR ??= join(homedir(), ".executor", "v2", "cli");\nprocess.env.EXECUTOR_BUILD_VERSION = ${JSON.stringify(version)};\n${yield* launcherAnalytics}enablePrivateCompileCache();\nawait import("./runtime/cli.mjs");\nflushCompileCache();\n`,
   );
   yield* fs.chmod(path.join(stage, "bin.mjs"), 0o755);
   yield* fs.copyFile(path.join(root, "scripts/releases/README.md"), path.join(stage, "README.md"));
   yield* fs.copyFile(path.join(root, "apps/cli/LICENSE"), path.join(stage, "LICENSE"));
   yield* installWindowsGitHttpBackend(stage);
-  yield* run(
-    "node",
-    [
-      "--input-type=module",
-      "--eval",
-      `import { spawnSync } from "node:child_process";
-import { packagedRuntimeEnvironment } from "./runtime-env.mjs";
-const result = spawnSync("git", ["--version"], {
-  env: packagedRuntimeEnvironment({ ...process.env, PATH: "" }),
-  stdio: "inherit",
-});
-if (result.error) throw result.error;
-if (result.status !== 0) process.exit(1);
-const backend = spawnSync("git", ["http-backend"], {
-  env: packagedRuntimeEnvironment({ ...process.env, PATH: "", GIT_PROJECT_ROOT: process.cwd(),
-    GIT_HTTP_EXPORT_ALL: "1", PATH_INFO: "/executor-release-probe-missing.git/info/refs",
-    REQUEST_METHOD: "GET", QUERY_STRING: "service=git-upload-pack", SERVER_PROTOCOL: "HTTP/1.1" }),
-  encoding: "utf8",
-});
-if (backend.error) throw backend.error;
-if (backend.status !== 0 || !backend.stdout.includes("Status: 404")) {
-  throw new Error("The bundled Git HTTP backend did not return the expected missing-repository response");
-}`,
-    ],
-    stage,
+  // The bundled Git runs with no other Git on PATH and answers Git's HTTP protocol.
+  const git = bundledGit(path.join(stage, "node_modules/dugite/git"));
+  const inherited = Object.fromEntries(
+    Object.entries(process.env).filter(
+      (entry): entry is [string, string] =>
+        entry[1] !== undefined && entry[0].toUpperCase() !== "PATH",
+    ),
   );
+  const probe = (args: readonly string[], environment: Record<string, string> = {}) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const child = yield* processes.spawn(
+          ChildProcess.make(git.executable, args, {
+            cwd: stage,
+            extendEnv: false,
+            env: { ...inherited, PATH: "", ...git.environment, ...environment },
+            stdin: "ignore",
+            stdout: "pipe",
+            stderr: "inherit",
+          }),
+        );
+        const [code, stdout] = yield* Effect.all(
+          [child.exitCode, child.stdout.pipe(Stream.decodeText(), Stream.mkString)],
+          { concurrency: 2 },
+        );
+        return { code: Number(code), stdout };
+      }),
+    );
+  const started = yield* probe(["--version"]);
+  if (started.code !== 0 || !started.stdout.startsWith("git version "))
+    return yield* Effect.die(new Error(`The bundled Git did not start: ${started.stdout}`));
+  yield* Console.log(started.stdout.trim());
+  const backend = yield* probe(["http-backend"], {
+    GIT_PROJECT_ROOT: stage,
+    GIT_HTTP_EXPORT_ALL: "1",
+    PATH_INFO: "/executor-release-probe-missing.git/info/refs",
+    REQUEST_METHOD: "GET",
+    QUERY_STRING: "service=git-upload-pack",
+    SERVER_PROTOCOL: "HTTP/1.1",
+  });
+  if (backend.code !== 0 || !backend.stdout.includes("Status: 404"))
+    return yield* Effect.die(
+      new Error(
+        "The bundled Git HTTP backend did not return the expected missing-repository response",
+      ),
+    );
   // The npm package is the release install: the executable and the files beside it. The staged
   // runtime stays for the desktop app, which runs it with its own Node.
   // Signing is a deliberate choice per build, and notarizing implies signing. A published macOS
@@ -156,7 +178,9 @@ if (backend.status !== 0 || !backend.stdout.includes("Status: 404")) {
   );
   if (bytes > budgetBytes)
     return yield* Effect.die(
-      new Error(`npm archive exceeds the 180 MiB release budget: ${bytes} bytes`),
+      new Error(
+        `npm archive exceeds the ${npmArchiveBudgetMiB} MiB release budget: ${bytes} bytes`,
+      ),
     );
   yield* Console.log(`Native artifact: ${output} (${(bytes / 1024 / 1024).toFixed(1)} MiB)`);
 });
diff --git a/scripts/releases/publish-npm.ts b/scripts/releases/publish-npm.ts
index 47ac579b24..86c18bc7b7 100644
--- a/scripts/releases/publish-npm.ts
+++ b/scripts/releases/publish-npm.ts
@@ -20,6 +20,7 @@ import { FetchHttpClient, HttpClient } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import {
   npmArchiveBudgetBytes,
+  npmArchiveBudgetMiB,
   platformArchive,
   platformVersion,
   platforms,
@@ -94,7 +95,9 @@ NodeRuntime.runMain(
           return yield* Effect.die(new Error(`Missing ${pkg.file}`));
         if (Number((yield* fs.stat(pkg.file)).size) > npmArchiveBudgetBytes)
           return yield* Effect.die(
-            new Error(`npm archive exceeds the 180 MiB release budget: ${pkg.file}`),
+            new Error(
+              `npm archive exceeds the ${npmArchiveBudgetMiB} MiB release budget: ${pkg.file}`,
+            ),
           );
         const integrity = yield* integrityOf(pkg.file);
         const response = yield* http.get(`${registry}/executor/${pkg.version}`);
diff --git a/scripts/releases/runtime-bundle.ts b/scripts/releases/runtime-bundle.ts
index d2922b4289..b61d543908 100644
--- a/scripts/releases/runtime-bundle.ts
+++ b/scripts/releases/runtime-bundle.ts
@@ -29,6 +29,59 @@ const installedPackages = [
   "typescript",
 ] as const;
 
+/**
+ * The files of dugite's Git distribution the runtime keeps, by path relative to it. The bundled Git
+ * serves app repositories on this machine, through plumbing commands and `git http-backend`, and
+ * never reaches a remote. So the Git Credential Manager, Git LFS, network transports and scripted
+ * tools dugite also ships are left out. What stays is the `git` executable, `git http-backend`
+ * (which windows-git.ts adds on Windows after staging), the libraries they load, the templates
+ * `git init` copies and the licenses of what remains. Symbolic links to `git`, its argv[0]
+ * aliases such as `git-upload-pack`, stay as well.
+ */
+const keptGit = (platform: string): ReadonlyArray<RegExp> =>
+  platform === "win32"
+    ? [
+        /^LICENSE\.txt$/u,
+        /^cmd\/git\.exe$/u,
+        /^mingw64\/bin\/(git\.exe|libiconv-2\.dll|libintl-8\.dll|libpcre2-8-0\.dll|libwinpthread-1\.dll|zlib1\.dll)$/u,
+        /^mingw64\/libexec\/git-core\/git-http-backend\.exe$/u,
+        /^mingw64\/share\/git-core\/templates\//u,
+        /^mingw64\/share\/licenses\//u,
+      ]
+    : [
+        /^bin\/git$/u,
+        /^libexec\/git-core\/(git|git-http-backend)$/u,
+        /^share\/git-core\/templates\//u,
+      ];
+
+/** Remove everything from the Git distribution at `directory` that `keptGit` does not keep. */
+const pruneGit = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const kept = keptGit(process.platform);
+    const prune = (current: string): Effect.Effect<boolean, never, FileSystem.FileSystem> =>
+      Effect.gen(function* () {
+        let empty = true;
+        for (const name of yield* fs.readDirectory(current)) {
+          const file = path.join(current, name);
+          const relative = path.relative(directory, file).split(path.sep).join("/");
+          const info = yield* Effect.tryPromise(() => lstat(file));
+          if (info.isDirectory()) {
+            if (yield* prune(file)) yield* fs.remove(file, { recursive: true });
+            else empty = false;
+          } else if (
+            kept.some((pattern) => pattern.test(relative)) ||
+            (info.isSymbolicLink() && (yield* fs.readLink(file)) === "git")
+          )
+            empty = false;
+          else yield* fs.remove(file);
+        }
+        return empty;
+      }).pipe(Effect.orDie);
+    yield* prune(directory);
+  });
+
 /** The source substitutions both runtime builds share. */
 const sourcePlugin = (root: string) =>
   Effect.gen(function* () {
@@ -246,7 +299,7 @@ const internalWorkers = (directory: string) =>
     return workers;
   });
 
-/** Bundle both process entry points once; copy only locked native dependencies and resource files. */
+/** Bundle the CLI entry point; copy only locked native dependencies and resource files. */
 export const bundleLocalRuntime = (root: string, stage: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -279,10 +332,7 @@ export const bundleLocalRuntime = (root: string, stage: string) =>
     const bundled = yield* Effect.tryPromise(() =>
       build({
         absWorkingDir: root,
-        entryPoints: {
-          cli: "apps/local/server/src/bin.ts",
-          desktop: "apps/local/desktop/src/server.ts",
-        },
+        entryPoints: { cli: "apps/local/server/src/bin.ts" },
         outdir: output,
         outExtension: { ".js": ".mjs" },
         bundle: true,
@@ -373,6 +423,7 @@ export const bundleLocalRuntime = (root: string, stage: string) =>
     ] as const) {
       yield* copyPackage(yield* requiredPackage(name, owner));
     }
+    yield* pruneGit(path.join(stage, "node_modules/dugite/git"));
     // npm deliberately omits symbolic and hard links. Git uses argv[0] aliases;
     // preserve those commands with shell builtins instead of duplicating its binary.
     const materializeLinks = (
diff --git a/scripts/releases/runtime-env.d.mts b/scripts/releases/runtime-env.d.mts
index c2a5f0f571..e2ac05e715 100644
--- a/scripts/releases/runtime-env.d.mts
+++ b/scripts/releases/runtime-env.d.mts
@@ -1,5 +1,2 @@
 /** Types for runtime-env.mjs, which the npm package and desktop import as plain JavaScript. */
-export declare function packagedRuntimeEnvironment(
-  environment: Readonly<Record<string, string | undefined>>,
-  gitDirectory?: string,
-): Record<string, string | undefined>;
+export declare function useBundledGit(): void;
diff --git a/scripts/releases/runtime-env.mjs b/scripts/releases/runtime-env.mjs
index 62484aba17..f9c4880c4d 100644
--- a/scripts/releases/runtime-env.mjs
+++ b/scripts/releases/runtime-env.mjs
@@ -1,30 +1,11 @@
-/** Resolve packaged native tools at the process boundary, independent of a user's Git install. */
-import { delimiter, dirname } from "node:path";
-import { resolveEmbeddedGitDir, resolveGitExecPath, setupEnvironment } from "dugite";
+/** Name the packaged Git to the Executor server, independent of a user's Git install. */
+import { resolveEmbeddedGitDir } from "dugite";
 
 /**
- * Preserve the caller's environment while selecting the artifact's Git binary and helper programs.
- * `gitDirectory` is the bundled Git: dugite's own copy by default, or the copy beside a release
- * executable, whose bundled dugite cannot locate it from its module path.
+ * Point the server at the Git this package bundles, dugite's own copy. Only the server's Git host
+ * runs it, with the environment it needs; processes Executor starts for other purposes keep the
+ * caller's PATH and Git.
  */
-export function packagedRuntimeEnvironment(environment, gitDirectory = resolveEmbeddedGitDir()) {
-  const inherited = Object.fromEntries(
-    Object.entries(environment).map(([name, value]) => [
-      process.platform === "win32" ? name.toUpperCase() : name,
-      value,
-    ]),
-  );
-  const { env, gitLocation } = setupEnvironment(
-    {
-      LOCAL_GIT_DIRECTORY: gitDirectory,
-      GIT_EXEC_PATH: resolveGitExecPath(gitDirectory, ""),
-    },
-    inherited,
-  );
-  return {
-    ...env,
-    PATH: [dirname(gitLocation), env.PATH]
-      .filter((value) => value !== undefined && value !== "")
-      .join(delimiter),
-  };
+export function useBundledGit() {
+  process.env.EXECUTOR_GIT_DIRECTORY = resolveEmbeddedGitDir();
 }
diff --git a/scripts/releases/standalone-entry.ts b/scripts/releases/standalone-entry.ts
index 0df4b1ea8d..acb2f817ff 100644
--- a/scripts/releases/standalone-entry.ts
+++ b/scripts/releases/standalone-entry.ts
@@ -4,7 +4,6 @@
  */
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { packagedRuntimeEnvironment } from "./runtime-env.mjs";
 import type { StandaloneRelease } from "./runtime-bundle.ts";
 
 /** The install directory, from the bundle's banner. */
@@ -12,10 +11,9 @@ declare const __executorRoot: string;
 /** The release identity, defined at build time. */
 declare const executorRelease: StandaloneRelease;
 
-Object.assign(
-  process.env,
-  packagedRuntimeEnvironment(process.env, join(__executorRoot, "runtime", "git")),
-);
+// The server's Git host runs the Git beside the executable, which the bundled dugite cannot locate
+// from its module path. Other processes keep the caller's PATH and Git.
+process.env.EXECUTOR_GIT_DIRECTORY = join(__executorRoot, "runtime", "git");
 process.env.EXECUTOR_DATA_DIR ??= join(homedir(), ".executor", "v2", "cli");
 process.env.EXECUTOR_BUILD_VERSION = executorRelease.version;
 // The npm launcher names itself; started directly, the executable's own location shows how it
diff --git a/scripts/releases/windows-git.ts b/scripts/releases/windows-git.ts
index 4e383b1d05..5206c916c8 100644
--- a/scripts/releases/windows-git.ts
+++ b/scripts/releases/windows-git.ts
@@ -47,5 +47,7 @@ export const installWindowsGitHttpBackend = (stage: string) =>
     const extracted = path.join(temporary, helper);
     if (hash(yield* fs.readFile(extracted)) !== helperHash)
       return yield* new WindowsGitFailed({ stage: "helper" });
+    // The staged Git keeps nothing else in libexec/git-core (keptGit in runtime-bundle.ts).
+    yield* fs.makeDirectory(path.dirname(path.join(git, helper)), { recursive: true });
     yield* fs.copyFile(extracted, path.join(git, helper));
   }).pipe(Effect.provide(FetchHttpClient.layer), Effect.scoped);